Every Link Matters: The State of Supply Chain Security in the UK Public Sector

Introduction

Over the past two decades, the delivery of UK public services has become increasingly dependent on thousands of external suppliers and service providers. Payroll, pathology, case management, hosting, identity and network operations that public sector bodies once ran themselves are now delivered under contract, often by the same small group of providers working across government, local authorities, policing and the NHS. A modern public service is thus relying on platforms owned and operated by organisations outside the public body that depends on it to deliver public goods. The security perimeter of a government department, an arm’s length body or a council therefore extends well beyond its own organisational perimeter, to every supplier its services depend on, and even to the suppliers behind them.

Hostile states and criminal groups are increasingly exploiting these dependencies. The NCSC handled 204 nationally significant incidents in the year to August 2025, more than double the previous year, and its chief executive has said that most attacks now originate directly or indirectly from nation state actors. Attackers who cannot breach a well-defended department know they can still hope to breach it through a critical supplier with weaker controls. The government’s own Action Plan acknowledges as much: “Our adversaries see Government as a single target.”

The policy response has been substantial. Since January 2026, Accounting Officers have been personally accountable for cyber risk across their organisations, the arm’s length bodies they sponsor and the suppliers they depend on. Government now treats shared dependencies on major suppliers as a category of risk that no single organisation can manage. Accountability on this scale demands a matching level of insight into supply chains, and this report examines whether public sector supplier assurance can provide it.

It draws on Risk Ledger’s 2026 survey of cyber security and third-party risk professionals across the UK public sector. It also looks at platform data from a community of 26 government organisations and a community of 25 councils that have begun to manage supplier risk together with their peers.

The evidence points to two problems of different scale. Traditional supplier assurance is under strain even in its core task of assessing direct suppliers. The larger exposure lies further down the supply chain, in dependencies that public bodies share without seeing them. Looking at the experience of the public bodies already working together demonstrates how both problems can be addressed, and how this model of collective defence can shape the agenda.
‍

Section 1: The threat to public services and the policy response

1.1 A sustained, state-driven threat

The threat to UK public services has intensified for three consecutive years. Of the 429 incidents the NCSC handled in the year to August 2025, 204 were nationally significant and 18 were highly significant, the third annual rise in that most serious category (Annual Review 2025).

At CYBERUK 2026, Dr Richard Horne described the UK as caught in a “perfect storm” of rapid technological change and sustained geopolitical tension. He identified China as a peer competitor in cyberspace and set out continued hostile activity by Russia and Iran.

MI5’s Director General placed the same trend in its wider national security context. In his annual threat update in October 2026, Sir Ken McCallum said the UK had entered a new era of national security. MI5’s state threats caseload has quadrupled over a decade, and Russia and Iran are expanding hybrid campaigns that include cyber attacks and sabotage. He warned that the UK’s supply chains, energy grids and financial systems were “designed during simpler times for maximum efficiency” and are now vulnerable to malicious disruption and coercion. MI5 has made building resilience against that disruption a front-rank mission.

Frontier AI is adding pace to this pressure by enabling attackers to discover and exploit vulnerabilities at scale. In May 2026 the NCSC told organisations to prepare for a resulting wave of security patches. That pressure falls hardest on public bodies running large legacy estates with limited specialist staff.

The NCSC has also identified organisations’ growing reliance on managed service providers as a driver of breaches that originate with suppliers. A provider with privileged access to dozens of public bodies offers an attacker a return no single department can match.

The consequences reach the public directly. The ransomware attack on pathology provider Synnovis in June 2024 halted blood testing across south-east London. Two NHS trusts postponed more than 10,000 outpatient appointments and 1,700 elective procedures, according to the National Audit Office, and the government later put the cost at £32.7 million. In the same year, the compromise of a contractor-operated Ministry of Defence payroll system exposed data on around 272,000 serving personnel, reservists and veterans.

In both cases the affected public bodies had a direct contract with the supplier concerned. Section 3 shows that the harder cases begin further down the chain.

1.2 Uneven maturity across government

The public sector has to confront this threat from varying security maturity baselines. The NAO’s review of the first year of GovAssure found significant gaps in the cyber resilience of the 58 critical systems assessed independently. It found at least 228 legacy systems in use, 63 of them rated red for risk. It also reported that one in three central government cyber security roles was vacant or filled by temporary staff in 2023-24.

The Action Plan adds that 28% of the government technology estate is legacy technology and that 58% of government organisations report a basic cyber skills gap. It accepts that the 2022 strategy’s goal, for government to be resilient to known attacks by 2030, will not be met.

Maturity tends to decline beyond central government departments and bodies. Arm’s length bodies, councils and other smaller public sector bodies have fewer specialist staff and often struggle to access the central support available. The NAO found that departments had not met their responsibilities for the resilience of the wider sectors they oversee.

This variation in security maturities matters for supply chain risk management. A supplier that serves both a well-resourced department and a small arm’s length body links the security of the two. An attacker who compromises that supplier can reach whichever customer is least prepared to detect the intrusion.

1.3 The policy response

The Government Cyber Action Plan, published in January 2026, has responded by placing accountability where the risk sits. It creates a Government Cyber Unit within DCMS, backed by more than £210 million, to manage risks that cut across government.

Each Accounting Officer is now accountable for the cyber risk of their own organisation, of the arm’s length bodies their department sponsors, and of their suppliers. Boards must receive regular reporting on all three. Lead government departments must report on their arm’s length bodies’ risk using Cyber Assessment Framework outcomes, and must work together to reduce duplicated reporting. The Unit will also form strategic partnerships with the suppliers that carry most risk to the government.

The plan also distinguishes risks an individual organisation can manage from government-wide risks it cannot, and it places common dependencies on technology platforms and major suppliers in the second category. Government acknowledges in the same document that it has so far relied on each organisation managing risk on its own.

The Cyber Assessment Framework, now in its fourth version, provides the common standard behind this model. It is applied to central government through GovAssure, to the NHS through its Data Security and Protection Toolkit, and to councils through a voluntary local government version. Principle A4 requires organisations to understand and manage risk in their supply chains.
‍

The Cyber Security and Resilience Bill, which reaches Lords report stage in October 2026, completes the picture from the supplier side. It excludes central and local government from its duties, but it does bring medium and large managed service providers, data centres and designated critical suppliers into regulation, with incident notification requirements within 24 hours.

Many of the suppliers that public bodies depend on will therefore face stronger regulatory obligations than the bodies themselves. Public bodies will still carry the accountability for how those suppliers’ failures affect their services. The next section examines whether traditional third-party risk management practices give them the means to do so.
‍

Section 2: Third-Party Risk Management under strain

2.1 Frequent incidents, slow incident response

Risk Ledger’s 2026 survey, conducted by Censuswide, asked cyber security and third-party risk professionals across the UK public sector how their organisations assess and manage the security of their suppliers. Their answers reveal a model that finds it difficult to keep pace with a threat that has become endemic.

Supply chain incidents are now a regular feature of public sector operations. 82% of respondents experienced at least one cyber incident originating in their supply chain in the past year, and 40% experienced two or more. 86% rank supply chain incidents among their top three concerns for 2026. 

The TPRM assurance processes meant to reduce this risk, but its a slow and painful process for everyone involved. Not a single organisation surveyed can complete security due diligence on a new supplier in under a week, and only 26% can complete it within two weeks. Meanwhile, 42% need more than three weeks, and 16% need more than a month.

Public procurement rarely allows for that much time. Framework call-offs and fixed delivery dates push contracts towards signature while assessments are still under way, or reduce assessments to a check that certificates are in place.

2.2 Evidence that ages between reviews

Once a supplier is under contract, the evidence provided during an initial assessment can be out of date quickly. Only 28% of respondents said that they can monitor the internal security controls of their important suppliers continuously. 68% rely on arrangements that update quarterly or only when an event prompts a review, and a small remainder still works from annual spreadsheets.

Practitioners see this as the most serious weakness in current practice: 30% of the respondents name the inability to monitor suppliers’ internal controls continuously as the single biggest shortcoming of third-party risk management, more than any other factor.

The concern is well founded. A supplier’s security posture changes as staff leave, systems are replaced, subcontractors change and new vulnerabilities emerge in the software it uses or provides. An assessment completed at contract stage merely provides a snapshot of a supplier’s security maturity at that point-in-time. A public body that reviews annually may learn of a material control weakness only months after it emerged, or only when an incident exposes it.

External scanning helps by showing how a supplier’s internet-facing systems appear from the outside, but it cannot show how the supplier manages access, patches internal systems or prepares to respond to an attack. Only the supplier can provide that evidence, and only they can keep it current and share it with the organisations that depend on it.

2.3 The cost of duplication

Slow due diligence and stale evidence have a common cause. Public sector supply chain assurance is bilateral: every public body assesses each of its suppliers separately, with its own questionnaire, on its own timetable. A supplier serving dozens of public bodies answers broadly similar questions dozens of times a year, often in incompatible formats. Each of those bodies then holds its own copy of largely the same evidence.

The cost lands on the resource the public sector can least spare. Section 1 set out the vacancy rate and skills gap in government cyber teams. Every hour a specialist spends collecting evidence that a peer organisation already holds is an hour not spent acting on the weaknesses that evidence reveals. The same pressure forces most bodies to assess in cycles and to reserve full assessment for a small group of its most critical suppliers.

Suppliers bear the same burden, and the quality of their answers declines as requests multiply. Smaller suppliers in particular respond with less care, or stop responding entirely. One in ten respondents names low supplier engagement as the main shortcoming of current practices.

The government has officially recognised this problem since 2022, when the Government Cyber Security Strategy committed to shared assurance that would reduce duplication. The Action Plan’s requirement for lead government departments to cut duplicated reporting shows that the commitment remains largely unmet.

2.4 The practitioners’ verdict

While traditional third-party risk management continues to have its place, and is essential as a basis, only 12% of respondents regard it as very effective. The rest of the profession sees partial protection at best against a growing and ever more complex threat. The TPRM weaknesses respondents commonly identify revolve around the lack of continuous monitoring, resources, supplier engagement and collaboration with peers.

Everything examined so far concerns the relationship between a public sector body and its direct suppliers. That is where the current TPRM model remains strongest, and what public sector bodies have the most control over. The more serious threat, however, increasingly lies beyond third parties, in suppliers that organisations have never selected and often don’t know they have an exposure to.
‍

Section 3: In focus: Risks beyond third parties

3.1 Suppliers that public bodies never contracted with

A growing share of the most damaging supply chain incidents today reach organisations through suppliers they never worked with themselves, or assessed. The compromise can start one or more tiers down the chain and then trickle down to the affected organisation through a direct supplier.

The MOVEit breach of June 2023 showed how this can unfold. The Clop group exploited a previously unknown vulnerability in MOVEit Transfer, a file transfer product used by Zellis, a payroll provider to hundreds of UK organisations. Zellis confirmed that data belonging to eight of its customers had been taken. The BBC, British Airways and Boots were among them, and the names, National Insurance numbers and in some cases bank details of their staff were exposed.

Each of these organisations held a contract with Zellis and would have likely assessed it in depth. The breached product, however, was a tool Zellis had chosen for its own operations, one tier beyond anything its customers had reviewed.

The ransomware attack on Collins Aerospace in September 2025 had similar implications. Collins runs MUSE, a check-in and boarding platform that lets many airlines share desks and gates at the same airport. When ENISA confirmed the ransomware attack that disabled it, Heathrow, Brussels and Berlin had already fallen back on having to rely on manual check-ins. Brussels Airport asked airlines to cancel 140 of 276 departures in a single day. The airlines lost check-in capability through a platform their airports had chosen, and their own supplier assurance had never covered.

The UK public sector faces the same risks. Arm’s length bodies use shared services selected by their sponsoring departments, councils depend on platforms run by neighbouring authorities, and every school in Northern Ireland depends on C2k.

The Glasgow incident of June 2025 was another example of the cascading implications of a single supplier breach. CGI, Glasgow City Council’s main ICT provider, detected malicious activity on servers run by one of its own suppliers. The attack disrupted the council’s online services, including planning, parking enforcement and the Strathclyde Pension Fund portal. It then reached North Lanarkshire and East Dunbartonshire, which relied on Glasgow’s systems for parking penalties. For those two councils, the point of compromise sat three steps away from any contract they held.

3.2 Supply chain visibility often stops at the second tier

Public bodies have made real progress in seeing past their direct suppliers. Every survey respondent reported at least some visibility beyond its critical third parties, and 60% claim they can see all the subcontractors of their most critical suppliers. Visibility of the full chain is much rarer. Only 24% suggest they see the complete set of fourth, fifth and further-tier suppliers behind their important services, which leaves 76% working with a partial picture.

The reason for the lack of supply chain visibility is implicit in the very term Third-Party Risk Management. Knowledge of deeper dependencies sits with each supplier individually. To obtain it, each public body has to ask each supplier to list its own subcontractors, and to ask them to list theirs and so forth, which is unrealistic and impractical. The further down the chain the risk sits, the less likely any single public body can see it.

3.3 Concentration across the public sector

Third, fourth and nth-party risk can also be systemic when many public bodies all share the same supplier, directly or indirectly. A failure at such a supplier can then disrupt services across an entire sector at once.

The public sector has experienced this repeatedly over the past two years. An attack on the shared IT environment hosted by Kensington and Chelsea in November 2025 disrupted three London boroughs simultaneously. In April 2026, the compromise of C2k, the managed service Capita operates for Northern Ireland’s schools, required the Education Authority to reconnect more than 414,000 user accounts. The faulty CrowdStrike update of July 2024 cost the UK economy an estimated £1.7 billion to £2.3 billion and required a cross-government response.

The supply chain insights needed to anticipate such failures is spread across hundreds of separate supplier registers. Think of the example of five arm’s length bodies sponsored by the same department. Each may contract a different case management provider, and all five providers may host in the same cloud region and authenticate users through the same identity service. Each arm’s length body sees one contract, and the department sees five unrelated relationships. The shared dependency only becomes visible when their supply chain maps are combined.

The consequences show most clearly when an incident strikes. Only 4% of respondents can map their exposure across their supplier ecosystem within four hours of a major supplier compromise, and only 40% within a day. 60% need longer than a day, and 28% need three days or more. Establishing exposure still means emailing suppliers individually and reconciling their answers with contract and risk registers. Every other public body using the same supplier runs the same exercise at the same moment, while the supplier’s security team is trying to contain the incident.

The exercise is slower still where no direct relationships with the security teams of suppliers exists. Only 42% of respondents confirmed that they have such direct contact with the security teams at most of their critical suppliers.

3.4 Accountability without visibility

The Action Plan has also already recognised this category of risk. It classifies common dependencies on major suppliers and platforms as government-wide risk, owned centrally by the Government Cyber Unit. Since January 2026 it has also made every Accounting Officer accountable for supplier risk across their department and its arm’s length bodies.

The plan’s timetable for building the visibility that accountability requires runs considerably longer. Restoration readiness plans with mapped dependencies are due by April 2029. The main supply chain assurance milestone falls in Phase 3, from April 2029. It expects 90% of lead government departments and half of arm’s length bodies to undertake some form of supply chain assurance, with an annual Cyber Essentials check as the minimum.

The 2022 Government Cyber Security Strategy had already committed to central mapping of government’s critical and common suppliers. The Action Plan’s acknowledgement that government-wide risks have not been adequately identified shows how little of that mapping has taken place as of yet.

The result is a gap between what Accounting Officers are answerable for and what they can actually see. This shortcoming can’t be overcome simply by each organisation assessing its own suppliers more thoroughly, because the dependencies that matter most only appear once many organisations combine what they can see individually. Several groups of public sector bodies, however, have already begun to do exactly that.
‍

Section 4: Securing public sector supply chains together

4.1 The basis for collaboration

As already argued, the dependencies described in Section 3 cannot be managed by any public body acting alone. Dr Horne made the same point about how to handle the wider threat at CYBERUK 2026 when he stated: “We cannot manage the risk in isolation.”

The public sector already applies this principle to threat intelligence. Regional WARPs bring council security practitioners together to exchange incident information under the Chatham House Rule and the Traffic Light Protocol. The Government Cyber Coordination Centre coordinates the cross-government response to threats and incidents. The Action Plan cites NHS England’s central monitoring of NHS Microsoft 365 environments as a model for detection delivered across a whole sector.

Supplier assurance has begun to follow. Policing’s Third Party Assurance for Policing programme assesses suppliers once and shares the results across forces; it runs on the Risk Ledger platform. Among central government departments and their arm’s length bodies, assurance remains largely bilateral.

The public sector is ready to change that. The survey revealed that 96% of respondents would support a model in which supplier intelligence and assurance data are shared with peers without disclosing commercially sensitive information. That includes 32% who would be very supportive, and only 2% would oppose it. Their view matches the Action Plan, which makes “Defend as One” a core behaviour and expects government organisations to address government-wide risk together, even where that risk is not a priority for any one of them.
‍

4.2 How shared assurance works in practice

Under Risk Ledger’s shared assurance model, each supplier completes one security profile against a standardised framework mapped to the Cyber Assessment Framework, ISO 27001 and NIST. The supplier keeps the profile current and grants access to its customers. Each public sector body can then review that evidence against its own requirements and make its own risk decisions.

Suppliers connect to their own suppliers in the same way, which extends every customer’s view into the deeper tiers. Within Risk Ledger communities, members can choose to collaborate with their peers and securely combine their maps. The combined map shows which suppliers serve several members at once and what sits behind them. Members can then engage shared suppliers jointly and coordinate their response when a supplier is caught up in an emerging threat.

Risk Ledger’s network now connects more than 19,000 organisations. The two communities examined below are among the largest public sector groups that have decided to engage in this degree of collaboration. Risk Ledger is also supporting work under the Government Cyber Action Plan to improve visibility of supplier risk across government.

4.3 Central government

Thirty-one government departments and arms length bodies have come together to manage supplier risk in such a shared Risk Ledger community. Their aims are to build a central view of systemic risk and to standardise supplier assurance across government.

Together they have connected with 2,499 direct third-party suppliers. Through those suppliers’ own connections, the combined map has identified a further 4,617 dependencies, including 2,539 4th-parties and 2,078 nth-parties, more than covering the tiers in which the MOVEit and Glasgow compromises originated. None of the 31 members could have assembled this picture from its own records.

The map has also identified 928 potential concentration risks, 289 of them at the third-party level, 88 at the fourth and a further 551 at the nth-party level. Members rated 139 of the third-party concentration risks as critical, meaning an incident at that supplier would be likely to disrupt essential services at several government organisations at once.

The data also shows where controls are weak among those critical suppliers. Of the 289, 16.4% did not hold Cyber Essentials certification, 15 do not regularly test their business continuity and disaster recovery plans, and two do not use multi-factor authentication for remote access. A missing certificate does not prove a missing control, since PPN 014 accepts equivalent controls. The findings still give members a short, specific list of suppliers to engage, and they can engage those suppliers together.

4.4 Local authorities

In a second such Risk Ledger community, a group of 25 councils have come together to collaborate on supply chain assurance, supported by regional WARPs, including ISfL and SEGWARP. Within two weeks of joining, the initial group of 10 councils had compared 300 supplier names and connected to 180 direct suppliers. They found that sixty per cent of those suppliers were already using Risk Ledger and maintained active profiles. This meant that they could connect with them and review their security posture in hours, compared to the weeks it would usually take to assess a supplier from scratch. 

Six months later the community had grown to 20 councils, now also supported by the South West WARP, with more than 800 direct suppliers connected to them. The new joiners now found 70% of their suppliers already present. By then the platform also showed how concentrated the councils’ dependencies were. Eight suppliers each served at least half the members, ten fourth parties sat behind three or more of their direct suppliers, and one supplier served every participating council.

The community now includes 25 councils across Scotland, England and Wales. Together they have connected with 1,004 direct suppliers, and the combined map has identified a further 7,659 dependencies behind them, more than 3,600 of them at the seventh and eighth tiers. The map has identified 1,240 potential concentration risks, and members rated 99 third-party concentration risks as critical. Thirteen of those 99 critical suppliers lack Cyber Essentials certification.

4.5 What the communities show

Before joining, each member of these communities could only see its own supply chain. None could see the hundreds of critical concentration risks, or the thousands of deeper dependencies, that appeared once their maps were combined. The communities have produced the visibility that Section 3 found missing, and they have done so years ahead of the Action Plan’s own milestones.

The model also changes the economics of assurance. Most suppliers already held current profiles, so assessment began within hours of an organisation joining. Staff time moved from collecting evidence to acting on it. Each new member benefits from the work of those who joined before it. A remediation request raised jointly by many public sector bodies together also carries more weight with a supplier than the same request just coming from one client.
‍

Section 5: A shared agenda

The evidence in this report points to four shifts in how the public sector should manage supplier risk. Each one builds on an outcome the Government Cyber Action Plan already sets. None of them needs to wait for the plan’s later phases, because the communities in Section 4 show they can be delivered now.

5.1 Visibility across each departmental family

Accounting Officers are accountable for supplier risk across their departments and arm’s length bodies. Each body in that family still manages its suppliers separately, so no Accounting Officer yet sees the family’s supply base as a whole.

Departmental security leaders should build that view first. They should combine supplier data from the department and its arm’s length bodies, using a common definition of supplier criticality, to identify which suppliers serve several bodies at once and which support the most important services. The result should inform the risk strategy and board reporting the Action Plan requires.

Arm’s length bodies with limited specialist capacity gain most by concentrating their own assurance effort on the suppliers they share with their department and other public bodies, since a weakness at one of those suppliers exposes the whole family.

5.2 Shared evidence

The duplication of effort in traditional, siloed TRPM described in Section 2 can also be removed without weakening any public sector body’s individual scrutiny of its own suppliers. A common assessment baseline, mapped to the Cyber Assessment Framework and the government profiles used in GovAssure, allows each supplier’s evidence to be collected once and reviewed by every organisation that relies on it. Each body keeps its own requirements and makes its own risk decisions.

The Government Cyber Unit can speed this up by recognising shared assurance as an accepted way to meet supplier assurance expectations. In the light of what the existing communities have achieved, it might also want to consider earlier and broader targets than the Phase 3 milestone. Suppliers have a matching responsibility: maintaining one current profile for all their public sector customers removes most of the repeated requests they receive today.

5.3 Dependency maps across government

Government-wide supplier risk can only be managed once it can be seen. The Government Cyber Unit should set common standards for supplier data during Phase 1, so that maps from different departments can be combined when risk aggregation begins in Phase 2. The resulting picture would also inform the designation of strategic suppliers.

Departments and arm’s length bodies should begin mapping the dependencies behind their most important services now, starting with managed service providers, cloud platforms and shared services. Their critical suppliers should be expected to disclose and maintain the dependencies on which their own delivery rests.

The same logic extends across sectors. Councils, NHS trusts, police forces and central government often rely on the same providers. MHCLG, DHSC, the Home Office and the Government Cyber Unit should agree how dependency data from their sector communities can be combined.

5.4 Coordinated response

As our survey showed, most public sector bodies need more than a day to establish their supply chain exposure when a supplier is compromised. That gap can be closed before the next major incident.

Public sector bodies already using Risk Ledger have established contacts with the security teams at their suppliers and are notified automatically when any of their security controls change. Moreover, when an emerging threat strikes, the platform notifies all suppliers on its platform to ascertain whether they are affected, whether they are investigating, remediating or unaffected. Their answers are then shared automatically with all their connected public sector clients on the platform, which will aid their ability to learn whether and how any of their suppliers might be impacted.

These exercises should very much align with the Government Cyber Incident Response Plan once it is published as a shared dependency map would let GC3 identify every public body relying on a compromised supplier within hours.
 

‍

Conclusion: Securing public sector supply chains together

The UK public sector faces a sustained, increasingly state-driven threat with a new and demanding accountability framework. The Government Cyber Action Plan has placed responsibility for supplier risk with Accounting Officers. It has also recognised that dependencies shared across government form a category of risk no single organisation can manage alone.

As our research demonstrated, current assurance practice adequately cannot support such enhanced accountability. It struggles even with direct suppliers: due diligence takes weeks and there is a glaring lack of continuous monitoring between review cycles. An even greater weakness is structural. The incidents of recent years show that serious incidents increasingly originate with breaches at suppliers that public sector bodies don’t themselves use, but which one or more of their suppliers use.

The government and councils that have begun to manage supplier risk with their peers have shown that this gap can be closed. Their combined supply chain maps exposed dependencies and concentration risks that none of them could see alone. Shared evidence cut assessment from weeks to days. Joint engagement gave them leverage with suppliers that no single body has alone. In many ways, they are already doing now what the Action Plan expects of the sector over the rest of the decade, and their example deserves to be followed across departments, arm’s length bodies and the wider public sector.

The same suppliers also serve banks, utilities, retailers and manufacturers. Financial institutions are also already mapping their shared dependencies under DORA and the UK operational resilience regime, using the Risk Ledger platform. Each sector that maps its supply chain collectively adds to a clearer national understanding of where the UK’s critical dependencies lie. MI5 has made national resilience a core mission and has called for a whole-of-society effort to build it. Supply chain security is one of the clearest areas to put that effort into practice.

The Government Cyber Security Strategy asked the government to Defend-as-One. Applying that principle to the supply chain means treating assurance evidence, dependency maps and incident information as shared assets of the public sector. Adversaries already treat the government as a single target. Public bodies that see and act on their supply chains together will be far better placed to resist them.

‍