Museums left vulnerable to cyber-attack as government overly reactive in face of threats, says new PAC report
|
- Public Accounts Committee warns of rising costs, falling visitor
numbers and vacancies in key leadership roles; urges Govt to review
funding options The Public Accounts Committee (PAC) is warning that
national museums and galleries are being left vulnerable to a range
of issues from threats from cyber security to the physical security
of collections, as the Government continues to rely on a reactive,
rather than a strategic approach. A number of high-profile
incidents in...Request free trial
- Public Accounts Committee warns of rising costs, falling visitor numbers and vacancies in key leadership roles; urges Govt to review funding options The Public Accounts Committee (PAC) is warning that national museums and galleries are being left vulnerable to a range of issues from threats from cyber security to the physical security of collections, as the Government continues to rely on a reactive, rather than a strategic approach. A number of high-profile incidents in 2023, including both the cyber-attack at the British Library and the thefts reported at the British Museum, served to highlight the vulnerability of these institutions. Although the Government has facilitated the sharing of lessons, it was unable to provide specific examples of concrete actions taken as a result to better protect systems and collections in the wake of these incidents. The Committee does not believe that the DCMS is taking advantage of its central role to bring museums and galleries together to better address these issues. It finds that measures including the implementation of digital record keeping should be considered and has asked the DCMS to set out the concrete actions it and museums and galleries have taken and are taking to address cyber and physical security threats. The UK's national museums and galleries are among the country's most visited attractions, with the Natural History Museum alone drawing in 7.1m visitors in 2025. In 2024-25, museum and galleries self-generated income totalled £563 million, which is a 53% real-terms increase compared to 2021-22. Those income streams, however, are vulnerable to wider economic conditions and visitor numbers which have not returned to pre-pandemic levels, with costs also rising due higher staff costs and energy bills. Amid these challenges, the Department for Culture, Media and Sport (DCMS) provided 15 government-sponsored museums and galleries with £484m in grant-in-aid funding in 2024-25. This represents a real terms reduction of 16% as emergency COVID-19 pandemic funding has now ended. The PAC recommends that the DCMS should set out clear metrics by which it will assess museums and galleries, and what consequences there will be for those that do not meet the criteria it sets out to measure them against. The Committee also asks the DCMS to set out the circumstances in which it would allow the financial failure of a museum or gallery, amid concerns that the current funding regime does not provide museums and galleries with sufficient incentives to support themselves financially. The PAC asked the Government if it was considering charging visitors to museums and galleries. It told us that, while no decisions have been taken, it planned to look at the possibility of charging international visitors, as proposed by Baroness Hodge in her recent review. Alarmingly, the DCMS was unable to paint a clear picture of whether museums and galleries are delivering value for the taxpayer with the public money it grants them. The PAC also found the DCMS lacks the necessary insight into museums and galleries' financial situations to give it sufficient early warning of potential financial failures, with the Department recognising that it must rely less on anecdotal evidence. Though the steps being taken towards self-reliance are welcomed, the PAC believes that the DCMS is over-reliant on museums' and galleries' autonomy and is not taking the initiative to support them with the strategic challenges they face. Of particular concern are the high vacancy rates across boards of trustees, with the average time taken in 2024-25 to make an appointment being 219 days, far more than the target of 90 days. There have also been issues with the financial management capacity of these bodies due in part to a significant churn in senior financial leadership. The PAC is calling on the DCMS to report on the steps it has taken to ensure that those it appoints to board positions have the right mix of skills required to fulfil their functions effectively and the time taken to make these appointments. Sir Geoffrey Clifton-Brown, Chair of the Public Accounts Committee, said: Our museums and galleries are a treasured part of the fabric of our nation. The role they play in educating our people, preserving our shared history and showcasing our country to the world is quite simply priceless. However, they are being let down by a lack of leadership from the Department of Culture, Media and Sport, which appears to have taken an almost hands-off approach to the challenges they face. Cyber-attacks, the theft of items from collections, and a fall in the number of visitors are just some of the issues museums and galleries are fighting to overcome. They've made great strides to become more financially resilient, however the lack of centralised support is leaving them vulnerable. Furthermore, government has not done nearly enough to provide incentives for museums and galleries to be in a position to support themselves financially. The Department must do more to encourage shared learning across organisations and play a more proactive role in driving value for money. PAC report conclusions and recommendations The Department does not have a clear picture on whether museums and galleries are delivering value for the taxpayer with the public money it grants them each year. In 2024-25, the Department provided £484 million grant-in-aid to its 15 sponsored museums and galleries, 46% of their total income that year. The Department expects museums and galleries to deliver their core objectives of preserving and providing free public access to their collections. The Department also expects museums and galleries to contribute to its own priority outcomes which it set in July 2024. According to the Department, museums and galleries are aware of this expectation and might well be doing things already that contribute to these outcomes. However, the Department does not know how successful the museums and galleries will be, or have been, as the outcomes required are vague. For example, it is up to museums and galleries to decide the extent to which they will close their buildings to enable private hire without adversely affecting free access of the public, with no guidance from the Department on this topic. The Department has yet to put in place metrics for measuring museums' and galleries' delivery against its outcomes. Recommendation 1. The Department should, within six months, set out clear metrics by which it will assess how successfully museums and galleries are fulfilling their role in achieving its priority outcomes, and what consequences there will be for those that do not. The Department is missing opportunities to help museums and galleries address some of the common challenges to their resilience. The Department aims to have sufficient oversight of museums and galleries while at the same time allowing them to use the freedoms they have to operate at arm's length. For example, museums and galleries are free to decide whether or not they use Government procurement frameworks or the Department's planned shared services system for finance. If museums and galleries were all compelled to use the same systems, it would facilitate the creation of comparative cost information that is currently unavailable. Museums and galleries face common challenges and opportunities, which can have a real and direct impact, such as the use of AI and the digitisation of theircollections. The Department has focused on developing a community of arm's-length bodies, including museums and galleries, to address these common issues, by establishing various forums to share good practice. However, it lacks the means to require the museums and galleries to take the necessary action, and helping them to address challenges, such as collection storage issues, could require significant up-front investment. Recommendation 2. The Department should identify the cross-sector issues it will prioritise in its support to museums and galleries and set out its plans for taking a more proactive role in these areas and driving value for money. The Department is not doing enough to ensure museums and galleries apply learning from recent threats to the physical security of their collections and their cyber security. Museums and galleries face significant challenges on cyber-security and the physical security of their collections, as evidenced by the October 2023 cyber-attack at the British Library and the thefts reported in 2023 at the British Museum. While it is primarily up to museums and galleries and their trustees to address their physical and cyber security, the Department has an important role in capturing lessons from such events and sharing these across the sector. Although the Department has facilitated the sharing of lessons from these two cases, it could not provide us with specific examples of actions taken as a result to protect museums' and galleries' systems and collections. A number of possible controls could be put in place, including the use of digital technology to endure proper record keeping which could help prevent items going missing without people knowing while also increasing access to collections. Recommendation 3. The Department set out the concrete actions it and museums and galleries have taken and are taking to address cyber and physical security threats. We understand that there may be confidentiality considerations, in which case the Department should also write to us privately. The Department relies heavily on museums and galleries and their boards to ensure their own financial resilience, but their boards are not consistently well-equipped to do this effectively. As arms-length bodies, museums and galleries have primary responsibility for their ongoing financial resilience, with their boards playing an important role in ensuring they meet this responsibility. As at October 2025, the vacancy rate across all 15 museum and gallery boards was 15%, with the average time taken in 2024-25 to make a board appointment being 219 days, far more than the target of 90 days. Delays to appointments can mean capability gaps on boards are not addressed as quickly as required. Factors outside the Department's control, such as board posts being unpaid and the 2024 general election, have contributed to the delays. The Department has made a number of changes to speed up its processes, and is making more, in response to internal and external reviews it has commissioned. As a result, the speed of board appointments has improved, and the Department expects this to continue. Recommendation 4. The Department should report to us in six months on:
The Department's current funding regime risks not providing museums and galleries with sufficient incentives to support themselves financially. The Department recognises the importance of providing museums and galleries with incentives to maximise opportunities for raising their own income, while also receiving grant-in-aid, as a way of improving their financial resilience. It views museums and galleries as incredibly motivated to raise their own income and now sees their financial resilience as less risky than it was, although still rated as yellow-flashing. However, the Department's usual approach of providing flat rate annual increases in museums' and galleries' funding at the start of the year, with additional top-ups later on for those in financial trouble, could provide museums and galleries with insufficient incentive to maximise self-generated income or operate efficiently. One potential source of extra income would be for museums and galleries to charge international visitors. The Department will look with museums and galleries at this option, but cautioned that introducing such a measure would require great care. Recommendation 5. The Department should review the funding regime to identify how it can better incentivise the long-term commercial growth of the museums and galleries. Once this review is completed, it should write to us with its findings. The Department does not have the necessary insights into museums and galleries to give it sufficient early warning of their potential financial failure. The Department's line of sight of museums' and galleries' finances and financial management capabilities is via quarterly partnership meetings and its receipt of copies of museums' and galleries' financial data and risk registers. The Department recognises that it must rely less on anecdotal evidence in discussions with museums and galleries, and use more systematic indicators and be more joined-up in its own workings. It is reviewing its key performance indicators for all its arm's length bodies, including museums and galleries, to address weaknesses identified by the National Audit Office, such as its failure to measure museums' and galleries' financial management capabilities systematically, and ensure its new indicators cover both financial resilience and wider aspect of museum and gallery performance. It is also finalising a new strategic indicator tool, which will draw on its new indicators to give a more complete and joined-up assessment of the situation of each museum or gallery. It intends to have the new indicators and tool in place later this year. Although the implementation of these measures should provide the Department with early warnings of potential financial failure, it has yet to decide on its willingness to allow such failure. Recommendation 6. The Department should:
|