HMICFRS inspection: scope, timing and methods
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published its Cybersecurity in Police Forces and Fire and Rescue Services report on 27 October 2026. The report was compiled from a three‑phase inspection carried out between January and May 2026. Inspectors conducted dozens of interviews, carried out “reality testing,” and scrutinised more than 260 documents from police services and fire and rescue services to build their assessment.
Where the forces and services are exposed: legacy systems and third‑party risk
HMICFRS identified legacy ICT systems as a “strategic risk,” noting that older systems create difficulties with patching and integration. The assessment also flagged exposure to third‑party risk, especially where ICT suppliers manage sensitive police data. Inspectors highlighted human error when using external services as a further vector of vulnerability tied to those suppliers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOperational and control weaknesses: backups, access and accountability
The report catalogued underdeveloped preparedness and resilience, including weaknesses in backups and incident response arrangements. Inspectors found basic control problems in several areas — access management, authentication, and provisioning/deprovisioning — that increase the chances an attacker could gain or retain unauthorised access. HMICFRS also recorded a lack of accountability at a senior level: several police and fire leaders told inspectors that cybersecurity is not part of daily operational decision‑making.
National coordination and capability: uneven maturity and a suggested centre for fire services
HMICFRS reported poor coordination at a national level, which has produced uneven levels of cyber maturity across the various police forces and fire and rescue services. To address that imbalance, inspectors recommended promoting the use of the Police Digital Service’s National Management Centre and creating a similar national capability for fire and rescue services.
Recommendations: baseline standards, third‑party testing and skills
HMICFRS made 13 recommendations to improve cybersecurity across policing and fire services. Among the measures proposed were introducing baseline cybersecurity standards to raise maturity — for example, the Cyber Assessment Framework — and subjecting services to third‑party assessment of cybersecurity capabilities. The report called for improved procurement and contract management of third‑party ICT suppliers, including mandatory Cyber Essentials certification for those suppliers.
Other prescriptions included enhancing collaboration between government and policing cybersecurity leads; improving preparedness to respond to attacks through stronger backup-and-restore capabilities and regular incident response exercises; and improving learning and development for senior leaders as well as cybersecurity staff.
What this means for police forces, fire and rescue services, and procurement leaders
- Police forces and fire and rescue services: the inspection urges them to treat cyber risk as operationally critical, tighten basic controls (access, authentication, provisioning), and rehearse incident response and backups to improve resilience.
- Procurement leaders and ICT suppliers: HMICFRS recommends stronger contract management and mandatory Cyber Essentials certification for suppliers handling sensitive police data, and calls for third‑party assessments of supplier and service capability.
- National and government cybersecurity leads: inspectors urged greater coordination and the expansion of national management capabilities — notably broader use of the Police Digital Service’s National Management Centre and the creation of a comparable national centre for fire and rescue services.
HMICFRS concluded that while there have been gradual improvements, many forces and services must "urgently redouble their efforts to respond to the increased risk of cyber-attacks," a warning that underscores the report’s central point: cybersecurity cannot safely remain a technical afterthought. The watchdog added that "the government’s program of police reform and local government reorganization could offer both sectors opportunities to improve and better co‑ordinate the approach to cybersecurity," and cautioned that those opportunities "cannot be missed. Protecting systems and data is essential to protecting the public."
HMICFRS delivered 13 concrete recommendations and a clear timetable of inspection activity; the practical work now falls to local and national leaders to translate standards, procurement rules and training into tighter controls and better incident readiness. Whether that translation happens — and whether coordination at the national level can close the uneven maturity gap the inspectors found — will determine how well police forces and fire and rescue services can prevent, detect, respond to and recover from the next serious cyber incident.
