999 Risk Assessment

The Department for Science, Innovation & Technology (DSIT) is seeking to commission an

independent Network and Cyber Risk Assessment of the UK Public Emergency Call Service

(PECS), accessed via 999 and 112. PECS is the public's primary route to emergency help

and is a critical national service relied on by the public, emergency services, Government

and industry. Around 37 million 999/112 calls were made in 2025. This procurement is

funded through the Integrated Security Fund (ISF) and is being led by DSIT's Telecoms

Security and Resilience team within the Digital Infrastructure Directorate.

DSIT leads UK Government policy on the resilience of the 999 service and provides the

secretariat for the 999/112 Liaison Committee. The Committee brings together lead

Government departments, Ofcom, emergency services, BT as the call handling agent,

Communication Providers, devolved administrations and other relevant organisations. It

provides a forum for technical and operational oversight of PECS, supports escalation of

issues across the system, and maintains the PECS Code of Practice.

On 25 June 2023, BT experienced a major technical failure affecting its role as the

Centralised Handling Authority (CHA) for 999 calls in the UK. The fault lasted for over ten

hours and resulted in almost 10,000 unique callers being unable to reach 999 or 112. This

was the first significant disruption to the service in nearly 90 years. The outage prompted

significant public concern and formal review activity, including Ofcom's review and

Government's post-incident review. Those reviews highlighted weaknesses in cross-system

visibility, response arrangements and the absence of a single set of comprehensive

procedures or risk information across the end-to-end call chain.

The 999/112 call chain is a multi-organisation system involving several interdependent

parties:

- Communication Providers (CPs) - who originate and route 999 calls from

fixed-line, mobile, and VoIP networks;

- BT as the Centralised Handling Authority (CHA) - which receives, triages

and routes calls to the appropriate emergency authority;

- Emergency Authorities (EAs) and their control rooms - including Police, Fire,

Ambulance and Coastguard - which receive and handle the calls.

In broad terms, a caller dials 999 or 112; the originating Communication Provider transfers

the call to BT's CHA switch sites; BT's 999 call handling operation identifies the appropriate

Emergency Authority and routes the call onward; and the receiving Emergency Authority

control room determines and coordinates the emergency response. Risks can arise at any

point in this chain, but are particularly likely to emerge at the interfaces between

organisations, systems and contractual responsibilities.

Section 2

Specification of Requirements

OFFICIAL-SENSITIVE

OFFICIAL-SENSITIVE

Each segment relies on complex telecommunications infrastructure, a mix of legacy

TDM/PSTN and next-generation IP/cloud technologies, and mu