Individual technology choices and volumes purchased rest with individual departments

The Cabinet Office will soon start work on an audit to allow for a more comprehensive and consistent approach to reviewing legacy IT in government and will support departments to understand their legacy systems and any risks associated with those systems.

We estimate there are approximately 2,300 machines in the National Health Service currently still operating on Windows XP which is no longer supported by Microsoft. To be compliant with the mandatory Data Security and Protection Toolkit, NHS organisations must operate on supported systems or have plans in place to mitigate the risk such as segregating those machines from the network. There are valid reasons why some machines cannot be upgraded from Windows XP, primarily where they run essential locally developed clinical systems that cannot be upgraded or replaced.

We are supporting NHS organisations to upgrade their existing Microsoft Windows operating systems, allowing them to reduce potential vulnerabilities and increase cyber resilience.

We signed a multi-million pound contract with Microsoft in 2018 to support the NHS to upgrade their existing Microsoft Windows operating systems onto Windows 10.

All health and care organisations that have access to NHS patient data must annually complete NHS Digital’s Data Security and Protection Toolkit. This details the standards we expect them to adhere to and Data Security Standard 8 advocates that no unsupported operating systems, software or internet browsers are used within the IT estate.

To release any information may assist in determining the effectiveness of a future cyber attack and could compromise measures to protect government systems. If those systems are attacked it could lead to the loss of confidentiality, integrity and availability of government information and/or personal data.

Providing information which could lead to a crime being committed and/or the disruption to the delivery of justice services is not in the public interest.

The Government Digital Service (GDS) provides government departments with guidance on selecting technology through the Technology Code of Practice. Further details can be found here: https://www.gov.uk/government/publications/technology-code-of-practice/technology-code-of-practice

Individual technology choices and volumes purchased rest with individual departments. As such, GDS does not provide guidance to departments on specific operating systems, such as Windows 7 and the Government does not hold information concerning departments choice to use Windows 7 machines centrally. Microsoft provides guidance for its operating systems should departments need specific information.

Additionally, the National Cyber Security Centre published information on their blog on the upcoming removal of Windows 7 Support. The blog post can be found here: https://www.ncsc.gov.uk/blog-post/one-year-left-windows-7-support

0.16% of National Health Service machines are currently using Windows XP.

It is not possible to set a timeframe for complete removal of Windows XP from all NHS machines. This is because removal is not always possible, particularly where Windows XP is embedded in medical devices.

All NHS organisations have been given guidance on how to mitigate the risks if they cannot completely remove Windows XP from their estate, for example, they can segregate the affected machines from the network. They can also contact NHS Digital for further bespoke advice and support to mitigate risks.

All NHS organisations must report through the mandatory Data Security and Protection Toolkit (DSPT) whether or not they continue to run unsupported systems. Through the DSPT organisations must provide assurance that they are managing, monitoring and mitigating the risk. NHS Digital and NHSX then follow up with NHS trusts if that assurance is unsatisfactory.

National Health Service organisations are being supported to upgrade existing Microsoft Windows operating systems, allowing them to reduce potential vulnerabilities and increase cyber resilience.

As of 30 June 2019, approximately 1.05 million NHS computers are using Windows 7 from a total of around 1.37 million. This equates to approximately 76% of the NHS estate currently on Windows 7.

All NHS organisations, with the exception of one which had already upgraded to Windows 10, have signed up to receive Windows 10 licences and Advanced Threat Protection.

Deployment of Windows 10 is going well and in line with target to make sure the NHS is operating on supported software when Windows 7 goes out of support in 2020.

Decisions about technology choices rest with individual departments and bodies in the public sector. As such, Cabinet Office does not hold this information centrally.

The Cabinet Office itself does not have any computers using Windows 7.

The National Cyber Security Centre has published information on the upcoming removal of Windows 7 Support, here:
https://www.ncsc.gov.uk/blog-post/one-year-left-windows-7-support

Details of Ministerial meetings are published on GOV.UK.

As of July 2019, approximately 2,300 National Health Service computers are using Windows XP from a total of around 1.4 million. This equates to 0.16% of the NHS estate. We are supporting NHS organisations to upgrade their existing Microsoft Windows operating systems, allowing them to reduce potential vulnerabilities and increase cyber resilience.

Individual technology choices and volumes purchased rest with individual departments. As such, GDS does not provide guidance to departments on specific operating systems, such as Windows 7. Microsoft provides guidance for its operating systems should departments need specific information.

The Government Digital Service (GDS) provides government departments with guidance on selecting technology through the Technology Code of Practice. Further details can be found here: https://www.gov.uk/government/publications/technology-code-of-practice/technology-code-of-practice

Individual technology choices and volumes purchased rest with individual departments. As such, GDS does not hold information on how many government computers currently operate with Windows 7 or more widely in the public sector.

Departments are making their own preparation plans for the conclusion of Windows 7 support in 2020.

The Government Digital Service (GDS) provides departments with guidance when selecting technology through the Technology Code of Practice.

Individual technology choices and volumes purchased rest with individual departments. As such, GDS does not hold the information requested.