Defend as One

MHCLG’s Defend as One (DaO) programme is supporting councils to address shared cyber threats through collaboration and knowledge sharing. We want to take a unified and proactive approach to cyber security by sharing data, expertise and capabilities across government and the wider sector.

The Government Cyber Security Strategy (2022 to 2030)

“While developing a strong foundation of organisational cyber security is critical, the scale and pace of the threat demands a more comprehensive and joined up response. Government will therefore ‘defend as one’; harnessing the value of sharing cyber security data, expertise and capabilities across government to present a defensive force disproportionately more powerful than the sum of its parts.”

Programme aims

Based on one of the key pillars of the Government Cyber Security Strategy, Defend as One aims to:

improve cyber incident detection by ensuring councils can effectively detect and monitor cyber security incidents
reduce the impact of cyber incidents by coordinating the cross-government response, improving how councils respond, and minimising the impact of repeated or scaled attacks
facilitate knowledge sharing including cyber intelligence, best practices, and tools across councils and the wider public sector

Current work

We’re running a number of pilots to gather evidence and inform our long-term approach to supporting the sector.

Improving cyber incident detection

We recently completed an initial six-month pilot with 10 councils to assess the costs, benefits, and challenges of providing Security Operations Centre (SOC) provision to local government. We are now evaluating the results and exploring other potential interventions to support the sector and inform our long-term approach to improving incident detection. Updates and findings will be shared through our regular engagement and newsletters.

Cyber Incident Response (CIR)

We are planning to launch a Cyber Incident Response (CIR) service for local government. This service will provide eligible councils with access to an NCSC Enhanced Level CIR provider to support the containment and eradication of cyber incidents.

We want to help councils respond to and recover from cyber incidents as quickly as possible, reducing disruption and protecting essential public services.

Further guidance on eligibility and how to access this service will be shared soon.

Sharing cyber intelligence

We’re exploring how best to share cyber threat and vulnerability information with councils through two pilots:

Cyber Alert Service (CAS) - an initial 3-month pilot launched in March 2025 to deliver critical information about emerging threats and vulnerabilities. The evidence collected and feedback from participants will help us deliver our long-term approach to future intelligence sharing with the sector

Vulnerability Reporting Service (VRS) - a pilot launched in February 2025, in partnership with the Government Cyber Coordination Centre (GC3), we’re testing how councils can receive real-time alerts about specific vulnerabilities at their council, communicate directly with the security researchers, and improve visibility and response time across services

We have begun onboarding councils onto the VRS platform from July 2025. If you would like to be involved, please get in touch via [email protected].

We are also continuing to share urgent threat alerts with the sector via GOV.UK Notify and pass-on intelligence received from central government partners. 

Reporting incidents

We recommend that you report all suspicious activity and confirmed cyber incidents to the National Cyber Security Centre (NCSC) using its Report an incident form.

You should also notify Local Digital at MHCLG as early as possible: [email protected]. We’ll advise on available support and help coordinate with other central government departments.

Additional support:

the Local Government Association’s Cyber Incident Grab Bag can help guide your response in the early stages of an incident
the NCSC maintain a list of assured suppliers. If you need to engage a CIR provider, speak to your procurement team early

NCSC Report an incident form

Stay updated and get involved

Sign up to the newsletter to receive updates on the Defend as One programme, including upcoming pilots, as we often invite participation through expressions of interest.

If you have any questions or would like to get involved in a future pilot, you can contact us at [email protected].