Practical guides
Find the guidance you need
Browse by topic or search for the situation you are facing.
5 guides available
Baseline security controls
The essential technical controls that prevent or contain the most common attacks on public-sector systems.
Securing email and websites
Stop email spoofing, protect public websites and reduce the phishing that targets staff and citizens.
Incident response planning
Prepare to detect, contain, recover from and report a cyber incident before one happens.
Identity and privileged access
Control who can access systems, enforce least privilege and protect the administrator accounts attackers want most.
Supplier and third-party assurance
Manage the cyber risk that reaches you through vendors, contractors and connected systems.
Protect the services the public depends on
Government and county systems hold personal data and deliver services citizens cannot easily obtain elsewhere. A single compromised administrator account or unpatched public service can expose records or interrupt delivery. Consistent baseline controls, applied everywhere, matter more than advanced tools applied unevenly.
What every public body should have in place
Clear ownership for each system, with a named person accountable for its security and updates.
Multi-factor authentication on all staff and administrator accounts, and least-privilege access.
A current inventory of systems, domains and data, so nothing is forgotten and left exposed.
Routine patching, monitored backups and a tested plan to restore services.
A known route to report and escalate incidents, including to the relevant national authority.
Handle personal data lawfully
Public bodies process personal data under the Data Protection Act, 2019. Register with the Office of the Data Protection Commissioner where required, collect only what you need, protect it, and be ready to report a qualifying personal-data breach within the timelines the law sets. Security and data-protection obligations reinforce each other.
Govern it from the top
Put cyber risk on the leadership agenda, fund the basics, and require assurance that controls are actually working rather than merely documented. Use the guides below to put each area into practice.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.