British spy agency cannot account for thousands of data storage devices, watchdog says
The UK's surveillance watchdog publicly rebuked GCHQ for failing to track thousands of data storage devices — a governance failure that underscores how even elite security organisations can stumble on basic asset management, with direct lessons for NIS2 and DORA compliance.
Summary written by editorial AI · Source link below
The Investigatory Powers Commissioner’s Office (IPCO) in its annual report for 2025, published Thursday, said it was “very concerned” and “disappointed with the time it has taken GCHQ to investigate” the issue.
Editorial Analysis
If a national intelligence agency cannot maintain storage device inventories, the bar for enterprise asset management under NIS2 and DORA deserves urgent re-examination.
Audit physical media inventory controls and verify that cryptographic erasure or certified destruction is documented for all decommissioned storage assets.
A UK intelligence agency lost track of thousands of storage devices — a governance warning that makes the case for rigorous asset management ahead of NIS2 and DORA deadlines.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Security Desk
- Iris Ohyama data cloud breach exposes info of 7.7 million customers1d
- After Binance, check what your signing systems can approve3d
- The Exceptions That Break MFA Start in the Boardroom4d
- DigiCert data breach exposes customer information, identity documents4d
- Why waiting for quantum computers to arrive could leave your security exposed4d