Guarding Trust: Cybersecurity Readiness in Great Britain's Councils

In our current digital climate, the rapid rise of AI and smarter technologies poses a constant risk to traditional data protection. 

Key takeaways

• Cybersecurity training remains inconsistent across councils. One in four councils surveyed did not enforce universal mandatory training across their entire workforce, with some excluding elected members and temporary or agency staff.

• The gap between strong and weak performers is significant. While 23 councils achieved the top Tier A rating for rigorous, frequent and inclusive training, 23 councils were rated Tier C or D and identified as needing improvement.
• Regular, engaging training is critical to reducing human risk. With human error contributing to 95% of cyber breaches, councils need training that goes beyond completion to support employee engagement, retention and digital vigilance.
• Historical training data is an important part of cybersecurity governance. Tracking training metrics over time helps councils demonstrate improvement, identify weak spots, target additional training and justify investment in their cybersecurity programmes.

News headlines increasingly report sophisticated cyberattacks with UK travel companies, high street stores, and local councils all falling victim. While the private sector risks catastrophic revenue loss, the public sector faces the high-stakes challenge of keeping highly sensitive and confidential public data safe.

Conversely, in the public sector, Gloucester Council became victim of a cyberattack in December 2021, leading to the website being down for 11 days and leaving constituents without access to online application forms used to claim for housing benefit, council tax support, test and trace support payments and discretionary housing payments.  

An investigation found that 240,000 files were stolen by a Russian hacker group, with residents' personal information potentially being compromised. In total, it took 18 months for the Council to rebuild its servers and get services running fully again, costing £1.14 million. This illustrates how a single security breach can grind vital services to a halt, affecting both council workers and those who rely on its services.

More recently, Kensington and Chelsea Council fell victim to a cyber attack, writing to thousands of people urging them to be vigilant after data was stolen. Given the sensitive nature of data held, it gave hackers the necessary tools to pose as the local authority and request information claiming to be from the Council.  

The Council shared some affected services with Westminster City Council and Hammersmith and Fulham Council, demonstrating how easily the attack became scaled to affect a much wider area.

Investigating council cybersecurity

To understand how councils across Great Britain approach cybersecurity training, Skillcast conducted FOI requests to establish how many staff members had taken part in training, whether training is compulsory or not, and the frequency of refresher training.

These answers were then scored against a ranking system to create an index evaluating mandatory status, refresher frequency, and council enforcement. Councils were then attributed as either Tier A - top performers, Tier B - mid performers, Tier C - needs improvement, or Tier D - poor performers. 

Out of the 350 councils across Great Britain reached out to, 165 responded with sufficient evidence to assess mandatory training. However, only 56 were given a score, as they were the only respondents to supply comprehensive data across all three scoring criteria: who the mandatory training is relevant to, if recurring training exists, and the frequency of that training. 

Why is cybersecurity training so important?

Cybersecurity is the practice of ensuring computers, networks, and digital information are safe from attacks, damage, and unauthorised access. For local governments, the key focus is on keeping sensitive data up-to-date, private, and accessible to only those who need it.

With cyber criminals adopting new sophisticated tactics of targeting businesses, it is imperative that any organisation holding sensitive information, and the employees working within these systems, are correctly equipped with the right training systems to reduce the threat of these crimes.  

Councils hold incredibly sensitive information such as electoral records, adult social care and medical data, and children’s services files, so if staff are not receiving regular, high-quality training, the safety and privacy of vulnerable individuals are at risk.

Strong cybersecurity training does more than  mitigate risk; it empowers elected and non-elected officials to report and highlight any red flags they see, ultimately creating a safer and stronger workforce that maintains public confidence in local governments. 

The regions with robust cybersecurity training

Across Great Britain, 23 councils reached Tier A status, representing 41% of all councils scored in the index. All of these councils are deemed to have rigorous, frequent, and fully inclusive cybersecurity training with a confirmed enforcement mechanism.

Of the 56 councils that received a cybersecurity score, the average tier of these achieved was Tier B, suggesting that councils have the core elements of cybersecurity training in place, but there are some gaps in coverage, frequency, or repetition.

Both Yorkshire and London tied for the highest regional average framework scores in Great Britain at 8 out of 10. Every council evaluated in both regions achieved Tier A status, including City of York Council and London Borough of Lewisham. The South West followed closely behind with an average score of 7.75, seeing three of its four evaluated councils reach the top tier.

While these regions scored the highest, Scotland emerged as a standout for its training consistency and volume, with the highest number of Tier A-scoring councils and an average framework score of 7. Across the board, the majority of Scotland’s councils scored highly, with four in the top tier, five in Tier B and only one in Tier C, with none scoring in the lowest tier.

The councils reaching Tier A across these top-performing regions implement mandatory training for all staff, including elected members, and enforce annual refresher training. In some cases, despite not leading the scoreboard, Medway Council in the South East implemented this further by enforcing monthly refresher training to ensure that employees embody their learning in their daily work.

So, by turning training into a short-form learning format, Buckinghamshire Council has tackled these obstacles to ensure that essential training is delivered in the most effective way possible. 

The regions falling short

Our research has highlighted some crucial gaps in cybersecurity training across councils in Great Britain. 

The North East achieved the lowest average framework score, with a score of 3.5, followed by the North West with a score of 4.6 and the East of England at 4.7.

Meanwhile, the South East presents a stark internal contrast: despite hosting three Tier A councils, it simultaneously holds the highest number of Tier D councils in comparison to other regions (3), resulting in a score of 4.8.

Combining the number of councils that scored in Tier C (16) and Tier D (7), 23 councils have been identified as needing to improve, which is one out of every two. 

The mandatory training gap

Across those councils that responded with sufficient evidence, a key inconsistency was highlighted surrounding mandatory training policies. It is evident that across and within regions, there is no clear expectation surrounding what “mandatory training” means, and what the expectations are for employees and employers alike

Out of the 165 councils that responded, nine councils in Great Britain do not have a mandatory cybersecurity training protocol, equating to roughly one in 20.

When combined with councils that have conditional training, and those that exclude temporary and agency staff, this number jumps to 44 out of the 165 councils. This means approximately one  in four Great British councils fail to enforce universal mandatory training across their entire workforce. 

While 90 councils enforce training for all staff and elected members, 36 explicitly stated that they exclude elected members from mandatory training. In the South West alone, around half (48%) of councils exclude elected members from cybersecurity training.

Given that councillors handle highly sensitive constituent information, without the correct training, they can become prime targets for a cyberattack. Despite not holding a guaranteed fixed position within the council, councillors typically serve 4 years in the role, giving hackers enough time to potentially target them. 

In some cases, cybersecurity training has only been implemented this year, while others have only just begun enforcing refresher training. 

While it is reassuring to see these Councils adapt to today's escalating threat landscape, this transition period highlights the urgent need for local authorities to rapidly close pre-existing security gaps. Reversing years of potential vulnerability requires frequent and engaged training, as well as the necessity for a culture of digital vigilance to be built into the workplace.

The compliance risk of withheld data

When met with FOI requests, some councils claimed that keeping historical training records would violate the GDPR storage limitation principle.

However, this confuses individual personal data with high-level training metrics. Without historical data, these councils may struggle to prove to regulators, or the public, that their cybersecurity defenses are actually improving.  

Tracking historical metrics is key to ensuring a successful cybersecurity program is in place. This can help oversee employee retention of cybersecurity pillars like security protocols and phishing awareness, and help identify weak spots where focused, role-specific training can be issued if needed. Historical metrics can also be used for trends analysis, tracking improvements 
in cybersecurity, helping to justify investments in training and to pinpoint where extra attention may need to be paid.

New Cyber Security and Resilience Bill

Late last year, the government passed the new Cyber Security and Resilience Bill, adding to the existing Network and Information Systems (NIS) Regulations (2018). Designed to deliver a fundamental change to the UK’s national security, it can only be assumed that low scoring councils from this research will have more regulations and guidelines to assist in improving their cybersecurity.  

Overall, the new legislation will protect a wider scope of organisations, like data centres and IT service providers, and companies will be expected to report a broader variety of cyber incidents within a smaller time frame. Monitoring must be done more strictly, especially on any third party vendors to strengthen the overall safety network of organisations, and regulators will be given more power to force companies to fix security vulnerabilities immediately, with the ability to issue larger fines if there is a failure to comply. 

Want to learn more about how to protect your business against cyber threats?

Our Cybersecurity Compliance Management Hub is designed to help organisations minimise cyber risks and reduce cyber threats. This includes our Cybersecurity Compliance Training Course offers training on recognising cybersecurity threats, advice on how to combat cybersecurity threats, and how to identify sources of information and support.

Methodology

To determine the strength of cybersecurity training across councils in the UK, Skillcast conducted FOI requests to understand how many staff members had taken part in training, whether training is compulsory or not, and the frequency of refresher training.  

The following questions were submitted to 350 councils across the UK: 

1. What was the total headcount (individual person count) of your organisation as of 31 December 2024 and 31 December 2025? If available, please provide a breakdown by:

a. Permanent employees
b. Temporary, agency, or contract staff
c. Elected members

2. Is cybersecurity training mandatory for personnel within your organisation? Please specify if this requirement applies to:

a. Permanent employees
b. Temporary, agency, or contract staff
c. Elected members 

3. How many individual staff members completed introductory or onboarding cybersecurity training in each of the calendar years 2024 and 2025? Please provide separate figures for each

4. How many individual staff members completed recurring or refresher cybersecurity training in each of the calendar years 2024 and 2025? Please provide separate figures for each

Each council was then scored out of 10 across three criteria, to create the index.

Skillcast was then able to rank the councils against a tiered system to determine the proficiency levels at which each council is currently offering their cybersecurity training.  

Data correct as of October 2026.