999 Risk Assessment

Description

The Department for Science, Innovation & Technology (DSIT) is seeking to commission an independent Network and Cyber Risk Assessment of the UK Public Emergency Call Service (PECS), accessed via 999 and 112. PECS is the public's primary route to emergency help and is a critical national service relied on by the public, emergency services, Government and industry. Around 37 million 999/112 calls were made in 2025. This procurement is funded through the Integrated Security Fund (ISF) and is being led by DSIT's Telecoms Security and Resilience team within the Digital Infrastructure Directorate. DSIT leads UK Government policy on the resilience of the 999 service and provides the secretariat for the 999/112 Liaison Committee. The Committee brings together lead Government departments, Ofcom, emergency services, BT as the call handling agent, Communication Providers, devolved administrations and other relevant organisations. It provides a forum for technical and operational oversight of PECS, supports escalation of issues across the system, and maintains the PECS Code of Practice. On 25 June 2023, BT experienced a major technical failure affecting its role as the Centralised Handling Authority (CHA) for 999 calls in the UK. The fault lasted for over ten hours and resulted in almost 10,000 unique callers being unable to reach 999 or 112. This was the first significant disruption to the service in nearly 90 years. The outage prompted significant public concern and formal review activity, including Ofcom's review and Government's post-incident review. Those reviews highlighted weaknesses in cross-system visibility, response arrangements and the absence of a single set of comprehensive procedures or risk information across the end-to-end call chain. The 999/112 call chain is a multi-organisation system involving several interdependent parties: - Communication Providers (CPs) - who originate and route 999 calls from fixed-line, mobile, and VoIP networks; - BT as the Centralised Handling Authority (CHA) - which receives, triages and routes calls to the appropriate emergency authority; - Emergency Authorities (EAs) and their control rooms - including Police, Fire, Ambulance and Coastguard - which receive and handle the calls. In broad terms, a caller dials 999 or 112; the originating Communication Provider transfers the call to BT's CHA switch sites; BT's 999 call handling operation identifies the appropriate Emergency Authority and routes the call onward; and the receiving Emergency Authority control room determines and coordinates the emergency response. Risks can arise at any point in this chain, but are particularly likely to emerge at the interfaces between organisations, systems and contractual responsibilities. Section 2 Specification of Requirements OFFICIAL-SENSITIVE OFFICIAL-SENSITIVE Each segment relies on complex telecommunications infrastructure, a mix of legacy TDM/PSTN and next-generation IP/cloud technologies, and mu