Southern ShieldCyber

03 · Local government

The services a community relies on.

Councils and shires operate rates, libraries, works, care, and cameras with teams that were not established as security departments. When a portal fails or a mailbox is misused, the matter becomes public.

Typical conditions

  • 01

    Seasonal public load. Rates, grants, and enquiries arrive in peaks. The portal is the public counter.

  • 02

    Personal information across services. Community services hold data that a breach would make public very quickly.

  • 03

    A small team and a public question. The technology team is small. A general manager or councillor will ask what was done.

How the engagement is structured

  • 01

    Tests aimed at the services residents touch

  • 02

    Load tests before rates season, a grant round, or a public launch

  • 03

    A readiness drill that includes communications

  • 04

    A one-page brief a general manager can take to the executive

Relevant services

01Penetration testingAuthorised testing of the applications, networks, and identities in operational use: the public portal, staff remote access, the API behind a form, and privileges that should not extend. Findings are ranked by what an attacker can reach, then written so an engineer and an executive can both act.TestingLearn more04Load testingCapacity under the traffic the organisation is about to receive, with journeys, a ceiling, and abort conditions agreed before the first request is sent. The result identifies the point at which latency, errors, and saturation prevent the service from meeting its commitments.TestingLearn more03Incident response readinessPlans, roles, and a facilitated exercise that shows whether an incident can be contained: ransomware during business hours, a misused mailbox, exposed personal information, or failure of a public portal. The engagement concludes with an after-action record that names owners and dates.TestingLearn more02AWS configuration reviewAccounts, identity, logging, network boundaries, and data guardrails, assessed against the settings around the workloads in production. The review separates a guardrail that can be closed promptly from a design change that requires a project.TestingLearn more06ComplianceEssential Eight, the Information Security Manual, the Privacy Act, SOCI, and the sector duties that already apply, mapped to evidence you hold. Gaps are ranked by obligation and effort, in language an auditor or a board can read.AdvisoryLearn more07GovernanceWe help you keep security decisions visible after the test, with a register that is maintained, policies staff can follow, and reporting suitable for a council, an executive or a board.AdvisoryLearn more

Contact

Talk to us about local government.

Book a call about your organisation and the system you need to protect. We will come back with a scope, or with a question that makes the scope clearer.

Book a call