Government publishes Budget Information Security Review

Government has today published a review with recommendations to protect information security at future fiscal events.

Government has carried out a Review of Budget information security in light of the events that occurred in the run up to the 2025 Budget Statement 

This includes the outcomes and recommendations of the National Cyber Security Centre’s investigation into the publication of the Office for Budget Responsibility’s Economic and fiscal outlook (EFO) and the Cabinet Office’s leak inquiry relating to the 13 November article on income tax in the Financial Times. 

All recommendations will be implemented in full.

The government has today Monday 9 February published the Budget Information Security Review. The Review has been carried out in light of events that occurred in the run up to the 2025 Budget Statement and includes steps being taken to tighten information security.  

The Review includes outcomes and outcomes and recommendations from the National Cyber Security Centre’s investigation into the publication of the Office for Budget Responsibility’s Economic and fiscal outlook (EFO) and the Cabinet Office’s Financial Times leak inquiry. 

The principal changes, which will be introduced ahead of Budget 2026, are: 

A set of mandatory embedded protection actions within the IT systems to restrict the extent to which Budget material can be shared, including across departmental boundaries. Measures will include preventing the sending of attachments; limiting access to named lists and restricting the functionality for those accessing information to print or download; and with the ability to monitor and record access. 

Linking these protections to the introduction of a new ‘BUDGET - MARKET SENSITIVE’ sensitivity label for the most sensitive categories of Budget and forecast information where HMT and OBR use named lists. 

Cutting back the numbers of officials who can routinely access the most sensitive information, including on named lists.