Independent Information Assurance Review - Census 2021
Date published:
Download the full report: Independent Information Assurance Review - Census 2021.
Background
Bridewell Consulting, a National Cyber Security Centre (NCSC)-certified consultancy, was commissioned to conduct an Independent Information Assurance Review (IIAR) of the 2021 Census Programme’s security. This review covered the people, processes, and technologies involved in delivering Census 2021, including the supply chain, for both the Office for National Statistics (ONS) and the Northern Ireland Statistics and Research Agency (NISRA).
The goal was to identify potential risks to census systems, services, and data ahead of Census 2021, and to provide stakeholders - including the public - with an independent assessment of the programme’s security maturity.
Summary
The strong architectural foundations, design principles, and security baselines established during the 2019 rehearsal have been maintained and continuously evaluated. Since then, the security maturity of census systems has improved through sustained investment and oversight.
The review identified 21 findings, all rated as Low or Informational. These reflect minor gaps - such as a few corporate security policies needing updates - rather than any significant threats to census security.
Overall, the assessment concludes that both ONS and NISRA have implemented comprehensive security programmes that effectively mitigate risks to census delivery and citizen data. Strong controls are also in place to detect and respond to threats during live operations. The 2020 review confirms that the security measures have not only been preserved but also enhanced since the 2019 rehearsal.