UK Ministry of Housing, Communities and Local Government (MHCLG) 
MHCLG’s Defend as One (DaO) programme is supporting councils to address shared cyber threats through collaboration and knowledge sharing. We want to take a unified and proactive approach to cyber security by sharing data, expertise and capabilities across government and the wider sector.
The Government Cyber Security Strategy (2022 to 2030)
“While developing a strong foundation of organisational cyber security is critical, the scale and pace of the threat demands a more comprehensive and joined up response. Government will therefore ‘defend as one’; harnessing the value of sharing cyber security data, expertise and capabilities across government to present a defensive force disproportionately more powerful than the sum of its parts.”
Programme aims
Based on one of the key pillars of the Government Cyber Security Strategy, Defend as One aims to:
- improve cyber incident detection by ensuring councils can effectively detect and monitor cyber security incidents
- reduce the impact of cyber incidents by coordinating the cross-government response, improving how councils respond, and minimising the impact of repeated or scaled attacks
- facilitate knowledge sharing including cyber intelligence, best practices, and tools across councils and the wider public sector
Current work
We’re running a number of pilots to gather evidence and inform our long-term approach to supporting the sector.
Improving cyber incident detection
We recently completed a six-month pilot with 10 councils to assess the costs, benefits, and challenges of providing Security Operations Centre (SOC) services to local government.
A SOC provides continuous monitoring and analysis of security threats, helping organisations detect and respond to incidents more quickly and effectively.
We are now evaluating the pilot results and exploring potential interventions to support the sector's incident detection capabilities. The findings will help inform our long-term approach to strengthening cyber resilience across local government.
Updates and findings will be shared through our regular engagement channels and newsletters as the evaluation progresses.
Sharing cyber intelligence
We're exploring how best to share cyber threat and vulnerability information with councils through two pilots:
Cyber Alert Service (CAS) - a 3-month pilot launched in March 2025 to deliver critical information about emerging threats and vulnerabilities. Feedback from participants will inform our long-term approach to intelligence sharing with the sector.
Vulnerability Reporting Service (VRS) - launched in February 2025 in partnership with the Government Cyber Coordination Centre (GC3), this pilot tests how councils can receive real-time alerts about specific vulnerabilities, communicate directly with security researchers, and improve visibility and response times.
Responding to cyber incidents
To help councils respond quickly and effectively to severe cyber incidents, MHCLG has made a Cyber Incident Response (CIR) service available.
The service gives eligible councils access to a National Cyber Security Centre (NCSC) assured provider for containment and eradication support following a significant cyber incident.
In the event of a cyber incident, you should report it to the NCSC through their reporting portal. You should also report incidents, where appropriate, to:
- the Information Commissioner’s Office (ICO)
- the National Crime Agency (NCA) or call 0300 123 2040
- your regional Warning Advice and Reporting Point (WARP) to support wider threat intelligence sharing within the sector
NCSC will share reports promptly with MHCLG, who will monitor the reports on a 24/7 basis so we can assess whether the incident meets the threshold for activating the CIR service.
Further details, including eligibility, activation criteria, and reporting, are available in our CIR service guidance for councils.
Stay updated and get involved
Sign up to the newsletter to receive updates on the Defend as One programme, including upcoming pilots, as we often invite participation through expressions of interest.
If you have any questions or would like to get involved in a future pilot, you can contact us at [email protected].