The National Audit Office has praised the Ministry of Defence’s digital transformation strategy – but warned it faces significant challenges in implementing it, including a lack of “levers”, a huge legacy stack, and skills shortages.
In a highly balanced report the NAO said the MoD’s Digital Strategy for Defence is sound, has strong internal support, and that the ministry’s digital function is “well set up”. But the auditors also suggested the department’s Defence Digital unit has a long way to go before it is in a position to succeed in implementing this strategy.
In 2021 Defence Digital set out “The Digital Strategy for Defence” – a transformation programme which would see the military’s digital capabilities and systems overhauled by 2030. At least, that’s the aim.
“The Department does not have an overarching delivery plan for the strategy and as a result, cannot easily measure its performance with implementing it. Although it has individual plans supporting each of the workstreams and programmes within the strategy, it has not brought these together to provide a complete picture of progress across the strategy,” the National Audit Office said in its reported, published October 19.
7 key takeaways from MOD’s new Cyber Resilience Strategy
It also noted the CIO and Defence Digital lack “all the levers” needed for delivery. The MoD’s CIO and head of Defence Digital – Charles Forte – is in nominal charge of the department’s £4.4 billion annual digital budget.
“The CIO is accountable for the whole Department’s use of technology and data, leading the digital function and implementation of the strategy, but only directly [our italics] controls Defence Digital and its £2.7 billion of spend, against the Department’s estimated £4.4 billion of digital spend in 2021-22" NAO noted.
Whilst Forte -- a widely respected CIO in one of HMG's most challenging roles -- has delivered some improtant changes, like his predecessors, he faces real headwinds to delivering change, not least owing to the challenges caused by the MoD’s legacy tech, some of which dates from the 1980s. In 2019 Defence Digital said it expected to spend £11.7 billion over 10 years – almost half its IT budget – on updating or replacing these systems.
The issue isn’t only that the MoD’s legacy systems are old – it’s that they are almost comically cumbersome. TheNAO highlighted one particular procurement process: “The Department’s current process for ordering basic goods such as boots… involves 29 information systems and 23 different people. This is an example of the Department’s reliance on legacy systems and complex processes for accessing and sharing data,” said the NAO.
Mr Forte did not respond to a request for comment.
> Follow The Stack on LinkedIn today <
As the auditors made clear in the report, the risks to the MoD’s digital transformation project lie within systemic issues, the highly specific technology challenges faced by the military, and the enormous inertia inherent to its current IT environment. They also noted many have tried and failed to overhaul the MoD’s digital estate.
“We have reported that 11 central government digital strategies spanning 25 years failed to change a pattern of poor performance in digital change programmes. The challenges and aims reflected in the Department’s 2021 strategy are not new – it has tried to address them in previous strategies,” said the report.
But it added the current strategy benefits from “strong support” among the MoD’s senior leaders, including its four most senior officials, and all 16 “top-level budget” (TLB – the highest level of sub-unit in the MoD’s structure) CIOs.
“The high level of support and strategic momentum may help the Department achieve more fundamental change this time,” said the NAO report. As The Stack has regularly noted, positive signs of progress continue to emerge from MOD, whether that's it's first defence-wide hackathon, launch of a new DevSecOps platform to speed up and standardise secure application development, an honest appraisal of its cyber resilience challenges and more.
The Ministry of Defence now has a dedicated AI centre operational
There is clearly an enormous amount of work to be done. The NAO found that even within Defence Digital not all of its teams had adopted common data and technology standards “due to delivery pressures or a desire to innovate” – and also said there were multiple non-conforming architecture projects across the department.
“The Department’s understanding of its legacy estate is also immature. An internal audit in March 2022 found the Department did not have a centralised strategy for addressing legacy systems, and it has not fully mapped out its legacy estate,” added the report.
(MOD's own Cyber Resilience Strategy for Defence report earlier this year bluntly described a "misaligned culture, endemic obsolescence, [and] inadequate cyber resilience” as it laid out plans to try and bring improved cyber hygiene to the MOD’s sprawling set of agencies and organisations by 2030. Among that strategy’s promises is more openess from MOD, which will aim to “adopt a default ‘share’ posture… where policy permits” and, critically, an “open mindset to resetting security relationships” with enterprise partners as MOD looks to push resilience requirements further up it supply food chain, to include resilience audits and remediation by its business partners.)
Even as Defence Digital has struggled to shed a “historically poor” reputation for successfully delivering projects through a “reset”, it faces a challenge which is familiar to all IT departments at the moment: talent recruitment and retention: “The Department cannot match private sector pay for digital roles, which CIOs felt was a significant challenge. Government introduced the Digital Data and Technology pay framework with greater flexibility to help departments compete externally for talent and reduce competition within the civil service.
"However, not all TLBs have authority from the Department to apply pay uplifts for digital specialists, which is creating internal competition,” said the report.
Defence Digital has also found potential employees are put off by the MoD’s bureaucratic reputation (see: boots), a lack of public visibility for its work, and the fact that many roles are based in Corsham, Wiltshire (population: 13,000).
Given the enormous challenges the MoD faces in getting its IT estate into shape, the NAO report seems as positive as the department might have hoped for. But in an uncertain political climate, with significant cuts to all government budgets a distinct possibility, the MoD will have its work cut out keeping its transformation strategy on course.
