Summary
- The Local Digital programme has published practical guidance addressing recurring challenges identified by councils.
- The resources initially focus on leadership engagement, asset visibility, and risk-based prioritisation.
- The guidance forms part of a wider £6 million support programme involving 52 councils.
English local authorities have received new practical cybersecurity guidance intended to improve senior leadership engagement, asset management, and the prioritisation of security investment across essential council services.
The resources, published on 19 October through the government’s Local Digital programme, form part of a wider initiative supporting councils that have completed assessments against the Cyber Assessment Framework (CAF).
The CAF Support programme provides £6 million to help 52 councils accelerate improvements identified through their assessments. Its latest resources concentrate on Objective A of the framework, which addresses the management of security risk.
The guidance was developed using interviews, workshops, and direct engagement with councils to identify barriers that repeatedly prevent improvements from being implemented.
Rather than introducing another assessment requirement, the programme seeks to translate existing findings into changes that councils can deliver within their organisational and financial constraints.
Moving cybersecurity into corporate governance
The first resource addresses the difficulty of establishing sustained engagement from senior council leadership.
Local government cybersecurity has traditionally involved technical departments responsible for networks, systems, and data. Yet disruption of those systems can affect statutory services, public contact, finance, social care administration, and other responsibilities that extend beyond an IT department.
The new guidance encourages councils to frame cybersecurity as an organisation-wide risk and establish clearer ownership of decisions about exposure and resilience.
That includes explaining security requirements in terms of service delivery, identifying accountable senior officials, and connecting technical improvement plans with wider organisational priorities.
Leadership engagement is not simply a question of securing additional budget. It also determines how competing demands are resolved when a council cannot immediately fund every recommended improvement.
Different services may have different tolerances for interruption or data loss. A corporate approach can make those differences visible when decisions are made about investment, contingency arrangements, and acceptable risk.
Asset visibility as a foundation for resilience
A second resource focuses on creating and maintaining accurate records of the technology and dependencies supporting council services.
The programme found that councils can struggle to establish a complete view of their assets, particularly when information is distributed across technical teams, service departments, and external suppliers.
An effective asset register should do more than enumerate devices. It needs to identify the systems, information, suppliers, and infrastructure that particular services depend upon.
For example, a council may understand which application supports a public-facing service without having a complete view of the identity infrastructure, network connections, third-party hosting, and operational processes needed to keep that application functioning.
Those dependencies become especially important during an incident. Restoration teams need to know which systems are necessary to resume essential functions, while decision-makers need to understand the consequences of delayed recovery.
Local Digital’s approach emphasises knowledge held by service teams as well as technical inventories, reflecting the fact that operational staff often understand dependencies that are not fully represented in central asset records.
Directing limited resources towards material risk
The third resource addresses the prioritisation of improvement actions following a CAF assessment.
Councils may identify numerous weaknesses across governance, access management, monitoring, suppliers, recovery planning, and other security capabilities. Funding and staffing limitations mean that addressing every finding simultaneously is rarely realistic.
The guidance promotes a risk-based approach in which councils evaluate how individual weaknesses affect essential services before selecting the next improvements.
This connects security decisions to operational consequence. An unresolved dependency affecting a critical service may deserve earlier attention than a technically similar weakness associated with a less consequential system.
It also creates a more defensible record of why particular investments were selected, deferred, or treated through alternative controls.
The new resources are separate from an earlier government-backed opportunity for councils to undertake funded red-team testing. Testing can reveal how an attacker might move through an environment, while improvement guidance addresses the organisational decisions required to act on the findings.
Local Digital says the guidance reflects recurring themes gathered from councils across England and is intended to help authorities turn CAF findings into practical improvement plans. The initial resources cover governance, visibility, and prioritisation, with the wider support programme continuing to assist participating councils.
