Cyber security and local government

When the council goes offline, cyber security suddenly becomes everyone’s problem

Cyber security in local government is not simply about protecting computers. It is about keeping essential services running and making sure residents can still get help when something goes wrong.

There is something slightly misleading about the phrase “cyber attack”.

It makes you picture hackers in dark rooms, complicated lines of code and stressed IT teams watching warning messages flash across a screen.

For a local council, the reality can feel much more ordinary, and much more personal.

It can mean a resident cannot access a housing service. A member of staff cannot open an important case file. A payment cannot be processed. A care team cannot reach the information it needs. Or hundreds of employees arrive at work and discover that the technology they usually depend on is simply not available.

That is why cyber security is no longer just an IT issue. It is a public service issue.

What does a cyber attack actually look like?

We do not have to imagine the consequences.

In 2020, the BBC reported that a cyber attack on Redcar and Cleveland Borough Council left more than 135,000 residents without online public services for nearly a week. The council’s website and computer systems were affected, and the Information Commissioner’s Office became involved.

That is the part that can easily get lost among the statistics.

Behind every unavailable system is a real person trying to do something important.

Council technology supports everyday life

Housing

Social care

Planning

Waste services

Council tax

Benefits

Licensing

Elections

Children’s services

Technology now sits behind almost every one of these services. The more connected local government becomes, the more important it is to think about what happens if that technology is disrupted.

A technical problem can quickly become a community problem

A cyber incident rarely stays neatly inside the IT department. The effects spread quickly through an organisation and out into the community.

Cyber incident

Systems become unavailable

Staff cannot access the tools or information they need

Public services slow down or stop

Residents and vulnerable people feel the impact

The threat has changed, but so have councils

This is not an argument against digital transformation. Far from it.

Well-designed digital services can be quicker, easier to access and more efficient. The problem comes when organisations modernise the services people can see without giving the same attention to the systems, suppliers and security sitting behind them.

UK government research into the changing cyber threat facing English councils warns that weaknesses in digital systems can put both sensitive information and the continuity of services at risk.

Two questions worth asking

Could somebody steal or expose our information?

Could we still operate tomorrow if some of our technology disappeared tonight?

Good cyber resilience needs to answer both.

Cyber security cannot sit with the IT team alone

The IT team clearly has a major role to play. But it cannot make every decision on behalf of the organisation.

An IT manager should not be left to decide which public services must be restored first after an attack. Nor should the technology team be solely responsible for deciding how much operational risk the council is prepared to carry.

Those are leadership decisions.

The Cyber Assessment Framework for local government gives councils a structured way to assess and strengthen their cyber resilience. It was developed from the National Cyber Security Centre’s framework and adapted for local government.

Local Digital reported in January 2026 that 90 councils had completed a CAF assessment, with more working through the process. Councils said the framework had helped them focus resources, gain access to technical guidance and keep cyber resilience on the senior leadership agenda.

A simple way to look at it

IT teams manage technology. Leadership teams decide which risks matter most to the organisation and the people it serves.

What could your council least afford to lose?

Here is a useful exercise for a leadership meeting.

Forget ransomware, firewalls and phishing emails for a moment. Instead, imagine arriving tomorrow morning and discovering that one critical system will be unavailable for the next seven days.

Which system would cause the biggest problem?

Once you have an answer, work through these questions:

Who is responsible for the service?
Which systems and suppliers does it rely on?
Where is the information stored?
How quickly could the service realistically be restored?
When was the recovery process last tested properly?
Could staff continue working without the main system?
Who would communicate with residents?
What would happen if a key supplier was also unavailable?
Who has the authority to make decisions during the incident?

This conversation is much more useful than simply asking whether the organisation is secure.

No council, business or public body can honestly promise that it will never face a cyber incident. The more sensible question is whether it can respond, recover and continue supporting people when one happens.

AI adds another piece to the puzzle

Artificial intelligence presents a real opportunity for local government. It could help teams process information, reduce repetitive administration and deliver services more efficiently.

But it also introduces new questions.

What information is being entered into AI tools? Who has approved those tools? Can employees check the accuracy of the answers? Could confidential information be exposed? How could AI be used by criminals to create more convincing phishing messages or impersonate trusted people?

Local Digital has already confirmed that the move to version 4.0 of the Cyber Assessment Framework reflects changes in the threat landscape, including AI-related risks.

AI adoption and cyber security should be part of the same conversation, not two separate projects.

The weak point might be surprisingly ordinary

Not every successful attack begins with an incredibly sophisticated piece of hacking.

Sometimes the opening is much simpler:

An old account
that was never disabled.

Outdated software
that has not been patched.

A convincing email
opened by a busy employee.

A supplier account
with more access than it needs.

An untested backup
that cannot be restored.

A privileged account
without enough protection.

Technology matters, but so do people, processes, suppliers and clear ownership.

Cyber resilience needs to reach into procurement, HR, finance, communications, service delivery and senior leadership. It cannot be something that only gets discussed when the IT team raises a ticket.

Better cyber security does not always mean buying more software

Councils are already under considerable financial pressure. It is understandable that another cyber security proposal can feel like yet another demand on an already stretched budget.

But the answer is not automatically another expensive security tool.

Before spending more, it is worth understanding what is already in place, whether it is configured properly and whether it would work during a real incident.

A practical starting point

Know which systems, devices and accounts you have.
Review who has administrator or privileged access.
Apply multi-factor authentication consistently.
Keep software and devices patched and supported.
Understand which third parties have access to council systems.
Protect backups from the same attack affecting live systems.
Test restoring systems and data instead of assuming it will work.

The Local Government Association also provides councils with guidance, training, exercises, consultancy, resources and incident-response support.

There is plenty of guidance available. The real challenge is turning that guidance into something practical that works on an ordinary Tuesday morning.

One question every council leadership team should ask

Perhaps it is time to change the way we talk about cyber security.

Instead of asking:

“Are we protected from cyber attacks?”

Ask:

“If we were attacked tonight, which services could we still provide tomorrow?”

That is a more difficult question, but it is also a much more useful one.

Residents do not see the difference between a technical problem and an operational problem. They simply know that the service they need is not working.

Cyber security is not just about protecting servers, laptops and data. It is about protecting a council’s ability to look after its community.