Resetting the relationship between local and national government. Read our Local Government White Paper
Building a cyber resilient service: guidance for directors of adult social care
This document aims to support you to develop proactive, protective strategies and capabilities to enhance the cyber resilience of your council services. Some recommendations are technical, some organisational and some are about your people.
Introduction
This page details supplementary guidance specific to council planning services. Full guidance and steps can be found in our guidance document.
Step 5: Be clear on why your service may be targeted
Consider the three categories of harm caused by a cyber attack: being robbed (theft of money, data, or intellectual property), being weakened (espionage, political interference, or prepositioning) and being hurt (ransomware and destructive or catastrophic attacks)[1].
- Which of these motivations is most relevant to an Adult Social Services team?
- What do you have that makes your service vulnerable?
- Is data theft at the top of this list?
- Would that be personally identifiable information about the adults your service is responsible for safeguarding?
- Are you aware of all the digital data that the council’s control and safeguard this data of interest to malicious actors, making them a target?[2]
Adult Social Services, and teams within your directorate, are supported by a huge amount of data. This will include, for example, data on vulnerable adults, special educational needs and disability, and health data (see Figure 1). This amount and type of data makes your service vulnerable to cyber attacks and means the impacts to users of your service can be very damaging. Attackers may be looking to steal sensitive data for resale or to perpetrate further criminal acts, and you will be particularly vulnerable to extortion from criminals who recognise the criticality of this data and the need to keep services running.
Figure 1: Commonly held Adult Social Services data
- Personal details - Names, addresses, gender, dates of birth, and contact details for the adult or carers.
- Health data – NHS number, name and contact details of any person providing primary medical services.
- Social care data – Adult level data, information about any safeguarding concerns [3], adult protection plans, and any involvement with adult social care services.
- Support Plans – Individual care or support plans, containing an assessment of needs.
- Financial Information – Details of financial support or benefits received, income and expenditure details.
- Adoption and fostering data – Information about adults who have adopted or had been placed with them in foster care.
- Legal data – Information about any court orders or legal proceedings related to the adult.
Step 6: Be clear on the impact of a cyber attack
Below are a few examples of the way in which a cyber attack could affect your service area and things you should consider when preventing or recovering from a cyber attack:
Figure 2: Example of service impact
During a cyber attack you will likely have no access to the internet or your networks within which documents or data are stored. You need to consider how the loss of availability will impact your critical services, and how you could keep them running – you may need alternative manual processes in place to keep a skeleton service operational.
Things to consider:
- How can you best work with IT support prior to an incident to prioritise the systems to be recovered will assist them with their workload and allocation of resources?
- What processes do you have in place for identifying where processes are dependent on other internal and external systems being available? Simply restoring one system in isolation will not be sufficient to allow a service to start operating after an attack.
Always work in partnership with your IT team if you are making any changes to your service. This could include new information sharing agreements, procuring new systems, or changes to processes. Cyber security and IT implications should be factored into all these decisions.
Things to consider:
- Which critical services operated by your team rely on internet access?
- Which of these critical services is prioritised to be brought back online first?
- Have you created offline records and plans for use during an attack and ensured all teams have access to them?
Figure 3: Example of financial impact
If a cyber attack were to impact your team’s services, it could affect any financial system that your council operates. For example, if the system responsible for foster carer payments or direct payments was unavailable, you may not be able to make payments on time.
Things to consider:
- Does your team have an offline record of payments to be made?
- How would you ensure carers, benefit receivers and other payees receive their payments regularly, if the payment system were unavailable?
- What additional safeguarding concerns would be created if vulnerable adults had not received essential payments?
- Discussing these risks with the finance team and ensuring this is included in both yours and their business continuity plans is essential.
Figure 4: Example of data impact
Some local authorities have established Multi-Agency Safeguarding Hubs (MASH) teams that bring together professionals from different agencies, such as social services, health, police, and housing, to share information and make joint decisions regarding safeguarding concerns.
Things to consider:
- Are offline records available for use during a cyber attack?
- If you were unable to share this data due to a cyber attack at your authority or at the NHS, how could you continue to share this information securely to protect the most vulnerable adults?
- Discussing these risks with your IT service and the NHS’ IT service will ensure there is a robust back up system in place.
Step 7: Be clear on ways to mitigate cyber risks
Table 1: Storing data
| Theme | Context | Areas to consider |
| Databases |
As your service becomes more digital, systems will need to move online. To limit vulnerabilities, staff need support to run their devices on the latest available software and to install regular security updates. |
How regularly is software updated? Who is responsible for update rollout? How would your service operate without access to databases? How do you seek assurance that software is up to date? |
| Cyber security measures | Implement cyber security measures on council hardware such as firewalls, antivirus software, and intrusion detection systems to protect against cyber attacks. |
Does all hardware support updated systems? How often does staff training take place?
|
| Devices and networks |
Storing and accessing data on personal devices or through a public, unsecure network could create vulnerabilities. Any data stored in an unsecured way can create vulnerabilities, including data downloaded onto a desktop. |
Do staff using personal devices to access sensitive data? Are all staff in your service aware of potential vulnerabilities exposed by the use of public networks? How often to staff delete data from their desktop? |
| Backups |
Your service should have suitable, secured backups of essential data that would allow for a quick and prompt recovery of essential services. This may include encrypted backups held in a secure off-site environment, removable media in physically secure storage, segregated backups, or appropriate alternative forms. |
How often do backups take place? Where are backups stored? Who has access to backup data? Which member of your team is responsible for this? |
Table 2: Managing data
| Theme | Context | Areas to consider |
|
Handling sensitive data
|
Due to the nature of the work your service delivers, you will be handling sensitive data on a day-to-day basis, both electronically and physically. Your team must take extra precautions to protect the sensitive information outlined above.
|
Are you aware of all the sensitive data your service holds? How are physical notes and records stored or destroyed? What systems are used to store electronic records and information? |
|
Access controls
|
To ensure sensitive data is protected, you should implement access controls and restrict access to sensitive information only to authorised personnel. Training staff members on secure data handling is essential to ensure they are aware of their responsibilities in protecting data.
|
How is sensitive information stored in your service? How is it protected? Who has access to data storage systems? How often does your team review accesses? How often does training take place? How often are passwords changed? Is multi-factor authentication in use across programmes? |
| Regular audits | Your service should conduct regular audits of data management practices to ensure compliance with relevant regulations and industry standards i.e. a strong well-documented retention policy. Keep track of any changes in data protection laws and update practices accordingly. |
How often do you audit your data management practices? Who is responsible for organising this audit? How do you seek assurance that effective audits have taken place? |
|
Data protection regulations
|
The UK operates within legal regulations for data management, mainly General Data Protection Regulation (GDPR). It is your obligation to ensure that your team complies with these data protection regulations to protect personal data and ensure that the personal data of adults is collected, processed, and stored lawfully, fairly, and securely. |
Is your team aware of the UK GDPR regulations and how they affect its work? How often does staff training take place? |
|
Record keeping
|
Accurate and up-to-date record keeping is essential in Adult Social Services to ensure that important information about adults is available when needed. Records should be kept securely and in accordance with relevant legislation, and regular audits should be carried out to ensure the accuracy and completeness of the records. |
How often do your team update records? How are records stored and updated? |
|
Risk management
|
Risk management processes, such as conducting regular risk assessments, implementing appropriate security measures, and developing contingency plans for data breaches, are essential to identify and mitigate potential risks to the security and privacy of data. These risks should be added to the corporate risk register and raised to SMT. |
How often do risk assessments take place in your service? What contingency plans are in place for data breaches? Are staff aware of data breach processes? |
NHS England has produced a useful guide to secure data management and security: Protecting and Safely Using Data in the New NHS England.
Table 3: Sharing data
| Theme | Context | Areas to consider |
|
Collaboration and safeguarding
|
Sharing information enables practitioners and agencies to identify and provide appropriate services that safeguard and promote the welfare of adults.
However, information sharing must be done in accordance with relevant legislation, such as the Care Act 2014, and must ensure that the privacy and confidentiality of the adults is maintained. Effective information governance practices, such as assigning responsibility for data management (DPO), providing training on data protection and confidentiality, and implementing secure IT systems and procedures, are essential to ensure that data is managed securely and appropriately. |
Who is responsible for data management and sharing in your service? How often does training take place? What procedures are in place to ensure effective and secure data sharing between teams and partners? Do you feel confident that information is being shared safely by members of your team? |
|
Consent
|
As set out in the Data Protection Act 2018, you do not need to seek consent before collecting, processing, or sharing information regarding adults who may be at risk. It is, however, considered to be good practice to inform a parent/family member, or carer when sharing data. You must also be clear about your purpose for sharing information. |
Are all staff aware of consent regulations? Are your team clear on when they need to gain consent for sharing data? |
| Offline records |
When assessing the risks to your service, you should also think about any partner organisations you work with, suppliers and any systems you have external links with. You will need to have a robust and prearranged process in place for sharing information securely, so nothing is shared inadvertently. In addition to this, most IT systems will have a process in place for restricting sensitive records for these cases. |
Do you have processes in place for sharing offline information with partners? What security measures are in place for sharing sensitive information? |
Table 4: Awareness and training
| Theme | Context | Areas to consider |
| Positive culture |
A positive cyber security culture instils the importance of cyber security and the role every individual has in helping to protect the council. It will ensure that staff view cyber security as a business enabler rather than a hindrance and is understood by all councillors and staff. A positive culture contributes to the overall effectiveness, efficiency, and ethical conduct of your service. |
Does your team speak openly and regularly about cyber security and risk? Is it discussed at a board level? How often does your service review the cyber security strategy? How confident do your team feel with the strategy? |
| Awareness |
Experience shows that cyber risk to councils does not only come from external sources; employees can often present some of the most significant risks to cyber security. By clicking on links in phishing emails, storing sensitive data on personal devices, using unsecured networks, weak passwords or not installing security updates, employees can put your information under serious threat. |
Do you understand the awareness levels of cyber security within your team? How can you ensure cyber risk is pitched correctly for various roles in your service? |
| Training |
Cyber security training should be refreshed regularly. As a director you’ll be aware of the high demands on the staff within your service, however this training must be prioritised to reduce the risk of a cyber attack.
|
How often does cyber security training take place in your service? Is training appropriate for all staff at different technical levels?
|
| Reporting | In order to create a positive cyber security culture in your service, all staff must be aware of the process of reporting a potential breach and feel confident to do so at all levels. |
Do all team members understand the process of reporting a data breach? Is there a service-wide communication strategy in place to report data breaches? What impact would a data breach have on your team? |
| Workforce | A large amount of agency staff may be being used by your service. | How can you integrate cyber secure practices into this temporary and externally managed workforce? |
Table 5: Supply chain management
| Theme | Context | Areas to consider |
| Co-ownership | Procurement practices should be co-owned by IT, procurement, and Adult Social Services to ensure that products are understood from a business and technical perspective. |
Do members of your team work closely with other teams during the procurement process? What barriers are in place during this process? What needs to change to streamline this process? |
| Procurement | Your service should take steps to ensure that external providers are subject to rigorous procurement processes that assess their security controls and measures. This may include assessing their security policies, performing security audits, and ensuring that they comply with relevant security standards and regulations. |
Does your service consider cyber security during the procurement process? How do you seek assurance that this has taken place?
|
| Contract management | Your service should consider including specific cyber security requirements and clauses in its contracts with external providers to ensure that security measures are in place throughout the duration of the contract. |
Does your service include cyber security requirements within contracts? How is this measured? |
| Monitoring and reporting | Regular monitoring and assessment of external providers’ security practices should be conducted to ensure that they are maintaining a strong security posture. |
How would you work with partner organisations if your IT systems were unavailable? How would you work with partner organisations if they were experiencing a cyber attack themselves? |
Table 6: Legislative Implications
| Law | Cyber security Implications |
| Data Protection Act 2018 (DPA 2018) and UK General Data Protection Regulation (GDPR) |
These legislations mandate robust protection of personal data. Cyber security measures, such as encryption, secure access controls, and regular software updates, are essential to prevent unauthorised access and data breaches. Compliance involves ensuring that personal data is processed securely, and any breaches are promptly reported to the relevant authorities. |
| Care Act 2014 | Person-centred care planning often involves sharing information among different organisations. Cyber security measures are necessary to facilitate secure information exchange, preventing data breaches and ensuring that collaborative care efforts are not compromised by unauthorised access to sensitive data. |
| Health and Social Care Act 2012 |
This legislation emphasises the importance of information governance within the health and social care sector. Cyber security measures are crucial to uphold the confidentiality, integrity, and availability of sensitive information. Establishing secure networks, data encryption, and access controls align with the Act’s objectives of maintaining information security. |
| Mental Capacity Act 2005 | When handling information related to mental health, maintaining the security of data becomes crucial. Cyber security measures, including secure storage and transmission of mental health records, help ensure that this information is not accessed or disclosed improperly. |
| Access to Health Records Act 1990 |
Providing individuals access to their health records demands secure systems to protect against unauthorised access. Robust cyber security measures are essential to prevent data breaches and safeguard the confidentiality of health records. Ensuring that the Caldicott Principles are always adhered to. |
| Human Rights Act 1998 |
Respecting individuals’ rights to privacy and dignity is a key component of this legislation. Cyber security measures are vital to protect against unauthorised access or disclosure of personal and sensitive information, ensuring that individuals’ digital rights are safeguarded. |