Cyber Security Evidence
Status: Final
Adopted: Adopted by Resolution of the Council 26th October 2026
Prepared by: Geraldine McCarthy, Parish Clerk
Review Due: October 2027, or sooner if legislation or operational experience dictates
Introduction / Purpose
This Cyber Security Evidence Summary sets out the cyber‑security responsibilities of principal authorities and parish councils, including statutory obligations, national frameworks, website hosting arrangements, and risk‑management considerations.
It provides clear, authoritative evidence for inclusion in the Governance Folder and supports transparency in how cyber risk is managed across tiers of local government.
1.0 Cyber Security Requirements for Principal Authorities
1.1 National Frameworks (Mandatory)
1.1.1 Cyber Assessment Framework (CAF)
Principal authorities must comply with CAF, the UK Government’s national cyber‑security standard for essential public services.
1.1.2 NCSC Local Government Cyber Security Guidance
District councils must follow NCSC guidance covering governance, risk management, incident response, and technical controls.
1.1.3 DLUHC Local Digital & Cyber Improvement Programme
Principal councils receive government funding and must meet national cyber‑security standards. Parish councils are not included.
1.2 Statutory Obligations
1.2.1 UK GDPR & Data Protection Act 2018
Principal authorities must maintain formal information‑security policies, conduct DPIAs, and secure high‑risk personal data.
1.2.2 Mandatory Multi‑Factor Authentication (MFA)
Principal councils must enforce MFA across all cloud services and critical systems.
1.2.3 Incident Response & Monitoring
Principal councils must maintain formal incident‑response plans and monitoring systems.
1.3 High‑Risk Systems Operated by ELDC / PSPS
1.3.1
East Lindsey District Council (via PSPS) operates statutory, high‑risk systems including:
Council tax registers
Benefits systems
Housing and homelessness systems
Licensing and regulatory services
Revenues and payments
Sensitive personal data processing
1.3.2
Because these systems are high-risk, ELDC/PSPS must maintain formal cybersecurity policies, monitoring, and compliance with national frameworks.
2.0 Parish Council Cyber Responsibilities
2.1 Proportionate Requirements
2.1.1
Parish councils do not operate critical IT systems and therefore follow proportionate cyber‑security good practice.
2.1.2
Parish councils must comply with:
UK GDPR
Data Protection Act 2018
Secure passwords
MFA where available
Basic device security
DPIAs for CCTV
Secure email practices
2.2 Website Responsibilities
2.2.1
North Somercotes Parish Council’s website is hosted and technically secured by Lincolnshire County Council (LCC).
2.2.2
LCC is responsible for:
Server security
SSL certificates
Firewalls
Backups
Platform updates
2.2.3
The parish council is responsible only for:
Content accuracy
GDPR compliance
Secure access credentials
3.0 Evidence of Cyber‑Security Policies (Principal Authority & Hosting Provider)
3.1 East Lindsey District Council (ELDC)
ELDC maintains formal information‑security and data‑protection policies as required for principal authorities operating high‑risk statutory systems.
Evidence:
ELDC Data Protection Policy:
https://www.e-lindsey.gov.uk/article/5620/Data-Protection-Policy (e-lindsey.gov.uk in Bing)
ELDC Privacy Notice:
https://www.e-lindsey.gov.uk/privacy
3.2 Lincolnshire County Council (LCC)
LCC hosts and secures the parish council’s website and maintains formal cyber‑security policies, server security, SSL certificates, firewalls, backups, and platform updates.
Evidence:
LCC Information Security Policy:
https://www.lincolnshire.gov.uk/council-business/information-security-policy (lincolnshire.gov.uk in Bing)
3.3 Planning Portal Access
The parish council accesses planning information via the ELDC Planning Portal. This access does not involve hosting or managing any high‑risk systems; all technical security is maintained by ELDC and LCC.
4.0 Risk Management Statement
4.1
Cyber risk for North Somercotes Parish Council is significantly reduced because all high‑risk statutory systems (council tax, benefits, housing, licensing) are operated by East Lindsey District Council through PSPS, who are legally required to maintain formal cyber‑security policies, monitoring, incident response, and compliance with national frameworks including the Cyber Assessment Framework and NCSC guidance.
4.2
The parish council’s website is hosted and technically secured by Lincolnshire County Council, further reducing local cyber‑security exposure.
4.3
The parish council maintains proportionate cyber‑security controls appropriate to its low‑risk data processing.