Local Government Reorganisation will create one of the most significant operational shifts councils have faced in years.
New authorities. New structures. New leadership models. New service responsibilities. New technology decisions. New expectations from staff, residents, suppliers and central government.
It is natural that much of the conversation turns quickly to transformation.
Better customer journeys.
Application rationalisation.
Data platforms.
Automation.
Cloud migration.
Modern workplace.
Service redesign.
All of that matters.
But it is not the first test.
The first test is more basic, more practical and far less forgiving:
Can the new authority operate safely, legally and reliably from Day One?
That is the real threshold.
Before a council can transform, it has to function. Staff need to log in. Residents need to access services. Critical systems need to be available. Data needs to be protected. Support routes need to be live. Incidents need to be escalated and resolved.
This is what “Safe & Legal” means in practice.
It is not the end state.
It is not the full transformation vision.
It is the minimum operational standard the new authority must be able to meet from the first day of vesting.
And for Digital, Data and Technology (DDaT) leaders, that distinction matters.
In a Local Government Reorganisation context, Safe & Legal means the new authority can securely, lawfully and reliably deliver critical services from Day One.
For DDaT teams, this touches almost every part of the operating environment.
It means staff can authenticate and access the systems they need. It means core applications are available. It means data is being processed lawfully and governed clearly. It means cyber monitoring, incident response and recovery arrangements are in place. It means suppliers know their responsibilities. It means the service desk can support users when things go wrong.
In simple terms, Safe & Legal means the council can operate without relying on hope.
That matters because LGR creates a dangerous temptation: to focus so heavily on the future-state model that the Day One operating model becomes assumed rather than proven.
But assumptions are risky.
A new authority may have ambitious plans for digital transformation, but if staff cannot access systems, if inherited vulnerabilities are not understood, if supplier responsibilities are unclear, or if incident response ownership is blurred, then transformation ambition will not protect services.
Safe & Legal is the operational foundation.
Without it, everything else becomes fragile.
One of the biggest risks in LGR planning is confusing two related but different pieces of work.
Safe & Legal is about Day One operational readiness.
Transformation is about the future-state council.
They are connected, but they are not the same.
Safe & Legal focuses on continuity, control and compliance. It asks whether the new authority can operate from the first day with secure access, available systems, lawful data processing, live support routes, tested recovery processes and clear incident escalation.
Transformation focuses on optimisation and improvement. It asks how services can be redesigned, how applications can be rationalised, how data can be used more effectively, how customer journeys can be improved and how technology can support long-term value.
The danger comes when councils try to treat transformation as the answer to Day One risk.
It is not.
A future-state data platform does not solve an immediate access control problem.
An application rationalisation plan does not automatically secure inherited legacy systems.
A channel shift strategy does not guarantee that residents can access essential services on vesting day.
A target operating model does not prove that cyber incidents can be detected, escalated and managed during transition.
This is why LGR planning needs two lenses.
One lens for the future-state council.
One lens for the minimum viable council on Day One.
Both are important. But they answer different questions.
A new authority does not need to be perfect on Day One.
It does, however, need to work.
That means DDaT leaders need to be able to answer practical questions, not just strategic ones.
This is the minimum viable council.
It is not about lowering ambition. It is about sequencing it properly.
Safe & Legal first.
Transformation second.
That sequence is important because Day One failure will quickly become a service issue, a resident issue, a reputational issue and a leadership issue.
If the basics do not hold, the wider transformation story will not matter.
Local Government Reorganisation does not just combine services. It combines risk.
Multiple predecessor councils may bring different systems, different suppliers, different identity environments, different data standards, different security baselines and different levels of cyber maturity.
What previously existed as several separate estates may become one larger, more complex target.
That matters because transition creates noise.
Users move.
Data moves.
Systems change.
Suppliers overlap.
Responsibilities shift.
Teams stretch.
Controls drift.
For attackers, that kind of environment is attractive.
Cyber risk often increases when organisations are distracted, under pressure or moving quickly. LGR creates all three conditions at once.
This does not mean councils should approach reorganisation with fear. It means they should approach it with honesty.
The risk window is visible. The pressure points are predictable. The control areas are known.
The question is whether they are being managed early enough.
One of the most important cyber risks during LGR is not always the obvious programme risk.
It is BAU drift.
When teams are focused on reorganisation, the everyday controls that keep the council secure can quietly weaken.
Patching can slow down.
Monitoring can become harder to interpret.
Identity hygiene can slip.
Backup testing can be delayed.
Supplier escalation routes can become unclear.
Service desk handovers can get messy.
Incident response responsibilities can become blurred.
None of these issues may feel dramatic on their own.
Together, they create fragility.
This is why DDaT leaders need to protect BAU deliberately during transition. Operational cyber resilience cannot be left to look after itself while the programme accelerates.
The council still has to run.
Residents still need services.
Staff still need support.
Threat actors still look for weakness.
Legal obligations still apply.
Incidents still need response.
LGR planning must protect the future-state council, but it must also protect the council operating today.
Safe & Legal readiness cannot sit buried in complex programme documentation.
It needs to be visible, honest and simple enough for leadership to understand quickly.
A practical readiness dashboard can help.
This should show the status of areas such as:
The purpose is not to create another reporting burden. The purpose is to help leaders see where fragility sits.
If data readiness is red, leadership should know.
If identity is amber, leadership should know.
If supplier responsibilities are unclear, leadership should know.
If monitoring coverage is uncertain, leadership should know.
Good reporting helps councils make better decisions earlier.
It also helps separate optimism from evidence.
And during LGR, that distinction is critical.
During reorganisation, internal DDaT teams will be asked to manage more complexity, often with the same people and limited capacity.
That creates a practical question:
Who protects BAU while internal leaders are pulled into programme demands?
This is where the right partner model matters.
Cyber support during LGR should not feel like a one-off purchase or a last-minute bolt-on. It should be designed into the transition approach as additional operational capacity.
Good partner support can help provide:
The value is not just technology.
The value is continuity, capacity and confidence.
For councils under pressure, the right partner should feel like an extension of the internal team, not a distraction from it.
The safest time to ask difficult readiness questions is before the pressure peaks.
For councils preparing for LGR, the following questions are worth putting on the table early:
That final question may be the most important.
What would prove it?
Not what the programme assumes.
Not what people hope will be ready.
Not what is written in a slide deck.
What evidence shows that the authority can operate safely, legally and reliably from Day One?
Local Government Reorganisation creates a rare opportunity to rethink how councils operate.
But transformation cannot come at the cost of resilience.
Before new authorities can modernise, optimise and redesign, they must be able to operate. That means protecting identity, services, data, support routes, monitoring and incident response from Day One.
Safe & Legal is not the end state.
It is the threshold.
And the councils that treat it seriously now will be better placed to transform with confidence later.
Need a partner that’s proactive about your security?
Let’s start a conversation.
