Cyber Essentials for parish councils

Cyber Essentials is turning up in places parish councils did not expect. A district council asks for it before awarding a grounds maintenance contract. An insurer asks whether you hold it. A data protection review raises it. And the clerk, who is very often the council's entire IT department, has to work out what it means.

The short version: Cyber Essentials is a government-backed certification covering five basic technical controls. It is achievable for a council of any size, it does not require an IT department, and most of the work is administrative rather than technical. But there are three or four points where councils reliably fail, and they are worth knowing before you start.

What it actually covers

Five control areas, assessed by self-assessment questionnaire and reviewed by a qualified assessor:

• Firewalls — every device that connects to the internet must be protected by a firewall, including laptops used away from the office.
• Secure configuration — default passwords changed, unnecessary software removed, screens locked.
• Security update management — operating systems and applications supported by the vendor and patched promptly.
• User access control — everyone has their own account, administrator rights are separated from everyday use, leavers are removed.
• Malware protection — anti-malware in place, or app-store-only installation on phones and tablets.

Where parish councils get caught out

The clerk's own computer is in scope

This is the big one. If the clerk works from home on their own laptop and that laptop is used to access council email or council data, that device is in scope for the assessment. It must meet the same standards as any office machine: supported operating system, separate user account, firewall on, updates applied.

Councils sometimes discover at this point that the clerk is working on a personal machine shared with family members, running a version of Windows that went out of support some time ago. That is a solvable problem, but it needs solving before certification rather than during it.

Multi-factor authentication on cloud services

Cloud services are firmly in scope, and multi-factor authentication is now expected on all of them. For a typical council that means council email, the accounting package, the website content management system, online banking, the payroll provider, and the cloud storage where the minutes live. If MFA is available on a service and it is not switched on, that alone can fail the assessment.

Shared logins

A single login shared between the clerk, the chair and the RFO is common, understandable, and not permitted. Each person needs their own account. Where the software licence makes that genuinely impossible, the position needs documenting and the service may need to be reconsidered.

Nobody knows what the council actually has

The most time-consuming part of a council's certification is usually not fixing anything. It is establishing what exists: which devices, which cloud accounts, who still has access, what happened to the login of a clerk who left in 2022. Councils are long-lived organisations with high turnover in the roles that hold the passwords.

Councillors' own devices

Councillors reading council email on personal phones is the question that stalls most council certifications. The answer depends on how the council is set up, and it is a scoping decision rather than a technical one. Broadly, if councillors access council data on personal devices, those devices are drawn into scope; if the council can define a boundary — council-provided devices only, or access restricted to a web portal with no data stored locally — the scope narrows considerably.

Getting this decision right at the start is the difference between certifying a handful of devices and attempting to certify fifteen councillors' personal phones. It is worth taking advice on before you complete a single question.

What it costs and how long it takes

There are two costs. The certification body's assessment fee, which for an organisation of a council's size is modest and is set by the certification body. And the remediation — the actual work of fixing whatever would fail. For most councils the remediation is a few hours of configuration rather than new equipment, though a council still running unsupported machines will have hardware to replace.

Timescale is usually driven by the remediation and by how quickly the clerk can gather the information. A council that knows what it owns can complete in a fortnight. A council starting from scratch should allow six to eight weeks.

Is it worth doing without a contract requiring it?

Two honest arguments in favour. First, councils hold personal data about residents — burial records, allotment tenancies, complaints, planning correspondence, staff records — and the five controls are genuinely the ones that prevent the most common breaches. Second, certification is increasingly a precondition for public sector contracts and grant funding, and it is far less pressured to obtain it before it is demanded than in the three weeks before a tender deadline.

The argument against is simply cost, which for a small council with a modest precept is a real consideration and a decision for the council rather than the clerk.

Where to start

Before completing any questionnaire, do the inventory: every device used for council work including home computers, every cloud service the council pays for or uses, and every person who has access to each. Nine times out of ten that document is where the real work is, and everything after it is straightforward.