Part of the debate – in the Senedd at 3:47 pm on 15 March 2022.
Thank you. I think that's a very timely question. There is no doubt that we are seeing increased activity on the cyber-attack front. Certainly, as state actors, this is something the UK Government—and we work closely with them—is taking seriously and doing an awful lot about. And as you can imagine they prefer to keep it secret exactly what they are doing, but this is a very serious issue at a state level.
In terms of a Welsh public services and business level, I don't think there is sufficient awareness amongst organisations of the threat of disruption and harm to their organisation and their users that the cyber threat poses. So, back to what we were discussing earlier—the level of understanding of what digital is and what they can be doing about it—it is now a key risk for all organisations, and it should be led at a senior level. So, every chief executive or managing director needs to be asking themselves and their systems the question, 'Have we got the basics right? Are we doing the simple checks? Do we have password protections in place?' And there are a whole raft of resources out there. The cyber security centre run by the UK Government has on its website a whole range of digital tools that are free to access that businesses and organisations can do a simple check on. So, they need to make sure they have the basics right, that they have incident management processes in place, and that those fundamental controls are thought of and are actioned. We are in a new era. A lot of data is shared and spread. A lot of our systems we rely upon fundamentally for what we do, and they are all viable to collapse and attack. We need to take it seriously. I think this is one of things we're raising awareness of—this agenda—this is now normal business, this is mainstream, and all leaders need to take it seriously.