CAN YOU DELIVER CRITICAL LOCAL COUNCIL SERVICES DURING AND POST A SIGNIFICANT CYBER ATTACK?
The Context: Local Councils have been and will continue to be subject to Cyber attacks
“Councils are responsible for critical services like benefits payments, social care and elections. They interact and share data with other government departments. If one council’s system is compromised in a cyber attack, there is a risk that it would allow access to other networks, or attract further attacks against the public sector if it is perceived as vulnerable.
The 2020 cyber attacks, against Redcar and Cleveland and Hackney councils highlighted the catastrophic impact and far-reaching implications of such attacks. This includes threat-to-life if data on vulnerable people is lost, and significant financial costs for both the council and central government.” DHULC Report Dec 2022
The Challenge: Demonstrating a cyber resilience baseline for local government.
With over 10000 employees, many Councils handle sensitive and critical personal and business data daily.
“The concept of cyber resilience has three key aspects. First, the nature of the risk needs to be understood. Second, we need action to secure systems to prevent and resist cyber attacks. Third, recognising some attacks will still happen, we need to prepare for these, to be resilient enough to minimise their impact and be able to recover.” UK National Cyber Strategy 2022.
In January 2022, the Government Cyber Security Strategy set out the UK Government’s approach to building a cyber resilient public sector. Its long-term aim is for the whole public sector to be resilient to known vulnerabilities and attack methods no later than 2030.
The strategy is underpinned by the adoption of the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF) across government. Lead government departments are required to adapt this in a way that is most appropriate for the public sector organisations within their scope. Comment
Deploying the CAF Framework helps Councils identify actions that can improve cyber security, it helps facilitate discussions on cyber risk across the Council departments and can provide high level insight on cyber resilience.
CAF does not assure Councils on the resiliency of Local Councils service, post a ransomware attack or a significant IT disruption.
By conducting Cyber Resilience Exercises, Local Councils can assure all stakeholders, that the delivery of Local Services can be maintained during and post a significant cyber attack. Cyber Resiliency exercises test:
Business continuity planning
Critical council services analysis and IT systems analysis
The council’s (Gold/Silver/Bronze) crisis management framework
Crisis communications capabilities
Typical outcomes post the exercising of your Cyber crisis management framework are:
Independent assurance of the effectiveness of the Local Council’s leadership, coordination and complex response measures to a Cyber Crisis
Testing of the Local Council’s Data Breach Response Plan
Exercising the crisis communications plans for when Local Council services have been disrupted.
Completing an ICO Data Breach report
Improving the Local Councils’ Crisis Management Framework
