Local Government Association Cyber Incident Grab Bag for Local Authorities

The concept for the Grab Bag was that it should be a ‘first at hand’ resource that provides a concise outline of the actions that would need to be considered in responding to a major and high-impact cyber incident. The LGA wanted a tool that provides practical advice to people without needing specialist cyber knowledge, enabling them to coordinate a comprehensive and effective response from the early hours of an incident occurring.

As well as providing a toolkit that could be used directly in responding to an incident, the Grab Bag also needed to make it easy to access and use other official advice and supporting information, while also showing how response activities align with existing council strategies.

In early 2025 the LGA engaged Public Digital as their delivery partner to develop the Grab Bag. Through a rapid 10 week engagement, we:

• Worked with over 30 councils, the Ministry of Housing, Communities and Local Government’s Local Digital Team, and a wide range of partners, including the Information Commissioner’s Office, to understand user needs and co-design content.

• Tested and iterated content, developing a user centred product, organised across 7 themes that cover the full range of actions, scenarios and considerations that would need to be worked through across a council’s services when responding to a cyber incident.

• Launched the Grab Bag, supported by extensive sector-wide communication to maximise awareness and impact.

We developed a closely integrated way of working with the LGA Cyber, Digital and Technology team, pairing PD experts with the LGA’s own in-house specialists. We applied an agile and user-centred approach to the work, covering extensive research of existing guidance and collaborative workshop sessions with a wide range of councils and partners.

Following the initial user research phase, we carried out a rapid development phase to prepare the first iteration of the product. This was then tested with users through a further round of collaborative workshops, where users were able to test and give feedback to the content (including collaborative editing of the live content).

In addition to deep expertise in cyber response and recovery, Public Digital brought design capabilities to support the LGA team and ensure the Grab Bag content would integrate effectively with the LGA website. We particularly applaud the LGA for their decision to make the Grab Bag available openly online, since much of the content also applies to organisations outside of local government; this is a valuable contribution to wider cyber resilience.

Through the development and co-production process, it became clear that the Grab Bag is not only a valuable tool for councils responding to a cyber incident, but also plays an important role in supporting cyber resilience planning and preparation. The well-designed sections are a useful tool to use when assessing existing cyber response and recovery plans, helping to identify gaps and practical ways that organisations can increase their readiness and resilience.