Item 09 - Cyber Incident Response Plan (CIRP)
West Dunbartonshire Council · 5 February 2025
Back to Corporate Services Committee — 5 February 2025 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Some pages contain no extractable text. They may be blank, graphics or scanned pages. OCR has not been applied.
Page 1
WEST DUNBARTONSHIRE COUNCIL Report by Chief Officer – People & Technology Corporate Services Committee: 5th February 2025 ___________________________________________________________________ Subject: Cyber Incident Response Plan (CIRP) 1. Purpose 1.1 The purpose of this report is to seek approval of the new Cyber Incident Response Plan (CIRP). 2. Recommendations 2.1 The Committee is asked to: 2.1.1 Note that there have been several recent high profile cyber incidents including Scottish public sector; 2.1.2 Note that the CIRP will be the key document used by the Council to manage major Cyber Incidents, as recommended by the Scottish Government through its Public Sector Action Plan (PSAP) for Cyber Security; and 2.1.3 Approve the Council’s Cyber Incident Response Plan (CIRP) as appended. 3. Background 3.1 The Council is expected to adhere to national guidance both from UK and Scottish Governments. 3.2 There is published guidance from the Scottish Government in the form of the PSAP for Cyber Security which all public bodies are expected to align with, similarly, the UK National Cyber Security Centre also has published guidance referencing the requirement for a Cyber Incident Response Plan. 3.3 The CIRP lays out in detail how the organisation should deal with a major cyber incident in terms of: Identifying an incident Categorising an incident Establishing an Incident response team Identifying employees in the response team Provides details of how and where to report a major incident Provides information on how to manage communications around the incident Provides information on how to recover from an incident ITEM 9
Page 2
3.4 While having a CIRP meets part of the government guidance, this must be supplemented by employees understanding their roles and that these are exercised frequently. This document will be reviewed as required due to the fast-changing pace of threats both existing and potentially those yet unknown. 4. Main Issues 4.1 Due to the increased Cyber threat landscape and sophistication of techniques used by threat actors, the Council must take steps to mitigate risks as much as possible. The CIRP provides guidance on how the council should handle a major incident. 4.2 The CIRP has been developed in conjunction with the council’s resilience partners to illustrate how the Council’s response will be formulated, who is involved and will be referenced in the broader council wide incident response plan. 5. People Implications 5.1 The development and adoption of the CIRP will provide a degree of assurance and, in the event of a major cyber incident, potentially all users of Council computer systems could be impacted 5.2 The immediate implications for employees will affect all those listed as part of the Cyber Incident Response Team as there will be an expectation that they, and service area administrators of specific systems, will have an additional burden of work exercising the plan annually. 6. Financial and Procurement Implications 6.1 There are no direct financial or procurement implications associated with this report or policy. 7. Risk Analysis 7.1 Council service areas have business continuity plans in place; however, this CIRP plan will enhance the Council's incident response procedures and ensure the Council has a full, updated and formal procedure in place on how to manage a major cyber incident. 7.2 This plan will align the council with national guidance and will be in support of SR008 (Threat of Cyber-attack) included in the Council strategic risk register. 8. Equalities Impact Assessment (EIA) 8.1 An equalities impact assessment was carried out and there are no adverse equalities issues identified.
Page 3
9. Consultation 9.1 Finance and the Section 95 Officer have been consulted on the content of this paper. It was not necessary to consult with our Trades Union colleagues on this report. However, the Council’s ICT strategy and activity is discussed with the Convenors group where required. 10. Strategic Assessment 10.1 High quality and secure ICT equipment and services contribute to the Council’s 2022-27 strategic objectives to ensure our workforce is resilient and skilled where digital technology supports service delivery for our citizens; and all employees are provided with the technology needed to do their job effectively. Name:  Victoria Rogers Designation: Chief Officer - People and Technology Date:  13 January 2025 Person to Contact: Andrew Cameron, ICT Section Head, Infrastructure Tel 07813366731 andrew.cameron@west-dunbarton.gov.uk Appendix:  Cyber Incident Response Plan Background papers: EIA Screening SG PSAP for Cyber Resilience Wards Affected:  All
Page 4
No embedded text on this page.