Cyber Resilience Checklist

› Ask bidders to set out how responsibilities will be split between the council, the supplier and any shared-service partner.

› Put exit and data-return requirements in the specification itself, not only in the contract terms.

› Define the service measures you want reported, so reporting tells you something you can act on.

› Specify where data will be held, who owns it, how long it’s kept, and how the supplier will support FOI and subject access requests.

› Make accessibility a requirement for any public-facing service, with evidence expected at acceptance.

› Include reuse, recycling and certified secure disposal in the requirement.

› Know your estate before you specify: an accurate asset and application list stops you buying for the estate you think you have.

› Ask for support-life commitments on anything you buy, and a plan for anything already near end of support.

› Include analogue switch-off readiness for every site and line in any telephony or connectivity requirement.

Councils have been among the most visible targets of cyber attacks in the UK. The councils below have spoken publicly about what happened, and many others now use their experience in their own committee papers. Each lesson maps to areas in this checklist.

The ICO’s reprimand for the October 2020 attack found weaknesses in patch management and an insecure password on a dormant account, which it said gave attackers their first way in.[cite: 5] It also reported that attackers deleted around 10% of the council’s backups before the council intervened.[cite: 5] The council disputes the ICO’s findings.

Sources: ICO · The Register

Malware reportedly arrived through a phishing email and lay dormant before it was activated.[cite: 5] Recovery took months.[cite: 5] The council initially set aside £380,000, but the final cost was around £1.1 million.

Sources: Infosecurity Magazine · Local Government Association case study

› Require multi-factor authentication and privileged access controls as standard, not as optional extras.

› Ask how the supplier will help you evidence controls to your auditor, your insurer and frameworks such as the NCSC Cyber Assessment Framework.

› Make sure the council, not the supplier, owns domains, DNS and administrative access.

› Plan recovery on the basis that paying a ransom isn’t an option, and specify backup and recovery accordingly.

› Set recovery time and recovery point objectives from your own service priorities, then specify against them.

› Require immutable backups and regular restore tests, with evidence you can see.

› Ask how the supplier would support you through an incident, and who does what in the first 24 hours.

ICT leads are often asked by members, audit committees or leadership for assurance on cyber risk before they have the evidence to give it. We’ll deliver a short, jargon-free briefing for your members or leadership team, shaped around your results and your council’s priorities.

The briefing covers:

› what councils have learned from cyber attacks, and why it matters to yours

› what good looks like across the five layers in this checklist

› the questions members should be asking, and what good answers sound like

Around 45 minutes, in person or online, and free of charge. It isn’t a sales presentation, and there’s no commitment.

To arrange a briefing, email connor@unity.world or call Unity World on 0330 119 6666.

Prefer to talk through your results first, or ready for an evidence-based view?Ask us about the Council ICT Health Check: an independent, read-only review of the same 22 areas.