The Government Cyber Action Plan: strengthening resilience across the UK

Summary

The Government Cyber Action Plan (GCAP) is the UK government’s refreshed framework for improving cyber security and digital resilience across the public sector. Developed by DSIT with technical support from the NCSC, GCAP sets out roles, governance, centralised support and milestones to close the gap between rising cyber threats and current defensive capability. It is organised across five delivery strands and will be implemented in phases through to 2029 and beyond.

Key Points

GCAP replaces/refreshes previous strategy to provide a clearer, action-led approach to public sector cyber resilience.
The plan is structured around five delivery strands: Accountability, Support, Services, Response and Skills.
Accountability tightens responsibility for accounting officers, CDIOs and CISOs to manage cyber risk effectively.
Centralised support and shared services aim to reduce duplication and deliver secure digital solutions ‘once and well’.
G-CIRP (Government Cyber Incident Response Plan) formalises incident responsibilities and reporting across departments.
GCAP creates a Government Cyber Security Profession to attract, upskill and retain specialist cyber staff for government.
The NCSC will support delivery across strands, providing technical authority, incident support and capability-sharing.
Phased implementation runs to 2029+, but early wins (better risk management and faster incident coordination) are expected in year one.

Content summary

Recent high-profile attacks against UK retail and manufacturing exposed a widening gap between threat levels and resilience in critical services. In response, DSIT and the NCSC refreshed the Government Cyber Security Strategy into GCAP to provide practical, coordinated action across central government.

GCAP’s five strands aim to align leadership accountability, provide hands-on technical support, deliver common services, improve incident response through G-CIRP, and build a professional cyber workforce within government. The NCSC will work alongside DSIT and the Government Cyber Coordination Centre (GC3) to support departments and cascade best practice.

Context and relevance

This plan responds directly to DSIT’s State of Digital Government Review and the National Audit Office’s findings that government resilience is lagging. For cyber security professionals and large organisations working with the public sector, GCAP signals stronger central governance, clearer responsibilities and more shared technical resources — changes that will affect procurement, compliance and incident handling.

GCAP also fits broader trends: consolidation of shared digital services, professionalisation of cyber roles, and a move towards central incident playbooks. Expect departments to face stricter assurance and reporting requirements and to have greater access to centrally managed expertise and services.

Why should I read this?

If you deal with public-sector IT, procurement or cyber, this is worth a skim — actually, more than a skim. GCAP will change who’s accountable, how incidents get handled and what central services you can tap into. It’s essentially the government saying: “we’re getting organised — get on board or expect new rules.”

Author note

Punchy take: this is a policy-level fix aimed at closing glaring gaps. If you want to know where central government is directing resources and oversight, GCAP tells you — and it matters for partners, suppliers and internal security teams alike.