Government security leaders should prioritize by service. Identify the citizen-facing and national functions that cannot fail, then fund protection, resilience and legacy exit in that order. A ranking by system or by agency hides the dependencies that cause the worst outcomes.
What sets government apart
A government cannot withdraw a service that is failing. Benefits, identity, licensing, health and emergency services have statutory duties behind them, and citizens have no alternative supplier.
Four other features shape the risk. Governments hold long-lived records on whole populations. Their adversaries include states with time and resources. Budgets and procurement cycles lock in architecture for years. And services are shared: one agency’s platform often carries another’s workload, so risk is inherited as well as owned.
Accountability is public too. An outage or a breach becomes a political event. That affects how risk is accepted, and by whom, which is where many government risk registers are weakest.
Where exposure concentrates
| Exposure | Why it matters for government | Decision to settle |
|---|---|---|
| Citizen services and digital identity | Failure stops payments, permits and entitlements, and can enable fraud against citizens at scale. | Which services are critical, what they depend on, and the maximum tolerable outage for each. |
| Legacy systems | Long-lived applications and platforms that are costly to replace and difficult to secure. | For each: retire, isolate, or accept with compensating controls and an expiry date. |
| Shared services and supply chain | Common platforms and suppliers carry many agencies. A compromise upstream reaches everyone downstream. | Who owns the risk on a shared platform, and who may accept it on behalf of others. |
| Sensitive information | Population-level records, security-relevant data and policy material attract espionage and theft. | What must stay in-country or on controlled systems, and what level of protection follows each class of data. |
| Privileged access and contractors | Contractors and administrators across agencies hold broad access, often outside direct oversight. | Who holds privileged access, how it is time-limited, and how it is reviewed. |
| Smaller and regional bodies | Local and regional authorities run critical services with thin security capacity. | Whether central government provides shared capability, standards or funding. |
What the evidence shows
The supply chain risk is documented. In the SolarWinds incident, attackers compromised a software update mechanism and used it to reach multiple US federal agencies. The point for any government is how far a single supplier’s trust relationships extend.
Resilience at national scale is documented too. Costa Rica declared a national emergency after ransomware attacks hit several government bodies. Our reading is that attacks on smaller or poorly resourced public bodies can become national events when central services depend on them.
Priorities, in order
1. Identify critical services and map what they depend on. Rank by the consequence of failure for citizens and the state, then trace dependencies across agencies, suppliers and platforms.
2. Put legacy on a timetable. Every legacy exception needs an owner, compensating controls and an expiry. An exception with no end date becomes the architecture.
3. Control privileged access across agencies and suppliers. Reduce standing access and review it often. Identity compromise is the usual route to the data and systems that matter.
4. Set expectations for suppliers and shared platforms. Require evidence, not assertions, and plan for the failure of a supplier that many services share.
5. Prepare to operate and recover at service level. Test the manual or degraded mode of critical services, not just the recovery of the underlying systems.
Legacy: three options, not one
| Option | When it fits | What it requires |
|---|---|---|
| Retire or replace | The service is critical and the platform cannot be secured. | Funded program that outlasts the budget cycle, and a plan for data migration. |
| Isolate | Replacement is years away and the system can be separated. | Segmentation, restricted access, monitoring, and a named owner for the residual risk. |
| Accept with an expiry | The risk is low and cost of change is high. | A documented acceptance by someone with authority to accept it, and a date on which it is reviewed. |
Frameworks and obligations
Requirements differ widely by country, level of government and sector. Confirm what applies to each body.
| Framework or regime | Relevance to priorities |
|---|---|
| NIST Cybersecurity Framework 2.0 | Adds a Govern function covering risk strategy, roles and oversight. Useful for setting service-level priorities and decision rights. |
| UK NCSC Cyber Assessment Framework | Outcome-based framework used for government and critical national infrastructure. Assesses whether essential functions are protected. |
| EU NIS2 Directive | Includes public administration entities of central government, with risk management and incident reporting requirements. |
| UAE and GCC | Federal and emirate-level information security and assurance requirements apply, alongside national data and cybersecurity authorities. Check which apply to each entity. |
Indicators worth reporting
-
Number of critical services with a mapped dependency chain and a tested degraded mode.
-
Number of legacy exceptions past their expiry date.
-
Share of privileged accounts that are time-limited and reviewed.
-
Share of shared-platform suppliers that have supplied validated control evidence.
| **** |
|---|
Sources
-
National Institute of Standards and Technology, Cybersecurity Framework 2.0. nist.gov nist.gov
-
National Cyber Security Centre (UK), Cyber Assessment Framework. ncsc.gov.uk ncsc.gov.uk
-
European Union, NIS2 Directive on measures for a high common level of cybersecurity. eur-lex.europa.eu eur-lex.europa.eu
-
Cybersecurity and Infrastructure Security Agency, emergency directive and related analysis on the SolarWinds compromise. cisa.gov cisa.gov
-
Public reporting on the ransomware attacks on Costa Rican government bodies and the national emergency declaration. krebsonsecurity.com
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionManage Cyber Risk & ExposureKnow what attackers can reach and what it would cost.See how we work →Related service
Cyber Risk & Governance
Use this industry view to prioritize Government cyber-risk decisions.