Local Government Identity Security Guide: Councils, Shared Services and Resilience

Councils and other local authorities run hundreds of services, from social care and housing to waste, revenues and elections, on identity estates that grew by merger, shared service and outsourcing, and ransomware operators know a single over-privileged account can stop all of them. A typical authority has an on-premises Active Directory synchronised to a cloud tenant, line-of-business systems with their own local accounts, suppliers with remote access, partner bodies sharing networks, and seasonal staff for elections. This guide sets out the identity controls that matter most in that setting, how to handle shared services and suppliers, how to protect election systems, and how to align the work with the Cyber Assessment Framework for local government in England, NIST CSF 2.0 and US state and local resources. It is written for council IT and security teams, shared service managers and the senior information risk owners who sign off the risk.

Key takeaways

• Identity is the ransomware path: CISA's #StopRansomware Guide puts phishing-resistant MFA on email, VPN and critical-system accounts, separate admin accounts and quarterly removal of inactive accounts at the centre of prevention.
• Shared services multiply blast radius: one directory, one tenant or one supplier account serving several councils means one compromise reaches all of them; design tiering and per-partner scoping from the start.
• Suppliers and remote access need their own lifecycle: named accounts, MFA, time-bound access and quarterly review, with remote monitoring and management tools reviewed first.
• Elections are a peak-risk event: temporary staff, electoral management systems and registers need pre-planned, time-limited access and extra monitoring around polling day.
• Use the frameworks you will be assessed against: the CAF for local government (adapted from NCSC CAF) in England, and NIST CSF 2.0 or MS-ISAC resources in the US, give a shared language for funding bids and assurance.

The council identity estate

Attackers favour valid accounts (T1078) because they look like normal work. The priority order follows from the table: privileged and supplier accounts first, then remote access, then the general workforce, then the long tail of service accounts. See the Public Sector Identity Security Guide for the wider government context.

Privileged access and the hybrid directory

Most councils run a hybrid identity estate in which on-premises Active Directory is synchronised to a cloud tenant. Ransomware crews target the domain controllers, the sync server and the backup console because control of those means control of everything.

• Separate admin accounts: CISA advises separating administrator accounts from user accounts and limiting admin accounts to admin tasks (NIST SP 800-53 AC-6(5)). Admins should not read email or browse from privileged accounts.
• Tier the estate: keep accounts that administer domain controllers, the sync server and backups apart from those that administer servers and those that support desktops, so a compromised helpdesk account cannot reach the domain. See the Active Directory and Entra ID Hardening Guide.
• Audit AD privilege: review membership of Domain Admins, Enterprise Admins and other privileged groups, place privileged users in the Protected Users group, and use LAPS for local administrator passwords, as the #StopRansomware Guide recommends.
• Protect the sync account: Microsoft notes that Entra Connect and Cloud Sync accounts are not prompted for MFA under security defaults and must not be used for anything else. Treat the sync server as a domain controller. The Storm-0501 Hybrid Cloud Attacks 2024 show ransomware operators using stolen sync credentials to move from on-premises into the cloud.
• Emergency access: keep two cloud-only break-glass accounts outside synchronisation, with credentials stored offline and alerts on any sign-in. See the Break-Glass Account Guide.
• Isolate backup identities: backup consoles should use accounts that do not exist in the production domain, with MFA, so that domain compromise cannot delete backups. See the Backup Identity Isolation Guide.

Workforce and member authentication

The NCSC orders MFA methods as FIDO2 credentials first, then challenge-based authenticator apps, app-based code generators, hardware code generators and finally SMS, email or phone codes, which it considers appropriate only when nothing stronger is possible. CISA's ransomware guidance asks for phishing-resistant MFA on all services, particularly email, VPN and accounts that reach critical systems, and for any system that cannot enforce MFA to be escalated to senior management.

Block legacy authentication protocols in the cloud tenant, because they bypass MFA. Watch for push fatigue (T1621) where push approvals remain. See the Conditional Access Guide. Helpdesk password and MFA resets are a known bypass: require identity verification beyond knowledge of personal details, and call back on a number held in HR records. The Marks and Spencer Cyberattack 2025 shows how impersonation at the service desk can open a large organisation. See the Account Recovery and Help Desk Security Guide.

Shared services, partners and suppliers

Shared service models

• Write identity into the agreement: who owns tier 0, who approves admin rights for each partner, how joiners and leavers flow between HR systems, and what happens to accounts and data at exit. Due diligence before entering the relationship maps to NIST CSF 2.0 GV.SC-06.
• Review supplier access first: CISA asks for quarterly audits of user and admin accounts for inactive or unauthorised accounts, prioritising publicly reachable remote monitoring and management accounts and third-party access, and for managed service providers to hold only the access their responsibilities need. See the GDAP and MSP Delegated Admin Access Guide and the Third-Party Access Guide.
• No exposed remote access without MFA: CISA's guidance is not to expose RDP to the internet, to apply MFA and lockouts, and to log RDP attempts. The Change Healthcare Breach 2024 began with one remote access login without MFA.
• Partner bodies: guest accounts for health, police or voluntary sector partners get an owner, an expiry and a review at the end of the programme. Entra security defaults treat B2B guests like internal users for MFA.
• Supplier assurance: the NCSC notes that a growing number of organisations require suppliers to be Cyber Essentials certified, and user access control is one of its five controls. See the Cyber Essentials Guide.

Elections and other peak periods

Local authorities run electoral registration and elections, and those systems hold electoral registers and support a fixed, public deadline. In the US, election infrastructure, including voter registration databases and election management IT, was designated in January 2017 as a subset of the government facilities critical infrastructure sector, and CISA offers no-cost services to state and local election officials, including membership of the EI-ISAC.

1. Plan accounts early: create temporary staff accounts in a dedicated group with an expiry date set to a fixed number of days after the count, so removal happens without a manual step (NIST SP 800-53 AC-2(3)).
2. Least privilege in the election management system: separate roles for registration, postal vote processing and results, with administrator rights held by named permanent staff only.
3. Supplier access windows: election software suppliers get remote access only in agreed windows, through the council gateway, with sessions logged.
4. Heightened monitoring: from the close of nominations to the declaration, alert on new admin assignments, MFA method changes, bulk exports of the register and sign-ins from unusual locations.
5. Offline fallback: rehearse how the count and results publication continue if the election system or email is unavailable, including who can authorise emergency access.
6. Close out: confirm every temporary account is disabled, supplier access is removed and the access review is recorded.

The same pattern applies to other peaks such as annual billing, cold weather emergencies and school admissions.

Frameworks, funding and assurance

In England, MHCLG's Local Digital programme has adapted the NCSC Cyber Assessment Framework for councils. It was piloted with 10 councils in 2022, alpha-tested with 20 in 2024, and its early stages went live on the UK Government Security website in October 2024. Local Digital reports more than £28 million of direct support since 2020, a £6 million CAF Support fund from January 2026 for 52 councils that completed a CAF assessment, and a Cyber Incident Response Service with an NCSC-assured provider launched in November 2025 under its Defend as One approach. In the US, MS-ISAC serves state, local, tribal and territorial governments and moved to a member-funded model in 2025, with services such as Albert network monitoring and Malicious Domain Blocking and Reporting.

See the NCSC Cyber Assessment Framework (CAF) Guide. For smaller authorities such as parish, town and small district councils, NIST's CSF 2.0 Small Business Quick-Start Guide (SP 1300) gives a proportionate starting set: MFA on every account that supports it, starting with the most sensitive, password managers, replacing default passwords and removing access that is no longer needed.

Implementation roadmap

1. Days 0 to 30, privileged and remote access: inventory every admin, supplier and remote access account; remove what is unused; enforce MFA on VPN, remote desktop gateways and admin portals; create break-glass accounts.
2. Days 30 to 90, pilot workforce MFA and Conditional Access: run policies in report-only mode, pilot with IT and one directorate, list legacy apps that fail and plan gateway MFA or replacement.
3. Days 90 to 180, roll out and tier: enforce MFA for all officers and members in rings, block legacy authentication, separate admin accounts and introduce tiering for domain controllers, sync and backup systems.
4. Days 180 to 365, lifecycle and assurance: automate joiner, mover and leaver from HR, set expiry for temporary and partner accounts, run quarterly access reviews and complete a CAF or CSF self-assessment.
5. Rollback: if an enforced policy breaks a critical service, return only that policy to report-only, add a time-limited exclusion for the affected system with a named owner, and record the exception on the risk register.

Large unitary and county councils with shared services should invest in privileged access management and identity governance tooling; small councils get most of the benefit from MFA, separate admin accounts, a password manager and a tested offline backup. See the Privileged Access Management Guide and the Joiner-Mover-Leaver Guide.

Detection and measurement

• Directory changes: additions to privileged groups, new Domain Admins, changes to Group Policy and to the sync server configuration.
• Cloud sign-ins: legacy protocol attempts, impossible travel, sign-ins from anonymising networks, MFA method registration and changes, new consent grants to applications.
• Supplier activity: remote access sessions outside agreed windows, supplier accounts active after contract end, remote monitoring tool installs.
• Mailbox abuse: new forwarding and inbox rules, especially in finance, revenues and benefits teams.

Common failure patterns

• Weak and reused passwords across government accounts: once one account falls, single sign-on carries the attacker further. The Taiwan Autonomous AI Agent Cyberattack 2026 shows automated attackers cracking government accounts and pivoting through SSO.
• MFA everywhere except remote access and legacy systems: the gap is exactly where attackers enter, as with the Change Healthcare remote access login.
• Shared service admins with rights over every partner: convenient for the host, catastrophic when one admin account is phished.
• Directory sync server treated as an ordinary server: its credentials give a path from on-premises into the cloud, as Storm-0501 demonstrated.
• Backups administered from the production domain: once the domain falls, the attacker deletes or encrypts the backups before encrypting the estate (T1486). See the Ransomware Prevention Guide.
• Temporary and partner accounts without expiry: election staff, agency workers and programme guests remain active for years.

Practitioner checklist

• Enforce phishing-resistant MFA for every domain, tenant, backup and supplier admin account.
• Put MFA in front of every VPN, remote desktop gateway and internet-facing admin portal; close directly exposed RDP.
• Separate admin accounts from daily accounts and tier domain controllers, the sync server and backups as the highest tier.
• Scope shared service administration per partner authority and write identity ownership into each agreement.
• Audit user, admin and supplier accounts quarterly, starting with remote management and third-party access.
• Give temporary election, agency and partner accounts automatic expiry dates.
• Strengthen helpdesk identity verification for password and MFA resets.
• Keep offline, encrypted, tested backups administered by identities outside the production domain.
• Complete a CAF for local government or NIST CSF 2.0 self-assessment and track identity gaps on the risk register.

Standards and references

• NCSC: Cyber Assessment Framework
• MHCLG Local Digital: Cyber security for councils
• CISA: #StopRansomware Guide
• NCSC: Recommended types of MFA
• CISA: Election Security
• CIS: Multi-State Information Sharing and Analysis Center (MS-ISAC)
• NIST: SP 1300, CSF 2.0 Small Business Quick-Start Guide
• Microsoft Learn: Security defaults in Microsoft Entra ID

Related NHI Mgmt Group resources: Public Sector Identity Security Guide · NCSC Cyber Assessment Framework (CAF) Guide · Identity Recovery Guide · Ransomware Prevention Guide