A concise guide to the service-specific and situational modules that support councils through cyber incidents
The following guidance explains how to apply targeted modules when a council faces a cyber incident. These modules are intended to sit alongside the main grab bag materials and your existing business continuity plans. Use them to focus on the functions that matter most to your residents and to speed up recovery without losing sight of legal and safeguarding obligations.
Each module is written as a practical, task-oriented resource. A service-specific module describes actions when one council service is directly affected, while situational guidance deals with incidents that introduce organisational complexity. You do not need to apply every module; select those that align with the services and circumstances you face.
Service-specific modules: what they cover and why to use them
The suite of service-specific modules offers step-by-step measures for maintaining essential functions when systems are degraded or unavailable. For example, the adults’ services module prioritises continuity of care arrangements, safeguarding duties, and liaison with external regulators and partners.
It highlights how to manage sensitive records securely and keep providers informed when digital routes are unreliable.
Similarly, the children’s services module focuses on child protection processes, case management contingency steps, and communication protocols with agencies such as social care providers and oversight bodies. The aim is to preserve core safeguarding activities even when normal IT systems are compromised, ensuring that vulnerable people remain protected.
Finance and transactions: maintaining payments and preventing fraud
The finance module addresses income collection, supplier and resident payments, and treasury operations under constrained conditions. It gives specific advice on preserving payment continuity, alternative transactional routes, and heightened controls for fraud risk management while standard systems are restored. Engagement with banking partners and suppliers is emphasised to reduce disruption to services and cashflow.
Situational modules: navigating complexity during an incident
Some incidents are not just technical outages; they expose structural challenges such as unclear ownership of services or multi-agency arrangements. The situational guidance module helps you map responsibility quickly, identify decision-makers, and re-establish governance when roles are blurred. This is particularly important where councils operate shared services or rely on third-party suppliers whose processes may differ from your own.
When leadership or governance is in transition, the module proposes practical steps to clarify accountability, set temporary authorities, and maintain operational decision-making. It provides tools to document choices and to keep stakeholders — including the public — informed in a transparent, auditable way.
When to use situational guidance
Deploy situational guidance if the incident raises questions about who owns a system, where data resides, or how responsibilities are split across partners. This guidance supports rapid mapping of shared contracts, service-level agreements, and supplier chains so you can prioritise recovery activities and allocate limited resources where they will have the most impact.
How to combine these modules with your existing plans
These modules are designed to complement the main grab bag guidance and should be used alongside your business continuity and emergency plans. Treat them as operational supplements: pick the modules that match your affected services, follow the recommended immediate actions, and integrate their checklists into your incident logs and recovery timelines.
Not every module will be relevant in every incident. The guidance explicitly states that you only need to use those that apply to your situation. Over time, additional modules will be added to cover other services and complex scenarios, so keep monitoring for updates and incorporate new content into your preparedness activities.
Practical tips for fast implementation
Start by identifying the service area(s) affected, then open the corresponding module and follow the priority actions. Keep communication channels with external partners open, document decisions in the incident record, and escalate governance issues to the roles defined in your continuity plans. Use the modules as a living resource; adapt their checklists to local arrangements and capture lessons learned for future incidents.
