Local Government Cyber Incident Reponse

The Ministry of Housing, Communities and Local Government (MHCLG) require a Cyber Incident Response (CIR) service to operate on behalf of the local government sector.

MHCLG are looking to ensure that English local authorities receive support to respond to the most sophisticated and bespoke cyberattacks.

MHCLG will use the National Cyber Security Centre's (NCSC's) framework for classifying incidents to activate the service at C3 and above, or at a lower level as MHCLG see necessary.

To align this approach with other government departments and the advice of the NCSC (that all UK organisations use an NCSC-assured Cyber Incident Response provider when dealing with cyber incidents) a NCSC Assured Service Provider (ASP) is required.

The supplier will work with MHCLG to introduce the service to local government, and we will look to integrate the service into existing incident management processes for 24/7 access.

Local authorities will report incidents to the NCSC and once the NCSC have categorised the incident and the threshold for service activation is met, or MHCLG approve a below threshold activation, local authorities will be eligible to receive incident response support.

The contract will be for one-year, with the option to extend for up to four additional years in one-yearly increments.

MHCLG will appoint two suppliers.

Service activation will rotate between these.

In the instance of an event impacting many local authority organisations at once, both suppliers may be deployed.