Policy Brief: Strengthening cyber-resilience and procurement frameworks for connected places

A key focus of the UK’s national cybersecurity strategy 2022-2030 is to develop capabilities that provide sufficient system-wide visibility of digitally connected places to effectively manage systemic risks, and to protect citizens, organisations (such as public, private, academic, Government) and Critical National Infrastructure (CNI). Local authorities (LAs) have a key role to play in the design, build, and secure operations of the UK’s connected places. It is therefore critical to assess whether current policies and national guidelines support LAs in mitigating the systemic risks and cascading impacts of cyber-attacks across essential national services in a connected place environment.

This brief is based on research conducted between April 2022–January 2023, the purpose of which was to assess whether current procurement and cyber risk management processes for smart services enable the UK’s LAs to prevent and prepare for the magnitude of these systemic risks. This brief offers recommendations on strengthening current policies and aligning them with the National Cyber Strategy 2022-2030.

Lead researchers:
Meha Shukla PhD researcher, supervised by Professor Shane Johnson (Director, Dawes Centre for Future Crime, Department of Security and Crime Science at University College London, UK) and Professor Peter Jones (Transport and Sustainable Development, Dept of Civil, Environ &Geomatic Eng, University College London, UK). We also appreciate the support provided by NCSC and DSIT in reviewing this policy paper.

This policy brief was written by Luis Miguel Lacerda, Policy Engagement Specialist in the PIU in coordination with Meha Shukla.

Funder & Key Contributors:
This work was carried out by the Dawes Institute of Future Crime at UCL.

Output type:
Policy briefing