Cyber Security for Councils: Making the Essential Eight Operational

Councils rely on digital systems to collect rates, manage development applications, dispatch field crews, maintain assets and answer residents. A disruption is therefore a service problem as well as an IT problem. The Australian Cyber Security Centre's Essential Eight provides a baseline of eight mitigation strategies, but a council still needs people, ownership and tests that show those measures work in its own environment.

Begin with services and dependencies

List the services that would be hardest to pause. For each, identify the application, data, supplier, administrator, identity system and backup required to keep it operating or restore it. Include small systems owned by individual teams; a rates portal or cemetery register can be critical even if it is not part of the central enterprise platform. This map makes cyber priorities understandable to executives and service managers.

Next, identify high-risk users and systems: privileged accounts, externally accessible applications, devices used by contractors and systems holding sensitive personal information. The ACSC's broader mitigation guidance recommends starting implementation with high-risk users and computers before extending it across an organisation.

Make the Essential Eight a routine

The strategies cover application control, patching applications and operating systems, Microsoft Office macro settings, user application hardening, restriction of administrative privileges, multi-factor authentication and regular backups. Avoid treating them as a once-a-year checklist. Assign an owner, define the scope and ask for evidence of operation. For example, a backup exists only as a reliable recovery control when the council has tested restoring a representative service and knows how long that restoration takes.

For patching, agree who tracks vendor notices, what counts as an urgent exposure and how exceptions are approved. For privileged access, review which staff and suppliers truly need administrative rights, for how long and on what devices. For multi-factor authentication, include remote access, cloud services and privileged accounts in the design. The Essential Eight maturity model provides more detailed implementation guidance and a way to assess progress.

Train for the decisions people make

General awareness messages have limited value unless staff can practise likely situations. Give customer service staff a scenario involving a caller who asks to change bank details. Give a project manager a suspicious shared-document invitation. Give a system owner an urgent patch decision that affects a public-facing service. The exercise should show how to verify, report and escalate without blame.

Managers need to know the council's incident roles as well. A cyber incident may require decisions about service continuity, public communication, records, privacy and suppliers. The Information and Privacy Commission NSW describes the privacy principles relevant to councils' handling of personal information; the privacy contact officer should be part of the response pathway where personal information may be affected.

Test the recovery path

Run a tabletop exercise around a realistic service interruption. Ask who detects the issue, who can isolate a system, how field teams continue work, who contacts the supplier and what the public is told. Then perform a technical restore test for at least one important system. Record the gaps and fund the corrections. A polished response document is less useful than a tested procedure and a current contact list.

Questions for the next executive review

Which services would fail first if identity, email or internet access stopped?
How many privileged accounts exist, and when were they last reviewed?
Are patch exceptions visible and time-limited?
Which backups have been restored successfully, and how recently?
Have service managers practised the decisions they would make during an incident?

Cyber capability grows when the council can answer these questions with evidence, not only with policy statements.