As Local Government Reorganisation (LGR) gathers pace across England, much of the focus has understandably been on governance, finances, staffing and service delivery. However, one area that can easily be overlooked is cyber security.
Bringing together multiple councils means merging networks, users, suppliers, applications and security processes that have often evolved independently over many years. Every change creates new opportunities for cyber criminals to exploit weaknesses if organisations don’t maintain visibility and control throughout the transition.
Cyber resilience during LGR isn’t just about preventing attacks. It’s about ensuring councils can continue delivering essential public services, recover quickly from incidents and provide assurance to leadership, regulators and residents while operating in a constantly changing environment.
Below are ten practical areas every local authority should review before, during and after Local Government Reorganisation.
1. Maintain visibility across every environment
One of the biggest risks during LGR is losing visibility. Different councils may have different security tools, logging capabilities and monitoring arrangements, making it difficult to build a complete picture of risk.
Take the time to identify which systems are currently being monitored and, more importantly, which aren’t. Ensure both legacy environments and the future operating model are included, particularly business-critical services that support frontline operations.
2. Treat your Security Operations Centre as a transition capability
A Security Operations Centre (SOC) should provide far more than alert notifications. During organisational change, it should give leadership confidence that cyber risks remain visible and manageable.
Ask whether your SOC can answer key operational questions:
If the answer is no, improvements may be needed before migration activity accelerates.
3. Reassess supplier access and third-party risk
LGR often results in supplier consolidation, contract reviews and changes to support arrangements. Every supplier with access to council systems introduces potential cyber risk.
Create a comprehensive inventory of supplier access, review privileged permissions and confirm incident escalation processes between suppliers. Understanding who has access to what and how that access is monitored is essential during periods of change.
4. Standardise privileged access management
Administrative accounts frequently become overlooked during mergers.
Review privileged accounts across every authority involved in the reorganisation. Remove unnecessary access, validate service accounts and ensure elevated permissions are reviewed consistently as teams, responsibilities and organisational structures evolve.
5. Optimise Microsoft security tooling
Many councils operate separate Microsoft Sentinel environments or use a mixture of security platforms.
Rather than simply combining them, review configuration, alert rules, data sources and log ingestion costs. The goal should be a streamlined security monitoring capability that supports the future organisation while reducing unnecessary complexity and operational expense.
6. Align incident response with the new organisational structure
Detection alone isn’t enough.
Successful incident response depends on everyone understanding their responsibilities. As councils merge, response plans should be updated to reflect new reporting lines, decision-makers, suppliers and technical environments.
An incident response plan based on yesterday’s organisation may not work tomorrow.
7. Review backup and disaster recovery strategies
Each council is likely to arrive with different backup policies, disaster recovery plans and ransomware recovery capabilities.
Now is the opportunity to standardise these approaches, validate recovery procedures and test whether critical public services could continue operating during a cyber incident while the transition is still underway.
8. Produce reporting that supports CAF and governance
The Cyber Assessment Framework (CAF) places increasing emphasis on evidence rather than assumptions.
Security reporting should demonstrate cyber posture across the evolving organisation, providing meaningful insight for senior leadership, governance teams, technical staff and budget holders alike. Clear reporting also makes it easier to demonstrate progress throughout the transition.
9. Keep leadership informed throughout the transition
Cyber risk changes as the organisation changes.
Leadership teams need clear, consistent reporting that highlights current risks, areas of improvement and outstanding priorities. Waiting until Vesting Day to review cyber resilience is too late effective governance should continue throughout every stage of the programme.
10. Choose partners with Local Government experience
Technology alone won’t deliver cyber resilience.
Whether you’re working with an internal team, shared service or outsourced Security Operations Centre, choose partners who understand the realities of Local Government Reorganisation. They should be capable of supporting multiple environments simultaneously, managing supplier transitions, maintaining visibility and providing evidence of resilience throughout the programme.
The most important question councils should ask isn’t simply:
“Can we detect a cyber incident?”
Instead, ask:
Can we continue delivering critical public services, recover quickly and maintain public trust while the organisation itself is changing?
Local Government Reorganisation presents a unique opportunity to strengthen cyber resilience rather than simply combining existing environments. Councils that prioritise visibility, governance, supplier assurance and operational resilience from the outset will be better positioned to manage risk both during the transition and long after the new organisation is established.
Need a partner that’s proactive about your security?
Let’s start a conversation.
