CAF Support is a £6 million fund helping 52 councils that have completed a Cyber Assessment Framework (CAF) assessment to accelerate their cyber resilience improvements and strengthen resilience across local government.

Since our last blog post, we have published our first set of practical resources to help councils strengthen their cyber resilience, with an initial focus on CAF Objective A: Managing security risk. You can view the resources on Security.gov.uk.

The resources respond to recurring challenges councils raised through our research and provide practical guidance to help councils:

• engage senior leaders with cyber security by framing cyber as an organisation-wide risk and supporting clearer ownership, governance and decision-making
• know what they need to protect by building and maintaining an effective asset register that gives them better visibility of the assets and dependencies supporting essential services
• prioritise improvements based on risk so that limited time, resources and funding are focused on the actions that will have the greatest impact

How we created the guidance

We have been working with exemplar councils to identify best practice and understand the common blockers and challenges they face. We travelled across England and held online interviews, workshops and one-to-one sessions with exemplar councils. This allowed us to hear directly from councils, understand their needs and learn from approaches that have worked in practice.

What we heard from exemplar councils

• Senior leadership engagement: the importance of senior leadership buy-in in moving cyber from an IT issue to a shared corporate responsibility, and the sustained work required to embed a cyber-aware organisational culture.
• Asset management: the challenges of establishing ownership and maintaining an accurate view of the assets, systems, data and suppliers supporting essential services, as well as the value of building visibility from the bottom-up using the knowledge held by service teams.
• Prioritising action according to risk: the difficulty councils face in deciding which cyber improvements should come first and directing limited people, time and money towards the actions that will most reduce risk to essential services.

The guidance

Each resource responds to a challenge raised by the councils and shares practical approaches to addressing it.

Engage senior leaders

Purpose: Help councils engage with senior leaders to make sure cyber security is understood and managed as a council-wide risk.

Improve asset management and visibility

Purpose: Help councils make asset management an organisational capability.

Prioritise improvements according to risk

Purpose: Help councils take a risk-based approach to prioritising the actions from your CAF for local government improvement and implementation plan (IIP)

You can also find some practical steps to help you with these and other priority areas in our previous blog post.

Read the guidance and share your feedback

We want these resources to reflect the realities councils face.

After reading the guidance, please use our short feedback form to tell us:

• whether the guidance is useful and easy to apply
• whether the examples reflect your council’s circumstances
• what additional tools, examples or support would help you

Share your feedback through our short usability survey

You can also send feedback or questions to [email protected].

Your feedback will help us improve these resources and shape what we develop next.

Get started with the CAF for local government

Completing a CAF assessment and having it assured through our independent assurers can help put your council in a stronger position to access future support.

If you’ve not started the CAF yet, you can:

1. find out what the CAF is and how it can benefit your council
2. learn what the assessment involves and how much time it takes
3. prepare for the self-assessment

We know you still have questions about how to approach the CAF. We’ve published answers to common questions on our website.

If you have additional questions or need support, email [email protected].