British spy agency cannot account for thousands of data storage devices, watchdog says
The UK's surveillance watchdog publicly rebuked GCHQ for failing to track thousands of data storage devices — a governance failure that underscores how even elite security organisations can stumble on basic asset management, with direct lessons for NIS2 and DORA compliance.
Summary written by editorial AI · Source link below
The Investigatory Powers Commissioner’s Office (IPCO) in its annual report for 2025, published Thursday, said it was “very concerned” and “disappointed with the time it has taken GCHQ to investigate” the issue.
Editorial Analysis
Framed for the Compliance & GRC desk
GCHQ's inability to account for storage devices despite regulatory oversight highlights how even well-resourced organisations can fail basic asset management — a lesson directly applicable to NIS2 and DORA asset inventory requirements.
Cross-check your organisation's removable media and storage device registers against NIS2 asset management requirements and close any tracking gaps.
A UK intelligence agency lost track of thousands of storage devices — a governance warning that makes the case for rigorous asset management ahead of NIS2 and DORA deadlines.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Security Desk
- Iris Ohyama data cloud breach exposes info of 7.7 million customers1d
- After Binance, check what your signing systems can approve3d
- The Exceptions That Break MFA Start in the Boardroom4d
- DigiCert data breach exposes customer information, identity documents4d
- Why waiting for quantum computers to arrive could leave your security exposed4d