The government has surveyed UK businesses, charities and educational institutions to find out how they approach cyber security and gain insight into the cyber security issues they face. The research informs government policy on cyber security and how government works with industry to build a prosperous and resilient digital UK.
19 April 2023
Respondents were asked about their approach to cyber security and any breaches or attacks over the 12 months before the interview. Main survey interviews took place between October 2022 and January 2023. Qualitative follow up interviews took place in December 2022 and January 2023.
UK
The survey is part of the government’s National Cyber Strategy 2002.
There is a wide range of free government cyber security guidance and information for businesses, including details of free online training and support.
The survey was carried out by Ipsos UK. The report has been produced by Ipsos on behalf of the Department for Science, Innovation and Technology.
This release is published in accordance with the Code of Practice for Statistics (2018), as produced by the UK Statistics Authority. The UKSA has the overall objective of promoting and safeguarding the production and publication of official statistics that serve the public good. It monitors and reports on all official statistics, and promotes good practice in this area.
The document above contains a list of ministers and officials who have received privileged early access to this release. In line with best practice, the list has been kept to a minimum and those given access for briefing purposes had a maximum of 24 hours.
The Lead Analyst for this release is Emma Johns. For any queries please contact cybersurveys@dsit.gov.uk.
For media enquiries only, please contact the press office on 020 7215 1000.
The Cyber Security Breaches Survey, 2022 (CSBS) was run to understand organisations' approaches and attitudes to cyber security, and to understand their experience of cyber security breaches. The aim of the survey was to support the Government by providing evidence that can inform policies which help to make Britain a safer place to do business online. Details of changes for the 2022 survey can be found in the Technical Annex documentation.
These surveys have been conducted annually since 2016 to understand the views of UK organisations on cyber security. Data are collected on topics including online use; attitudes of organisations to cyber security and awareness of Government initiatives; approaches to cyber security (including investment and processes); incidences and impact of a cyber security breach or attack; and how breaches are dealt with by the organisation. This information helps to inform Government policy towards organisations, including how best to target key messages to businesses and charities so that they are cyber secure (and so that the UK is the safest place in the world to do business online). The study is funded by the DCMS as part of the National Cyber Security Programme.
The underlying data are useful for researchers to better understand the response across a range of organisations and for wider comparability over time. The survey originally only covered businesses but was expanded to include charities from the 2018 survey onwards. From 2020, the survey includes a sample of education institutions (primary and secondary schools, further and higher education). Please note that the UK Data Service only holds data from 2018 onwards.
Further information and additional publications can be found on the GOV.UK Cyber Security Breaches Survey, 2022 webpage.
This is because it would breach the first data protection principle as: a) it is not fair to disclose claimant personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the claimant. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/40
The Cyber Security Breaches Survey, 2021 (CSBS) was run to understand organisations' approaches and attitudes to cyber security, and to understand their experience of cyber security breaches, especially in light of the COVID-19 pandemic. The aim of the survey was to support the Government by providing evidence that can inform policies which help to make Britain a safer place to do business online. Details of changes for the 2021 survey can be found in the Technical Annex documentation.
These surveys have been conducted annually since 2016 to understand the views of UK organisations on cyber security. Data are collected on topics including online use; attitudes of organisations to cyber security and awareness of Government initiatives; approaches to cyber security (including investment and processes); incidences and impact of a cyber security breach or attack; and how breaches are dealt with by the organisation. This information helps to inform Government policy towards organisations, including how best to target key messages to businesses and charities so that they are cyber secure (and so that the UK is the safest place in the world to do business online). The study is funded by the DCMS as part of the National Cyber Security Programme.
The underlying data are useful for researchers to better understand the response across a range of organisations and for wider comparability over time. The survey originally only covered businesses but was expanded to include charities from the 2018 survey onwards. From 2020, the survey includes a sample of education institutions (primary and secondary schools, further and higher education). Please note that the UK Data Service only holds data from 2018 onwards.
Further information and additional publications can be found on the "http://GOV.UK" target="_blank"> GOV.UK Cyber Security Breaches Survey, 2021 webpage.
Please be aware that I have decided not to release the full details where the total number of individuals falls below five. This is because the information is exempt under section 40(2) of the FOIA (personal information). This is because it would breach the first data protection principle as: a. it is not fair to disclose individual’s personal details to the world and is likely to cause damage or distress b. these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the individual Please see the following link to view the section 40 exemption in full: https://www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Confidentiality Please note that the identification of individuals is also a breach of the common law duty of confidence. An individual who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please see the following link to view the section 41 exemption in full: https://www.legislation.gov.uk/ukpga/2000/36/section/41
https://www.gov.uk/government/publications/environment-agency-conditional-licence/environment-agency-conditional-licencehttps://www.gov.uk/government/publications/environment-agency-conditional-licence/environment-agency-conditional-licence
This record holds data from 2015 to 2023. Previous years data is available on request.
We use compliance ratings to help assess the risks from a regulated facility.
An operator’s compliance record will affect whether they pay a subsistence charge that is higher or lower than the base charge. We will calculate a compliance rating for an operator based on their compliance record. We calculate a compliance rating after a permit has been issued and use a standard approach called the Compliance Classification Scheme to classify permit breaches. A compliance rating only applies to a permit for a waste operation or installation. It does not apply to farming installations operated by members of the our Pig and Poultry Assurance Scheme, or waste mobile plant.
We identify and record any non-compliances in the course of a calendar year – January to December. We use this information to work out a compliance rating based on a points system. For permits that cover more than one activity, the compliance rating will apply to the whole permit. We convert permit breaches into a points system. We add the points from each breach to calculate an annual total of non-compliance points. We allocate points based on the amount of extra work we usually have to do when dealing with different types of permit breaches.
CCS Category breach 1 (most serious) 60 points CCS Category breach 2 (serious) 31 points CCS Category breach 3 (less serious) 4 points CCS Category breach 4 (minor) 0.1 points
Based on the cumulative score over a calendar year, we place each site into one of six compliance bands A to F. Band A 0 points Discount of 5% on subsistence charge Band B 0.1-10 points No impact on subsistence charge Band C 10.1-30 points 10% increase on subsistence charge Band D 30.1-60 points 25% increase on subsistence charge Band E 60.1-149.9 points 50% increase on subsistence charge Band F 150+ points 200% increase on subsistence charge
CHANGES TO THIS DATASET This dataset was previously provided in the Opra record. The Opra scheme has now been replaced by a new charging scheme.
https://www.gov.uk/government/publications/environment-agency-conditional-licence/environment-agency-conditional-licencehttps://www.gov.uk/government/publications/environment-agency-conditional-licence/environment-agency-conditional-licence
Datasets available are from 2014 to 2023 from the resources links.
These datasets contain details of condition breaches on Environmental Permitting Regulations (2010) waste and installation permits from 2014. This dataset may exclude some records on the basis of National Security or Commercial Confidentiality.
A briefing accompanies the data.
The Cyber Security Breaches Survey, (CSBS) is run to understand organisations' approaches and attitudes to cyber security, and to understand their experience of cyber security breaches.. The aim of the survey is to support the Government by providing evidence that can inform policies which help to make Britain a safer place to do business online.
These surveys have been conducted annually since 2016 to understand the views of UK organisations on cyber security. Data are collected on topics including online use; attitudes of organisations to cyber security and awareness of Government initiatives; approaches to cyber security (including investment and processes); incidences and impact of a cyber security breach or attack; and how breaches are dealt with by the organisation. This information helps to inform Government policy towards organisations, including how best to target key messages to businesses and charities so that they are cyber secure (and so that the UK is the safest place in the world to do business online). The study is funded by the DCMS as part of the government's £2.6 billion National Cyber Strategy 2022 to protect and promote the UK in cyber space.
The underlying data are useful for researchers to better understand the response across a range of organisations and for wider comparability over time. The survey originally only covered businesses but was expanded to include charities from the 2018 survey onwards. From 2020, the survey includes a sample of education institutions (primary and secondary schools, further and higher education). Please note that the UK Data Service only holds datasets on each specific year from 2018 onwards.
Cyber Security Breaches Survey: Combined Dataset, 2016-2022 includes data from 2016 to 2022. This is cross-sectional data only and not all variables are included in all years. For longitudinal data, please access the Cyber Security Longitudinal Survey: Wave 1, 2021 (available from the UK Data Archive under SN 8969) and onwards.
Further information and additional publications can be found on the GOV.UK Cyber Security Breaches Survey webpage.
a - it is not fair to disclose individual’s personal details to the world and is likely to cause damage or distress. b - these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the individual. Please click the below web link to see the exemption in full. www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Confidentiality Please note that the identification of individuals is also a breach of the common law duty of confidence. An individual who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/41
This is because it would breach the first data protection principle as: a) it is not fair to disclose patients’ personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the patients. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Patient confidentiality Please note that the identification of patients is also a breach of the common law duty of confidence. A patient who has been identified could make a claim against the NHSBSA or yourself for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/41 Questions 2 & 3 The COVID-19 vaccines are very new and the global effort to establish any potential causal relationship between the vaccines and their potential adverse effects is not straightforward and has taken time. Claims relating to Covid-19 vaccines have not yet been medically assessed, therefore there have been no payments made to date. Question 4 There have been fewer than 5 claims rejected due to those claims falling outside the eligibility criteria. Therefore this information is being withheld under the same exemption outlined in the response to question 1 above. Data Queries
The annual reports of the Cyber Security Breaches Survey can be found on the Cyber Security Breaches Survey collection page.
Geographic coverage: UK.
If you would like any further information please contact statistics@dsit.gov.uk.
Date published | Ad hoc detail | Data tables |
---|---|---|
January 2024 | Cyber security practices among organisations who do/ do not adhere to Cyber Essentials |
a - it is not fair to disclose claimant personal details to the world and is likely to cause damage or distress. b - these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the claimant. Please click the below web link to see the exemption in full. www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Patient confidentiality Please note that the identification of claimants is also a breach of the common law duty of confidence. A claimant who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full.
a - it is not fair to disclose claimant personal details to the world and is likely to cause damage or distress. b - these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the claimant. Please click the below web link to see the exemption in full. www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Patient confidentiality Please note that the identification of claimants is also a breach of the common law duty of confidence. A claimant who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full.
Response I can confirm that the NHSBSA holds the information you have requested and a copy of the information is attached. Fewer than 5 Please be aware that I have decided not to release details where the total number of beneficiaries falls below 5. This is because the beneficiaries could be identified, when combined with other information that may be in the public domain or reasonably available. This information falls under the exemption in section 40 subsections 2 and 3A (a) of the Freedom of Information Act. This is because it would breach the first data protection principle as: a) it is not fair to disclose beneficiary personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the patients. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Patient confidentiality Please note that the identification of claimants is also a breach of the common law duty of confidence. A claimant who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/41 Publishing this response Please note that this information will be published on our Freedom of Information disclosure log at: https://opendata.nhsbsa.net/dataset/foi-02309 Your personal details will be removed from the published response.
The CMA is a listed organisation included in the Prescribed Persons Order 2014, which provides the statutory framework for protecting persons from harm if they report on any wrongdoing involving their employer. The process by which a person may make this report is referred to as “making a disclosure” or “whistleblowing”.
To be covered by whistleblowing law, the disclosure must be a ‘qualifying disclosure’. This is any disclosure of information which, in the reasonable belief of the worker making the disclosure, is made in the public interest and tends to show that one or more of the following has occurred, is occurring or is likely to occur:
a criminal offence (this may include, for example, types of financial impropriety such as fraud) a breach of a legal obligation a miscarriage of justice danger to the health or safety of any individual damage to the environment the deliberate covering up of wrongdoing in the above categories
More information can be found in Whistleblowing: guidance for prescribed persons.
The CMA is a listed organisation included in the Prescribed Persons Order 2014, which provides the statutory framework for protecting persons from harm if they report on any wrongdoing involving their employer. The process by which a person may make this report is referred to as “making a disclosure” or “whistleblowing”.
To be covered by whistleblowing law, the disclosure must be a ‘qualifying disclosure’. This is any disclosure of information which, in the reasonable belief of the worker making the disclosure, is made in the public interest and tends to show that one or more of the following has occurred, is occurring or is likely to occur:
More information can be found in Whistleblowing: guidance for prescribed persons.
Question 1 No claimants have been notified they are entitled to a Vaccine Damage Payment because of chronic fatigue syndrome. Question 2 No claimants have been notified they are entitled to a Vaccine Damage Payment because of myalgic encephalomyelitis (ME) Question 3 Please be aware that I have decided not to release this figure. Fewer than five claimants have been notified that they are entitled to a Vaccine Damage Payment because of fatigue. This is because the individuals could be identified, when combined with other information that may be in the public domain or reasonably available. This information falls under the exemption in section 40 subsections 2 and 3 (a) of the Freedom of Information Act (FOIA). This is because it would breach the first data protection principle as: a. it is not fair to disclose individual’s personal details to the world and is likely to cause damage or distress. b. these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the individual. Please click the below web link to see the exemption in full. www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of confidentiality Please note that the identification of individuals is also a breach of the common law duty of confidence. An individual who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full. www.legislation.gov.uk/ukpga/2000/36/section/41
http://reference.data.gov.uk/id/open-government-licencehttp://reference.data.gov.uk/id/open-government-licence
In accordance with the public Contracts Regulations 2015 regulation 113(7), Leeds City Council publishes statistics showing how far the authority has complied with its obligations under this regulation to make payments within 30 days.
Public Contracts Regulations 2015: http://www.legislation.gov.uk/uksi/2015/102/pdfs/uksi_20150102_en.pdf
Guidance: https://www.gov.uk/guidance/transposing-eu-procurement-directives
From 1 December 2010, the collection of monthly mixed sex accommodation (MSA) breaches was introduced. NHS organisations submit data on the number of occurrences of unjustified mixing in relation to sleeping accommodation. The collection enables the analysis and publication of consistently defined data to allow patients and members of the public to understand the extent to which mixed sex accommodation is occurring at individual organisations.
Official statistics are produced impartially and free from any political influence.
This is because it would breach the first data protection principle as: a) it is not fair to disclose applicants personal details to the world and is likely to cause damage or distress. b) these details are not of sufficient interest to the public to warrant an intrusion into the privacy of the applicants. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/40 Breach of Applicant Confidentiality Please note that the identification of applicants is also a breach of the common law duty of confidence. An applicant who has been identified could make a claim against the NHSBSA or yourself for the disclosure of the confidential information. The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the Freedom of Information Act. Please click the below web link to see the exemption in full. https://www.legislation.gov.uk/ukpga/2000/36/section/41 Note - Ages have been grouped to allow for a lower amount of suppression of the data. ‘Age 11 and under’ has been added to the dataset to complete the analysis. Please note that this request and our response is published on our Freedom of Information disclosure log at: https://opendata.nhsbsa.net/dataset/foi-23325 If you have any queries regarding the data provided, or if you plan on publishing the data, please contact nhsbsa.foirequests@nhsbsa.nhs.uk ensuring you quote the above reference. This is important to ensure that the figures are not misunderstood or misrepresented. If you plan on producing a press or broadcast story based upon the data, please contact nhsbsa.communicationsteam@nhs.net. This is important to ensure that the figures are not misunderstood or misrepresented.
The government has surveyed UK businesses, charities and educational institutions to find out how they approach cyber security and gain insight into the cyber security issues they face. The research informs government policy on cyber security and how government works with industry to build a prosperous and resilient digital UK.
19 April 2023
Respondents were asked about their approach to cyber security and any breaches or attacks over the 12 months before the interview. Main survey interviews took place between October 2022 and January 2023. Qualitative follow up interviews took place in December 2022 and January 2023.
UK
The survey is part of the government’s National Cyber Strategy 2002.
There is a wide range of free government cyber security guidance and information for businesses, including details of free online training and support.
The survey was carried out by Ipsos UK. The report has been produced by Ipsos on behalf of the Department for Science, Innovation and Technology.
This release is published in accordance with the Code of Practice for Statistics (2018), as produced by the UK Statistics Authority. The UKSA has the overall objective of promoting and safeguarding the production and publication of official statistics that serve the public good. It monitors and reports on all official statistics, and promotes good practice in this area.
The document above contains a list of ministers and officials who have received privileged early access to this release. In line with best practice, the list has been kept to a minimum and those given access for briefing purposes had a maximum of 24 hours.
The Lead Analyst for this release is Emma Johns. For any queries please contact cybersurveys@dsit.gov.uk.
For media enquiries only, please contact the press office on 020 7215 1000.