Improving council cybersecurity and digital health

Summary:

• Working face to face to improve .gov.uk domain adoption across parish councils has majorly improved cybersecurity across the sector
• The initiative owes its success to its people-first, rather than technology-first, approach
• Utilising existing relationships with trusted organisations was an effective way to encourage adoption of the domain
• Transparency over data and project progress further encouraged and solidified progress

When we consider digital transformation, we don’t usually think about village halls and community meeting rooms — yet that’s exactly where the Parish Council Domains Helper Service (PCDHS) made its mark. Rather than leading with technology, the team behind the project focused on people, speaking in plain English, meeting clerks face-to-face, and working through trusted local networks. The result was a huge uplift in .gov.uk domain adoption, a major improvement in cybersecurity across the sector, and an award‑winning example of what happens when transformation starts from the ground up. 

What was the purpose behind the project and how has the digital health and cybersecurity of parish councils been improved? What long-term benefits do you see for communities?

Khidr: One of the biggest improvements has been around email and information management. When we started, roughly two thirds of councils were using personal email accounts, such as Gmail and Hotmail, for official business. That’s obviously risky. If a councillor left, they took all of their emails and records with them. Clerks were stuck trying to chase information they no longer had access to. There were also risks around impersonation and a complete lack of audit trails. By moving to council‑owned .gov.uk domains, clerks could finally manage accounts properly — create them, close them, and retain records. This represents a huge step forward for transparency and good governance.

Tim: Cybersecurity also improved dramatically. Every council that moved to .gov.uk gained access to NCSC tools like Web Check, Mail Check and Early Warning, as well as broader monitoring from the GDS team. This meant that vulnerabilities could now be spotted earlier and potential threats monitored more effectively. Councils sometimes assumed this meant ‘we’re now 100% safe’, so we had to reinforce the message that there are still risks, especially in relation to human error. But, they’re now starting from a much more secure foundation. The long-term benefits for communities are really about trust. When residents contact a .gov.uk address, they know they’re dealing with a legitimate authority. As a result of this project councils themselves become far more resilient, organised and future-proof.

What was the biggest challenge in persuading parish councils — many of which are financially constrained — to adopt .gov.uk domains?

Tim: Cost was definitely one of the first things that came up. When we started, .gov.uk domains were more expensive than the usual options, so councillors quite reasonably asked why they should spend money on something that wasn’t a frontline service. But that was only part of the story. Many councils didn’t even know they could use a .gov.uk domain, never mind what the benefits were. And for a lot of clerks and councillors the whole subject felt technical and slightly intimidating. Some didn’t really know what a domain was, let alone how to migrate one.

On top of that, clerks often work part time and already have more than enough on their plates, so taking on another project, even a small one, felt like a big ask. And yes, there was a fair bit of ‘we’ve always done it this way’, which is perfectly understandable. Changing the foundation of how a council presents itself online can feel like a much bigger step than it actually is.

How does the PCDHS exemplify digital transformation at the local government level, and what makes it different from previous initiatives?

Khidr: What made this different is that we didn’t start with technology at all. We started with people. Digital transformation is often talked about in terms of shiny new systems, but none of that matters if the humans involved don’t understand it, don’t feel confident, or don’t buy into the change. 

Tim: We ran face‑to‑face sessions across the country, speaking directly with clerks and councillors in language that made sense to them. No jargon, no central‑government speak, just open conversations about their worries, barriers and priorities. Because this wasn’t mandated, everything relied on persuasion and trust. That meant really listening, building relationships, and showing how this would make their lives easier, not harder.

The human element is the reason this worked. That’s also why the project stood out to the award judges. It’s a great example of transformation led by empathy, not by technology.

The project exceeded its adoption target by nearly 30%. What made that possible, especially within the time and budget limits?

Tim: We knew from day one that we needed the help of organisations that parish councils already trusted. So we worked closely with the Society of Local Council Clerks (SLCC), the National Association of Local Councils (NALC), and the regional ALCs. There’s no single email list you can use to contact every parish council — the only way to reach them is through these networks. Once we connected with those bodies, everything became easier because their endorsement carried real weight.

For you

Be part of something bigger, join BCS, The Chartered Institute for IT.

We also used a mix of encouragement and, let’s say, gentle nudging. We helped subsidise the higher cost of .gov.uk domains, provided simple guidance, and offered training.

At the same time, we worked with editors of the Practitioners’ Guide, auditors and NALC’s Local Council Award Scheme to make .gov.uk the best-practice option. So while it wasn’t mandatory, councils were constantly encountering it in sector standards and guidance. It helped normalise the idea. And we tracked everything. Every meeting, every adoption, every bit of progress. Sharing that data openly with regional ALCs sparked a bit of friendly competition — ‘Yorkshire is ahead of Nottinghamshire’, that sort of thing, which definitely helped.

Collaboration seems to have been a big part of this project. What lessons did you learn about partnership working that could shape future digital transformation efforts?

Tim: For me, the biggest lesson is that you have to work with the organisations people already listen to. SLCC, NALC and the ALCs have built trust over many years, and tapping into that was vital. It’s a reminder that transformation isn’t just about expertise, it’s about relationships.

Khidr: Another lesson is the value of transparency. We shared every metric, every update, every regional breakdown. It gave everyone a shared sense of progress, and it meant discussions were grounded in real data rather than guesswork. 

Tim: And of course, it’s important to be aware of language and how you communicate with people. Every audience has its own pressures, priorities and ways of communicating, so by tailoring your messages accordingly you can make sure they land much more effectively.

With the service now transitioned to the Government Digital Service (GDS), how will momentum be sustained?

Tim: We spent a lot of time designing something that could keep running even with a much smaller team. All the guidance now lives on .gov.uk in a clear, self‑service format. 

Khidr: Training continues, just on a slightly lighter schedule. And our GDS team has kept up the relationships with NALC and others, continuing to strengthen how best practice is reflected in sector documents and award schemes. The encouraging thing is that the pace hasn’t slowed. After CMC’s team stepped back, another thousand councils moved to .gov.uk, which shows the model is working. We've even gone on to expand our remit and are now delivering cyber security presentations to councils after a very well received presentation at the SLCC National Conference.

And finally, what are your thoughts on the award win at the IT Industry Awards, and the whole process leading up to it?

Khidr: The judging process was surprisingly enjoyable. It wasn’t just a presentation, it turned into a proper discussion with people who understand digital change and were genuinely interested in the impact. Pulling everything together for the submission was satisfying too; it reminded us just how much progress had been made. 

Tim: It felt like a very robust process. The written submission is no small task, and the judges clearly take it seriously. When our category was announced it was a brilliant moment. We were up against some huge names, including major retailers and banks, and we were the only SME in the category. The win really highlighted that strong outcomes and clear evidence matter more than size or brand recognition. That’s why the award felt so meaningful. It was real acknowledgement of the project’s impact.