East Lothian Council has no overarching cybersecurity strategy and has yet to put a formal AI governance policy in place, according to an internal audit review presented to councillors.
The review, which went before the council’s Audit and Governance Committee on 29 September, rated the authority’s cyber arrangements as “reasonable assurance”, the second-highest of four grades. That means a generally sound system of controls are in place with ‘some’ areas of non-compliance and scope for improvement.
Auditors found the council protects itself through standardised secure configurations, centralised device management, encryption, patching, access controls and continuous monitoring.
Without a council-wide strategy, however, they said the authority lacks a clear way to set direction, prioritise work and match limited resources to the most significant risks.
The council’s corporate risk register rates cyber threats as “very high”, reduced to a “residual high” by the controls in place. One scenario it records is a third-party attack that cuts off access to, or destroys, parts of the council’s IT infrastructure and information systems.
The report said: “The Council’s Information Security and IT teams have robust processes in place to monitor and safeguard IT infrastructure and systems, and in ensuring that appropriate cybersecutity arrangements are in place, the Council operates against established and externally mandated frameworks such as the NCSC Cyber Assessment Framework (CAF), PSN compliance requirements, and DWP Memoranda of Understanding (MoU).”
The report says recent cyber incidents at high-profile commercial organisations and at other Scottish local authorities have raised awareness of the risks facing the council, and of the need for tighter control over digital communications and systems access.
“Resource constraints” in the cybersecurity team had led to heavier workloads, competing priorities and staff covering multiple roles, the report noted. Auditors said this could limit strategic planning and oversight, though they noted the IT security team is now fully resourced. With the council’s exposure to cyber risk still growing, they said security capacity needs further review to meet operational, regulatory and resilience demands. Management has committed to creating additional roles by December 2026.
On artificial intelligence, the review found no formal council AI governance policy and described AI-specific risk assessment as an area still evolving. Auditors recommended that the council adopt a policy and build AI-related cyber risk assessment into its existing technology review processes, which management agreed to put in place by March 2027.
The same deadline applies to the cyber strategy, which will be aligned with the work of the council’s ‘strategic digital and customer board’.
In total the review made four medium-graded recommendations, all accepted by management. It follows an August 2025 audit of specific cyber controls, which produced 12 recommendations, which were not graded. This year’s exercise was a higher-level assessment of governance, risk management and controls, carried out by the council’s internal auditors against the cybersecurity requirements set by the Institute of Internal Auditors, the profession’s standards body.
The report also identified several areas of good practice. The council benchmarks itself against the National Cyber Security Centre’s ‘cyber assessment framework’ and maintains Public Services Network (PSN) compliance. Cybersecurity training is mandatory for new and existing staff, and managers follow up when it isn’t completed, with the report noting a ‘strong culture of accountability and continuous awareness’. The council has adopted a “deny by default” zero trust model, and auditors said its decision not to rely on a single network vendor improves resilience by reducing exposure to shared vulnerabilities.
Threats and vulnerabilities are scored by likelihood, impact, according to industry standard CVSS/CVE ratings, asset criticality and potential effect on public services. Risks are tracked through dashboards and ongoing scanning until they are resolved, and the council has a documented cyber incident response and recovery plan.
Internal audit will follow up on progress against the new recommendations, with the strategy, extra security roles and AI policy all due within the next six months.
