Resetting the relationship between local and national government. Read our Local Government White Paper

Building a cyber resilient service: guidance for directors of environment services

Building a cyber resilient service guidance for directors of environment services
This document aims to support you to develop proactive, protective strategies and capabilities to enhance the cyber resilience of your council services. Some recommendations are technical, some organisational and some are about your people.


This page details supplementary guidance specific to council planning services. Full guidance and steps can be found in our guidance document.

Shades of blue

Step 5: Be clear on why your service may be targeted

Consider the three categories of harm caused by a cyber attack: being robbed (theft of money, data, or intellectual property), being weakened (espionage, political interference, or prepositioning) and being hurt (ransomware and destructive or catastrophic attacks)[1].

  • Which of these motivations is most relevant to your team? 
  • What do you have that makes your service vulnerable? 
  • Is data theft at the top of this list? 
  • Would there be data of value about environmental services, residents, or staff? 
  • Are you aware of all the digital data that the council’s control and safeguard this data of interest to malicious actors, making them a target?[2] 

Environmental Services, and teams within your directorate, are supported by a huge amount of data. This will include, for example, use of CRM systems, data on vulnerable people e.g. those unable to put out their rubbish/recycling, waste management data, data related to fly-tipping enforcement, use of CCTV images, data from IOT sensors, LLPG data (Local Land and Property Gazetteer) air quality data, water quality and management, environmental permitting, environmental impact assessments (EIAs), public health and safety, GIS (Geographic Information System) data, a lot of which will contain personally identifiable information (PII).

This amount and type of data makes your service vulnerable to cyber attacks and means the impacts to staff, residents and council services can be very damaging. Attackers may be looking to steal sensitive data for resale or to perpetrate further criminal acts, and you will be particularly vulnerable to extortion from criminals who recognise the criticality of this data and the need to keep services running.

Shades of blue

Step 6: Be clear on the impact of a cyber attack

Below are a few examples of the way in which a cyber attack could affect your service area and things you should consider when preventing or recovering from a cyber attack:

Figure 2: Example of service impact

During a cyber attack you may have no access to the internet or your networks within which documents are stored. You need to consider how the loss of internet access might affect your critical services, and how you could keep them running – you may need alternative manual processes in place to keep a skeleton service operational.

Working with IT support prior to an incident to prioritise the systems to be recovered will assist them with their workload and allocation of resources.

Similarly, identify where processes are dependent on other internal and external systems being available. Simply restoring one system in isolation will not be sufficient to allow a service to start operating after an attack.

Always work in partnership with your IT team if you are making any changes to your service. This could include new information sharing agreements, procuring new systems, or changes to processes. Cyber security and IT implications should be factored into all these decisions.

Things to consider:

  1. Which critical services operated by your team rely on internet access?
  2. Which of these critical services is prioritised to get back online first?
  3. Have you created offline records and plans for use during an attack and ensure all teams have access to them?

Figure 3: Example of financial impact

If a cyber attack was to impact your team’s services, it could affect the financial systems that you operate. For example, if the system responsible for Environmental Enforcement Collection was unavailable, you may not be able to process fines on time.

Things to consider:

  1. Does your team have an offline record of fines to be collected?
  2. How would you ensure people who were in receipt of enforcement notices could make the payment if the collection system was unavailable? 
  3. Have you discussed these risks with the finance team and ensuring this is included in both yours and their continuity plans?

Figure 4: Example of data impact

If inaccurate or manipulated data was released regarding water quality in rivers or other water bodies, it could mislead your service and the public about the health of ecosystems.

Incorrect assessments might result in inadequate protective measures, leading to harm to aquatic life, habitats, and overall environmental quality.

Areas to consider:

  1. Are offline records available for use during a cyber attack?
  2. If you were unable to share data due to a cyber attack at your service, how can you communicate with other agencies such as the Environment Agency?
  3. Discussing these risks with your IT service and other agencies you would need to contact will ensure there is a robust back up system in place.

Shades of blue

Step 7: Be clear on ways to mitigate cyber risks

Table 1: Storing data

Theme Context  Areas to consider

As your service becomes more digital, systems will need to move online.

To limit vulnerabilities, staff need support to run their devices on the latest available software and to install regular security updates. 

How regularly is software updated?

Who is responsible for update rollout?

How would your service operate without access to databases?

How do you seek assurance that software is up to date?

Cyber security measures Implement cyber security measures on council hardware such as firewalls, antivirus software, and intrusion detection systems to protect against cyber attacks. 

Does all hardware support updated systems?

How often does staff training take place?


Devices and networks

Storing and accessing data on personal devices or through a public, unsecure network could create vulnerabilities.

Any data stored in an unsecured way can create vulnerabilities, including data downloaded onto a desktop.

Do staff using personal devices to access sensitive data?

Are all staff in your service aware of potential vulnerabilities exposed by the use of public networks?

How often to staff delete data from their desktop?


Your service should have suitable, secured backups of essential data that would allow for a quick and prompt recovery of essential services. 

This may include encrypted backups held in a secure off-site environment, removable media in physically secure storage, segregated backups, or appropriate alternative forms.

How often do backups take place?

Where are backups stored?
Are your team aware of how to access backups in case of an attack?

Who has access to backup data?

Which member of your team is responsible for this?


Table 2: Managing data

Theme Context  Areas to consider

Handling sensitive data


You may be less likely than other directorates to be handling sensitive data on a day-to-day basis, however, that doesn’t mean that it won’t happen!

Your team must take extra precautions to protect the sensitive information.

Are you aware of all the sensitive data your service holds? 

How are physical notes and recorded stored or destroyed?

What systems are used to store electronic records and information?


Access controls


To ensure sensitive data is protected, you should implement access controls and restrict access to sensitive information only to authorised personnel. 

Training staff members on secure data handling is essential, and ensure they are aware of their responsibilities in protecting environmental services data.

How is sensitive information stored in your service? 

How is it protected?

Who has access to data storage systems?

How often does your team review accesses?

How often does training take place?

Is multi-factor authentication in use across programmes?

Regular audits

Your service should be conducting regular audits of data management practices to ensure that they comply with relevant regulations and industry standards, e.g., ensuring data is only held for a relevant amount of time or is stored in the correct system. 

Keep track of any changes in data protection laws and update practices accordingly. 

How often do you audit your data management practices?

Who is responsible for organising this audit?

How do you seek assurance that effective audits have taken place?


Data protection regulations


The UK is subject to the General Data Protection Regulation (GDPR) and the Data Protection Act (2018).

It is your obligation to ensure that your team complies with these data protection regulations to protect your services personal data and ensure that the personal data of environmental services is collected, processed, and stored lawfully, fairly, and securely.

Is your team aware of the UK GDPR regulations and how they affect your work?

How often does staff training take place?


Record keeping


Accurate and up-to-date record keeping is essential in environmental services for many reasons; including regulatory compliance, emergency response planning, long-term planning and sustainability, research, and resource allocation.

Reliable record-keeping enhances the credibility of environmental services.

How often do your team update records?

How are records stored and updated?


Risk management


Risk management processes, such as conducting regular risk assessments, implementing appropriate security measures, and developing contingency plans for data breaches, are essential to identify and mitigate potential risks to the security and privacy of environmental services data. 

These risks should be added to the environmental risk register and raised to SMT.

How often do risk assessments take place in your service?

What contingency plans are in place for data breaches?

Are staff aware of data breach processes?



Table 3: Sharing data

Theme Context   Areas to consider



Different government agencies and departments at various levels (local, regional, national) may be involved in environmental services management. 

Collaborative data sharing allows these entities to work together seamlessly, avoid duplication of efforts, and create a more comprehensive understanding of environmental issues.

Collaborative efforts may involve the establishment of data standards and protocols to ensure consistency among different datasets. Standardised data formats enable smoother collaboration and data integration.

Who is responsible for data management and sharing in your service?

How often does training take place?

What procedures are in place to ensure effective and secure data sharing between teams and partners?

Do you feel confident that members of your team are safely sharing information?


Offline records

When assessing the risks to your service, you should also think about any partner organisations you work with, suppliers and any systems you have external links with. 

Managing offline records in environmental services is as crucial as managing digital records. Even in this era of digital technology, many councils maintain physical or offline records for various reasons, including legal requirements, historical documentation, and as a backup strategy.

Do you have processes in place for sharing offline information with partners?

What security measures are in place for sharing sensitive information?


Table 4: Awareness and training

Theme Context Areas to consider
Positive culture

A positive cyber security culture instils the importance of cyber security and the role every individual has in helping to protect the council. 

It will ensure that staff view cyber security as a business enabler rather than a hindrance and is understood by all councillors and staff. 

A positive culture contributes to the overall effectiveness, efficiency, and ethical conduct of your service.

Does your team speak openly and regularly about cyber security and risk?

Is it discussed at a board level?

How often does your service review the cyber security strategy?

How confident do your team feel with the strategy? 


Experience shows that cyber risk to councils does not only come from external sources; employees can often present some of the most significant risks to cyber security. 

By clicking on links in phishing emails, storing sensitive data on personal devices, using unsecured networks, weak passwords or not installing security updates, employees can put your information under serious threat.

Do you understand the awareness levels of cyber security within your team?

How can you ensure cyber risk is pitched correctly for various roles in your service?


Cyber security training should be refreshed regularly. 

As a director you’ll be aware of the high demands on the staff within your service, however this training must be prioritised to reduce the risk of a cyber attack.


How often does cyber security training take place in your service?

Is training appropriate for all staff at different technical levels?


Reporting In order to create a positive cyber security culture in your service, all staff must be aware of the process of reporting a potential breach and feel confident to do so at all levels.

Do all team members understand the process of reporting a data breach?

Is there a service-wide communication strategy in place to report data breaches? 

What impact would a data breach have on your team?

Workforce A large amount of agency staff may be being used by your service.  How can you integrate cyber secure practices into this temporary and externally managed workforce?


Table 5: Supply chain management

Theme Context Areas to consider

Co-ownership involves establishing shared environmental goals and objectives throughout the supply chain. 

All stakeholders, from suppliers to service providers, align their efforts toward common sustainability targets.

Do members of your team work closely with other teams during the Environmental Services process?

What barriers are in place during this process?

What needs to change in order to streamline this process?

Contract management Your service should consider including specific cyber security requirements and clauses in their contracts with external providers to ensure that security measures are in place throughout the duration of the contract.

Does your service include cyber security requirements within contracts?

How is this measured?

Monitoring and reporting Regular monitoring and assessment of external providers' security practices should be conducted to ensure that they are maintaining a strong security posture.

How would you work with partner organisations if your IT systems were unavailable? 

How would you work with partner organisations if they were experiencing a cyber attack themselves?


Table 6: Legislative Implications

Law Cyber security Implications
Environment Act 2021

This involves extensive data collection and management. Robust cyber security ensures the integrity and reliability of this data, preventing unauthorised alterations that could impact decision-making and policy formulation.

The Act also requires the development and management of environmental plans, which means that the confidentiality of these plans is essential to prevent compromise strategic initiatives or regulatory compliance efforts.

Environmental Protection Act 1990

This Act involves digital reporting mechanisms; therefore, robust cyber security is crucial to ensure the security of online platforms, preventing unauthorised access to environmental compliance reports and maintaining the credibility of reporting processes.

The Act is further involved in enforcement activities, which means you must protect the integrity of enforcement data, preventing tampering or unauthorised access that could undermine regulatory actions and legal proceedings.

Waste and Resources Action Programme (WRAP) Regulations

Ensuring the security of this data is crucial for preventing unauthorised access or manipulation, which could impact waste reduction initiatives and resource efficiency programmes.

WRAP regulations mean collaboration among stakeholders. Cyber security ensures secure communication and data exchange, preventing potential breaches that could compromise collaborative efforts.

Control of Pollution (Oil Storage) (England) Regulations 2001

Cyber security is essential to protect against cyber threats that could disrupt operations, compromise safety measures, and result in environmental disasters.

Cyber security measures prevent unauthorised access to critical systems involved in oil storage. Unauthorised access could lead to spills or leaks by activists looking to further their cause and damage reputation of your service.

Water Resources Act 1991

Water, as part of Critical National Infrastructure (CNI), means the cyber security implications are vast. It is essential to prevent unauthorised access or manipulation, ensuring the accuracy of water quality assessments crucial for environmental conservation and public health.

Cyber security measures also protect against risks of cyber attacks that could compromise water quality. Such an attack could potentially lead to contamination, posing risks to ecosystems and the local population. 

Clean Air Act 1993 This Act involves digital monitoring of air quality, therefore, cyber security safeguards these monitoring systems: hacktivists may seek unauthorised access or manipulation of air quality data which can have significant public health and environmental consequences.
Hazardous Waste Regulations 2005

Cyber security protects data related to the disposal and handling of hazardous waste. Unauthorised access or manipulation of this data would lead to environmental risks and regulatory non-compliance.

Another aspect is the secure communication and collaboration among stakeholders involved in hazardous waste management.