Enabling delivery: supporting Thurrock’s digital ambitions
View client story
Developing a cyber incident manual for local authorities
Working with the Local Government Association, we developed a practical ‘first-at-hand’ resource to both guide local councils through the steps of handling a major cyber incident, and help them build cyber resilience at an organisation-wide level.
Since its release in 2025, the Cyber Incident Grab Bag has been used by several councils responding to major cyber incidents, and has proven to be a valuable resource for other organisations in both the public and private sectors who have been affected by cyber incidents.
The challenge
Cyber threats pose a significant risk for local authorities, and the results of a serious attack can be devastating. Best practice guidance recognises that incidents are a case of ‘when’ not ‘if’.
The Local Government Association (LGA), as the national voice of local government across England, wanted to provide support that could assist local authorities when responding to a major and high-impact cyber incident.
The toolkit needed to provide concise and practical advice for those without specialist cyber knowledge, enabling councils to coordinate a comprehensive and effective response from the early hours of an incident occurring. It also needed to show how incident response activities align with existing council processes and services continuity plans.
At the same time, the LGA wanted the product to encourage councils to recognise the cross-cutting risk of cyber, and how organisational resilience hinges on each council service’s preparedness, not on IT security measures alone.
The Grab Bag provides:
- 1
Concise, practical advice developed through extensive research and co-design with over 30 councils and a wide range of partners.
- 2
User-centred content that has been tested with councils in collaborative workshops, and iterated based on feedback.
- 3
Actions, scenarios and considerations for councils to use when responding to a cyber incident.
- 4
A resource to support cyber resilience planning and preparation, helping organisations assess existing response and recovery plans, identify gaps, and take practical steps to increase their readiness.
Developing the Grab Bag
To ensure the resource was truly user-centred, we worked with over 30 councils, the Ministry of Housing, Communities and Local Government’s Local Digital Team, and a wide range of partners, including the Information Commissioner’s Office, to understand user needs and co-design content. This early content was then tested and iterated.
We worked closely with the LGA Cyber, Digital and Technology team, pairing PD experts with the LGA’s own in-house specialists. We applied an agile and user-centred approach to the work, covering extensive research of existing guidance, as well as collaborative workshop sessions with a wide range of councils and partners. These gave us the opportunity to test and iterate the product based on real feedback from users.
Empowering the LGA to maintain a living resource
In 2026, we partnered with the LGA to update and extend the Grab Bag. This update incorporates feedback from local authorities who have made use of it during real incidents and added in-depth guidance for specific service areas: financial operations, adult social care, and children's social care.
To help the LGA continue to ensure that the Grab Bag remains up to date as cyber threats evolve and further extend in-depth guidance to cover other service areas, we also developed a playbook which the LGA team can use to maintain the resource independently, taking a product-based approach.
A tool for cyber resilience and preparedness
The Grab Bag has been described by users as “brilliant, timely, clear, well-structured, well-designed, and human-centred”.
It is not only a valuable tool for councils responding to a cyber incident, but also plays an important role in supporting cyber resilience planning and preparation. The well-designed sections are a useful tool to use when assessing existing cyber response and recovery plans, helping to identify gaps and practical ways that organisations can increase their readiness and resilience.
The Grab Bag is available on the LGA website. We applaud the LGA for their decision to make the Grab Bag publicly available online, making an important contribution to wider cyber resilience beyond local government.
