Cyber Resilience - Training for Public Sector Boards

Globally organisations and individuals have become reliant on digital technology. Effective cyber security and resilience protect the processes and services we depend on, ensuring we can take advantage of the benefits that technology can bring. An organisation’s ability to prevent, respond to and recover from a cyber attack is central to resilience. Cyber resilience is therefore a key risk and consideration for any Board. The Scottish Government’s Strategic Framework for a Cyber Resilient Scotland (‘the Strategic Framework’), published in February 2021, sets out what we all need to do to make Scotland a digitally secure and resilient nation. Four outcomes underpin this vision, and four action plans set out the detail of how we will achieve these. Responsibility for the implementation of the Strategic Framework lies with the Scottish Government’s Cyber Resilience Unit (CRU). The Public Sector Action Plan annexed to the Framework is a priority for the CRU and overarching aim 5 seeks to embed cyber resilience into the governance, policies and processes of public sector bodies. The CRU works in partnership with a wide range of organisations including the UK Government’s National Cyber Security Centre (NCSC). The NCSC supports all areas of society to understand cyber risk from our critical national infrastructure organisations to the general public. More specifically, the NCSC distils its deep knowledge and expertise into practical guidance including a Board Toolkit designed to encourage cyber security discussions between an organisation’s Board and its technical experts. In spring 2023, the Scottish Government contracted a short pilot project to adapt the NCSC’s Board Toolkit and pilot its delivery with a group of public sector board members drawn from organisations across Scotland. The pilot was successful and feedback was positive. It is on the foundation of this pilot that we are now contracting a scaled-up roll-out of the training programme. We will work with the successful Service Provider to make any further tweaks to the training pack that are recommended in the evaluation report of the training pilot.