FOI release

RFI

Updated 11 August 2025

RE: Freedom of information request - IT

Thank you for your email dated 15 October 2025 in which you asked for the following information: 

“Under the Freedom of Information Act, I would request you to respond to questions included in the attachment.

For any reason if you are unable to open the attachment do let me know. I can then send the questions within the email itself.

Please note: If you do not have records relating to the questions in the attachment, please pass on this request to your IT department to provide us with the required information.”

We have considered your request under the Freedom of Information Act 2000 (‘FOI Act’). 

Under the Freedom of Information Act 2000 (‘the FOI Act’), you have the right to:  

• know whether the Single Source Regulations Office (‘SSRO’) holds the information you require 

• be provided with that information (subject to any exemptions under the FOI Act which may apply). 

I confirm that the SSRO does not hold the following information you requested: year on year budgets for each category of spend is not available. Due to our funding model, we do not have year on year budgets and in our response, we have entered a flat rate across all years where applicable.

I confirm that the SSRO holds the remainder of the information you require. Subject to what follows, this requested information is disclosed in the attached.

In relation to the final row (Security Infrastructure) under Q1, and the information requested under Q3, this information is exempt from disclosure under section 31(1)(a) of the FOIA on the basis that disclosing this information would be likely to prejudice the prevention or detection of crime. This is because disclosing this information would give cyber criminals insight into vulnerabilities which may or may not exist and this would likely encourage attempts to illegally access the SSRO’s IT systems.

The exemption relied upon is a qualified exemption and is subject to a public interest test. We have balanced the public interest in disclosing the information against the public interest in maintaining the exemption. Factors in favour of disclosing the information are that it would support transparency of the organisation’s activities and expenditure, and it would provide information about how effective our security systems are. Weighed against this, disclosing the information would be likely to increase the likelihood of cyberattacks because it would provide cyber criminals with information necessary to build an understanding of the strengths and weaknesses of the SSRO’s IT security. If, for example, the SSRO disclosed its spend/budget for procuring IT security, and cyber criminals used this information, whether alone or in combination with other information, to draw their conclusion that the SSRO’s IT security was vulnerable, this would encourage attacks. Conversely, if the SSRO disclosed its spend/budget for procuring IT security, and cyber criminals used this information, whether alone or in combination with other information, to draw their conclusion that the SSRO’s IT security was strong, this may inspire cyber criminals to target the organisation’s systems on account of the challenge it would present.

Having weighed these public interests, our conclusion is that the public interests in maintaining the exemption in relation to “Q1 - Security Infrastructure” and maintaining the exemption in respect of all the information requested under Q3,  should preponderate.

If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within two months of the date of receipt of our response to your request and should be addressed to: enquiries@ssro.gov.uk.

If you are not content with the outcome of the internal review, you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.