Resilience Can’t Wait: Why Secure Data Mobility Must Lead Public Sector Reform

How can the government build technical resilience while wrestling with relentless structural reform and decades of inherited legacy tech?  Across Whitehall, local authorities, and national infrastructure, every priority, from citizen services to cross-agency AI, depends on secure data mobility. Strengthening public infrastructure cannot wait for full legacy retirement or structural stability; resilience must be achieved amid ongoing change. 

Cyber resilience is no longer a technical sub-item. When data availability fails or systems go dark, service delivery halts, public trust erodes, and operational continuity is compromised. Industry partners must help construct infrastructure where security and data access reinforce each other, enabling departments to share intelligence and innovate without legacy drag. 

The Structural Seams: Where Reform Meets Legacy Debt 

Policy drives change while legacy infrastructure absorbs the impact. Major reforms create operational seams vulnerable to exploitation, across: 

Local Government Reorganisation (LGR): Merging revenues, housing, and social care into unitary estates creates identity sprawl. Linking councils via flat networks expands the attack surface of any single breach. 

Great British Railways (GBR): Consolidating train operators requires converging corporate IT with trackside Operational Technology (OT). Protecting critical national infrastructure demands security independent of perimeter trust. 

Machinery of Government (MOG): Integrating policy, science, and trade portfolios highlights Whitehall’s restructuring pace. Cross-departmental teams need instant access to trade and research data without waiting for cumbersome network rewiring. When boundaries shift, inherited technical debt and stale permissions turn operational friction into cyber exposure. 

To summarise: strengthening public infrastructure cannot wait until the last legacy server is retired or the latest departmental restructure settles. Resilience must be built into the operational seams. 

The New Boardroom Calculus 

Under the NCSC’s Cyber Governance Code of Practice and the Cyber Security and Resilience Bill, cyber risk is a core strategic liability. Senior leaders require clear answers to three key questions: 

1. Continuity: Can essential services run if a major supplier or platform fails? 

2. Mobility: Can staff securely access sensitive data without exposing core legacy systems? 

3. Containment: If credentials or devices are compromised, can lateral movement across the estate be prevented? 

How Industry Steps Up: Zero Trust in Practice 

Securing data across legacy environments requires moving beyond trusted internal networks. Our job in industry must be to assist government in implementing an identity-first, Zero Trust architecture. This means: 

Decouple Access from the Network: Replace legacy VPNs by connecting verified users directly to specific applications based on identity, device posture, and real-time risk. Reorganising bodies can federate access without interconnecting legacy networks. 

Guardrail AI and Innovation: Build robust data loss prevention into AI deployments to prevent sensitive citizen records from leaking into untrusted models, supporting innovation safely. 

Isolate Supply Chain Risk: Grant third-party specialists zero-trust, browser-based access strictly to necessary applications, ensuring unmanaged partner devices cannot touch core government infrastructure. 

Resilient by Design, Not by Retrofit 

Resilient digital infrastructure is essential for effective governance. It enables local councils, transport systems, and central departments to collaborate smoothly despite legacy constraints. 

Embedding a Zero Trust baseline allows industry and government to create a digital public estate that is secure by design, resilient by default, and equipped to drive ongoing innovation.