Photo by Emanuel Ekström on Unsplash
In June 2026, the House of Commons Public Accounts Committee published findings about England's national museums and galleries that deserve serious attention from anyone responsible for running one. The committee found that the Department for Culture, Media and Sport has taken what it called an overly reactive approach to cyber security across the sector. It organised lessons-sharing after major incidents. But when the committee asked whether those lessons had led to concrete, verified improvements across institutions, DCMS could not show evidence they had.
That is a meaningful gap. It means that some of the most visited cultural institutions in the country are operating without any independent confirmation that their cyber defences have materially improved since the last high-profile incident hit the headlines.
Why Museums Are an Attractive Target
Museums and galleries are not the obvious targets that banks or payment processors are. They do not process thousands of card transactions every hour. But they do hold things attackers want. Donor databases contain personal and financial contact information. Digital archives and catalogues hold records that can be locked and held for ransom. Ticketing and membership systems store personal data covered by data protection law. Research networks often connect to universities and public bodies. And many institutions run on legacy infrastructure that was never designed with current threat models in mind.
Add to that the public-facing nature of the work, the reputational pressure to restore services quickly when something goes wrong, and the typically limited in-house IT resource, and you have an organisational profile that criminal groups have learned to recognise. The British Library ransomware attack demonstrated exactly how that plays out in practice. Recovery took months, cost millions, and disrupted researchers, cataloguers, and the public long after the immediate incident was contained.
What Overly Reactive Looks Like in Practice
The PAC's criticism of DCMS is not that it did nothing after incidents. It is that reacting to incidents is not the same as building resilience before them. Sharing a summary of lessons learned is useful. It is not a substitute for clear, measurable security standards that institutions are expected to meet and that someone is actually checking.
In practice, this means many institutions are making their own judgements about what counts as good enough security, with limited external input and no independent verification. Some will be doing well. Others will have gaps they are not even aware of. That is the nature of a reactive posture: you find out what you missed when something goes wrong.
What a Practical Baseline Looks Like
The PAC report calls on DCMS to establish clear metrics for the sector. While that process works through government, institutions do not have to wait for a policy to tell them what the baseline should be.
The most accessible starting point for any UK organisation is Cyber Essentials, the government-backed certification scheme covering five core technical controls: boundary firewalls, secure configuration, access control, malware protection, and keeping software patched and up to date. These five areas address the most common routes attackers use to get into a network. Achieving certification through a Cyber Essentials certification package gives an institution something it can actually point to: an independently verified baseline rather than a self-assessment that sits in a folder and is never tested.
It is important to be clear about what Cyber Essentials covers and what it does not. Both Cyber Essentials and Cyber Essentials Plus address IT and network security controls. They do not cover physical security, access to gallery spaces, or the protection of physical collections. Those are separate disciplines requiring separate expertise. If your concern is protecting your network, donor records, and digital systems, Cyber Essentials is directly relevant. Physical security is a different conversation.
For institutions with staff across front of house, collections, research, and administration, security awareness training addresses one of the most consistent sources of incidents: a member of staff who did not recognise a phishing email, or who was using a weak password on a shared account. Training does not need to be complicated or time-consuming to make a real difference to your risk profile.
What the British Library's Own Account Tells Us
The British Library published an unusually transparent account of how its ransomware attack unfolded, how attackers moved through its systems, and what recovery actually involved. The key finding is not that the attack was inevitable. It is that the gaps the attackers exploited were well-known categories of risk, not exotic techniques that nobody could have anticipated. Unpatched systems, weak access controls, and insufficient network segmentation are exactly the problems that Cyber Essentials is designed to close. That is worth sitting with for a moment.
If you are responsible for a museum, gallery, or heritage organisation and want to understand where your cyber security currently stands, our museums and galleries cyber security support page covers the specific risks relevant to the sector, the frameworks that apply, and practical next steps you can take now.
Act Before the Policy Catches Up
Government setting measurable security standards for the culture sector is a good outcome, and the PAC is right to push for it. But policy moves slowly. The institutions that will be in a stronger position when those standards arrive are the ones that did not wait to be told what the baseline was. They picked up Cyber Essentials, trained their staff, and made sure their backups could actually survive a ransomware event rather than discovering a gap in the middle of an incident response.
None of that requires a large in-house IT team or a large budget. It requires a decision to treat cyber security as part of running the organisation, not something to revisit after the next incident forces the issue.