7 Public Sector Data and Networks 7.1 State of Play Responsibility for the operation and security of public sector IT systems sits with individual Departments and Agencies, with the Office of the Government Chief Information Officer having an overarching role in leading the implementation of the Public Service ICT Strategy and managing the network which Departments and Agencies use to connect with each other and the wider internet. The primary role of the CSIRT within the NCSC in its early years involved establishing an incident response function to support these Departments and agencies when they reported incidents to the NCSC, and to build an Advisory system to allow for the rapid dissemination of specific information relating to threats and incidents, and best practice with regard to cyber security. The NCSC had no direct insight into activities on Government networks however, and no formal or precise means of determining what security measures might be in place in individual Departments or agencies. On this basis, and in tandem with the ongoing development of the CSIRT and the expanding toolset that are available to all constituents, the NCSC began to rollout a project titled ‘Sensor’; this is essentially an additional layer of boundary protection for Government Departments that alerts the NCSC when particular types of activity are observed transiting Government networks. Also, the NCSC issued a ‘5 Point Guide’ for Departments in late 2018, setting out a recommended baseline of security measures that Departments might take, based on some of the common incidents that the CSIRT had reported to it over the previous period. Key Developments 1. The Advisory system operated by the NCSC has been augmented substantially to allow for the rapid dissemination of information. 2. The NCSC has developed, tested and deployed the Sensor platform across a number of Government Departments, improving the security of IT systems and data against high level threats. 3. Government Departments and agencies have invested heavily in security, supported by guidance from the NCSC. 31