TOWN & PARISH TECHNOLOGY

Cyber Resilience Checklist

A quick self-assessment for clerks and councillors. Answer Yes, No or Not sure for each question, then use the score at the end to spot where the gaps are. It takes about 10 minutes. It also covers the digital and data requirements behind Assertion 10 of your Annual Governance and Accountability Return (AGAR). Items marked ★ are critical.

About You

This part isn't scored. It helps us tailor any advice to your setup.

Name *

Job Title

Email Address *

Phone *

Council Name *

Roughly How Many Users/Staff? *

Number of Councillors *

Annual budget (roughly)Under £25,000£25,000–£200,000Over £200,000

Council email addresses *.gov.ukAnother council-owned domainPersonal or free email

Roughly how many computers and devices? *

Who supports your IT now? *In-houseAn IT providerShared serviceNobody

If a provider, when does the contract renew? *

Anything prompting you to look at this now? (e.g. audit, insurance renewal, new clerk) *

Q1. Direction and Control

A named person or committee is responsible for the council’s IT, and councillors know who it is *YesNoNot Sure

The clerk knows who to call when IT goes wrong *YesNoNot Sure

You have a written agreement with each IT supplier that covers how you’d get your data back if you left *YesNoNot Sure

The budget includes planned replacement of IT equipment, not just repairs when something breaks *YesNoNot Sure

If the clerk was off for a month, someone else could get into council email and files without using the clerk’s password *YesNoNot Sure

Q1 Score

Q2. Information and Obligation

As public authorities, councils must respond to Freedom of Information requests under the Freedom of Information Act 2000 and handle personal data under UK GDPR and the Data Protection Act 2018. From 2025/26, Assertion 10 of the AGAR asks councils to confirm each year that they meet these digital and data duties. These questions check the IT side of them.

The clerk and all councillors use council email addresses on a domain the council owns, not personal or free email accounts *YesNoNot Sure

A named person handles Freedom of Information and subject access requests within the legal time limits *YesNoNot Sure

The council has adopted policies covering IT use, data protection and how long records are kept *YesNoNot Sure

Everyone knows what to do, and who to tell, if personal data is lost or sent to the wrong person *YesNoNot Sure

The council website meets the WCAG 2.2 AA accessibility standard and has an up-to-date accessibility statement *YesNoNot Sure

The website publishes everything you’re required to publish, including your publication scheme, privacy notice and the transparency code that applies to your council *YesNoNot Sure

When IT equipment is replaced, old devices are securely wiped, then reused or recycled responsibly *YesNoNot Sure

Q2 Score

Q3. Platform and Infrastructure

You keep an up-to-date list of the council’s IT equipment and software *YesNoNot Sure

Any public or hall wifi is kept separate from the council’s own devices *YesNoNot Sure

If the internet went down, you’d know how to keep working and who to call *YesNoNot Sure

The council, not a supplier or a former clerk, controls the admin login for your Microsoft 365 or Google account *YesNoNot Sure

Every laptop, tablet and phone used for council business updates automatically *YesNoNot Sure

Any server or network storage box you have is still supported by its manufacturer (answer Yes if you don’t have one) *YesNoNot Sure

You know who supports each system you rely on, such as accounts, payroll, bookings, or burial and allotment records *YesNoNot Sure

Your phone lines, including any alarm or lift lines, will keep working after the analogue phone network is switched off on 31 January 2027 *YesNoNot Sure

Every device used for council business is password- or PIN-protected *YesNoNot Sure

Q3 Score

Q4. Protection

Most council cyber attacks have started with something ordinary: a missed patch, an old account, a convincing email. Identity and cyber security are two of the four critical areas, and both are far easier to specify up front than to add later.

Every council email account uses two-step login (a code or app), not just a password ★ *YesNoNot Sure

You know what to do, and who to call, if the council is hit by a cyber attack ★ *YesNoNot Sure

The council, not a supplier or an individual, controls its own domain name (e.g. yourcouncil.gov.uk) *YesNoNot Sure

Q4 Score

5. Continuity

You’ve checked in the last year that you can restore council files and email from backup ★ *YesNoNot Sure

There’s a written plan for keeping council business running if IT fails, such as the clerk’s laptop being lost or stolen ★ *YesNoNot Sure

Q5 Score

Total Score

How did you score?

Count your Yes answers. No and Not sure both score zero.

21–26: Your council’s IT is in good shape — worth a periodic check to make sure it stays that way.

14–20: You have solid foundations but some real gaps — worth a conversation about priorities.

Below 14: There are meaningful risks here, particularly around access, backup and continuity — we’d recommend talking it through sooner rather than later.

Any ★ item answered No or Not sure? It’s worth a conversation whatever your score.

Several Not sure answers? That usually means nobody owns that area, which is worth fixing in its own right.

Found gaps? Book your Technology Resilience Review.

We’ll go through your results with you. The questions follow the 26 areas of our Council ICT Health Check, in the same order, so your No and Not sure answers show us where to start.

Book at unity.world/book-your-technology-resilience-review or scan the QR code.

Prefer a quick chat? Call Unity World on 0330 119 6666 or email connor@unity.world

Scan to book

Keeping in touchYes, I'd like Unity to send me occasional marketing, including guidance, updates and event invitations. I can unsubscribe at any time.Sure!

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.