'Appalling' cyber security training completion rate sparks alarm

“Alarming” official figures show just two of Gloucestershire’s 55 County Councillors have completed their cyber security training sparking calls for urgent action. Shire Hall provides training to all of its elected members and staff.

But a Freedom of Information request submitted by GloucestershireLive has revealed this week that only two councillors have completed all their assigned training. Four other elected members have completed part of it.

Gloucestershire County Council's more than 4,000 employees also regularly undertake monthly cyber security training. However, the estimated completion rate has nosedived since its high of 87 per cent in January last year to just 43 per cent in December.

£279m 'cyber warriors' will work with GCHQ boffins

Rent arrears of £50k sparks eviction of market traders after years of 'poor management'

The figues have been met with incredulity given the UK’s National Cyber Security Centre is based in the county at GCHQ in Cheltenham.

And Shire Hall's nearest district neighbour Gloucester City Council is still suffering from the fallout of a cyber attack in 2021.

One councillor who did not wish to be named described the figures as “frightening”. “It’s beyond alarming,” they said. “It’s frightening.

“Given that they’ve got Gloucester City Council in their location this really is appalling. It’s ridiculous given the amount of cyber crime there is. And the council manages a massive budget on behalf of the 660,000 people in the county.

“You would think they would want to ensure that at all levels of their organisation officials and councillors are up to speed.

“People don’t understand that cyber attacks happen 24/7. They will always go for the weakest link in the armour.

“From what I’ve learned, the weakest link is the elected officials, who actually should be leading by example and ensuring that all of their training is not only completed. Cyber security should really not be optional.”

The council said in its response to the FOI request that staff regularly undertake training and councillors are offered a suite of cyber security training.

“This translates to two of 55 councillors having completed all assigned cyber security e-learning videos, with four having completed a portion of the training,” they said in their response to the FOI request.

“The council's democratic services have recently issued training reminders to the elected members, and we anticipate an increase in completion of these non-mandatory e-learning sessions”

The council also said that based on their available records they estimate that 69.5 per cent of cyber security training issued to staff has been completed of date.

The National Cyber Security Centre gave an update on the cyber threat landscape in its annual review last year and said state actors such as China, Russia, Iran and the Democratic People’s Republic of Korea continue to present a significant threat to the UK and global cyber security.

They emphasise the importance for all organisations to act now to ensure cyber security is a key part of their operational resilience.

And just this week Defence Minister Luke Pollard announced a £279m investment in specialist modern facilities built for the Army’s cyber regiment at the Duke of Gloucester Barracks near Cirencester .

He spoke GloucestershireLive the importance of cyber security and the constant threat the UK faces.

“We are living in a new era of threats,” he said. “It’s not a theoretical threat, over the last two years there were 90,000 cyber attacks on defence by our adversaries.

“We know that every single day of the year our adversaries are seeking to get into our secure systems to attack us in the digital domain.”