Cybersecurity considerations 2024: Government and public sector

For the public sector, enhanced security through automation is less a choice and more an imperative for multiple reasons. Firstly, the public sector is not immune to the global skills shortage in cybersecurity. It often has to compete with the private sector to retain talent with the required knowledge and expertise. The public sector tends to lose talent to the private sector, creating a vacuum of knowledge and expertise.

Secondly, in many countries, the public sector is constantly under pressure for being too big. By investing in security automation, public sector organizations can help improve operational efficiency, reduce manual errors and optimize resource utilization, ultimately enhancing overall productivity and effectiveness. Automated processes play a key role in helping to ensure ongoing compliance, as they can be updated to reflect new regulations more swiftly and consistently than manual processes.

Lastly, public sector organizations are increasingly expanding their digital presence and adopting new technologies. This can bring enhanced efficiency but also greater complexity. As agencies scale their security operations more effectively, they should be able to adapt to evolving threats and technologies without significantly increasing costs.

With the growing range of threats, prioritizing what cybersecurity teams should focus on is key. Chief Information Security Officers (CISOs) should filter the noise to allocate resources to the most vulnerable areas. Cybersecurity leaders can start by defining the vision and strategy for automation in the context of larger organizational goals. The next steps would be to determine execution through build versus buy decisions and ensure skills for continuous implementation.

Cyberattacks and security incidents can disrupt critical government and public services, leading to significant economic, social and political consequences. As government agencies collect, store and manage vast amounts of sensitive information, including citizen records, financial data and national security intelligence, cybersecurity is integral to public safety and national security.

Clearly, there are inherent risks that come with today’s digitally connected landscape. Organizations should acknowledge that many cyber incidents are inevitable and simply cannot be prevented. As such, commensurate investment across the lifecycle (i.e. prevention, detection, response and recovery) is required to help ensure true resilience in the event of a breach, so the organization can quickly contain and minimize operational disruption.

Among government and public sector agencies, the integration of cybersecurity and resilience into organizational strategy remains a work in progress, with varying degrees of preparedness across different entities. This is largely because the sector’s approach to cybersecurity tends to be more reactive than proactive, often focusing on immediate threat mitigation rather than long-term resilience planning. This is further compounded by resource constraints. With adequate resilience, government agencies can help minimize disruption and ensure operational continuity.

For resilience, leaders are encouraged to develop a roadmap for how organizations can or should respond in the event of an attack next week, next month or next year. With periodic reviews, plans and frameworks can remain aligned with the evolving threat landscape.

In addition to assessing your cybersecurity program and helping to ensure it aligns with your business priorities, KPMG professionals can help government and public sector clients develop advanced digital solutions, advise on the implementation and monitoring of ongoing risks, and help design appropriate responses to cyber incidents. With the well-being and safety of citizens potentially at stake, leaders should act now to integrate operational resilience and security into core business functions. Proactive behaviors, the right cultural mindset and the safe adoption of digital tools are key in helping to ensure public safety and national security.

KPMG professionals are adept at applying advanced thinking to clients’ most pressing cybersecurity needs and developing custom strategies that are fit for purpose. With technology that is secure and trusted, KPMG professionals offer a broad array of digital solutions, including cyber cloud assessments, privacy automation, third-party security optimization, AI security, and managed detection and response.