999 Risk Assessment

2026-11-03

The Department for Science, Innovation & Technology (DSIT) is seeking to commission anindependent Network and Cyber Risk Assessment of the UK Public Emergency Call Service(PECS), accessed via 999 and 112. PECS is the public's primary route to emergency helpand is a critical national service relied on by the public, emergency services, Governmentand industry. Around 37 million 999/112 calls were made in 2025. This procurement isfunded through the Integrated Security Fund (ISF) and is being led by DSIT's TelecomsSecurity and Resilience team within the Digital Infrastructure Directorate.DSIT leads UK Government policy on the resilience of the 999 service and provides thesecretariat for the 999/112 Liaison Committee. The Committee brings together leadGovernment departments, Ofcom, emergency services, BT as the call handling agent,Communication Providers, devolved administrations and other relevant organisations. Itprovides a forum for technical and operational oversight of PECS, supports escalation ofissues across the system, and maintains the PECS Code of Practice.On 25 June 2023, BT experienced a major technical failure affecting its role as theCentralised Handling Authority (CHA) for 999 calls in the UK. The fault lasted for over tenhours and resulted in almost 10,000 unique callers being unable to reach 999 or 112. Thiswas the first significant disruption to the service in nearly 90 years. The outage promptedsignificant public concern and formal review activity, including Ofcom's review andGovernment's post-incident review. Those reviews highlighted weaknesses in cross-systemvisibility, response arrangements and the absence of a single set of comprehensiveprocedures or risk information across the end-to-end call chain.The 999/112 call chain is a multi-organisation system involving several interdependentparties:- Communication Providers (CPs) - who originate and route 999 calls fromfixed-line, mobile, and VoIP networks;- BT as the Centralised Handling Authority (CHA) - which receives, triagesand routes calls to the appropriate emergency authority;- Emergency Authorities (EAs) and their control rooms - including Police, Fire,Ambulance and Coastguard - which receive and handle the calls.In broad terms, a caller dials 999 or 112; the originating Communication Provider transfersthe call to BT's CHA switch sites; BT's 999 call handling operation identifies the appropriateEmergency Authority and routes the call onward; and the receiving Emergency Authoritycontrol room determines and coordinates the emergency response. Risks can arise at anypoint in this chain, but are particularly likely to emerge at the interfaces betweenorganisations, systems and contractual responsibilities.Section 2Specification of RequirementsOFFICIAL-SENSITIVEOFFICIAL-SENSITIVEEach segment relies on complex telecommunications infrastructure, a mix of legacyTDM/PSTN and next-generation IP/cloud technologies, and mu

United Kingdom (UK)

2026-09-23