Penetration testing for councils is a controlled attack on a local authority’s systems, run by an accredited tester, to find weaknesses before a criminal does. Most councils already do some of it, because annual IT health checks have long been tied to Public Services Network (PSN) connection. The harder questions are what to test, who should do it, and what to do with the report.
This guide covers those questions in plain terms for IT managers, heads of digital and the officers who sign off the budget.
Table of Contents
Why does penetration testing for councils matter?
Councils hold a lot of data about a lot of people. They also run services that residents cannot do without, from social care records to bin collections and benefits payments. That mix makes them a worthwhile target, and an outage hurts quickly.
The other pressure is practical. Many councils run a blend of old line-of-business systems, cloud services and suppliers’ portals. Nobody holds the whole picture in their head. A tester looks at the estate the way an outsider would, and that often exposes the forgotten server or the over-generous account that routine scans miss.
The NCSC puts the point plainly in its penetration testing guidance: a test only confirms the absence of known issues on the day, and a year or more can pass between tests. So it works best alongside regular scanning, not instead of it.
What is a CHECK penetration test?
CHECK is the NCSC scheme under which assured companies carry out authorised penetration tests of public sector and critical national infrastructure systems. The NCSC’s CHECK page says the scheme was built for central government departments, public sector bodies and CNI organisations, and that it sets standards those bodies can trust.
Councils sit squarely inside that audience. Tender documents show how this plays out. A Rossendale Borough Council ICT health check specification for 2025 says testing must follow NCSC guidance and that suppliers must be accredited to CHECK.
The NCSC does not describe CHECK as a legal requirement for every authority. Check your own contracts and connection conditions, then write the requirement into the tender if you want it.
What does an IT health check cover?
An IT health check is the name many councils use for the annual round of external and internal testing. The Rossendale specification gives a useful picture of the typical scope:
- internet footprinting and an external vulnerability scan;
- an external penetration test;
- a review of core switches, internal gateways and firewalls;
- an internal network penetration test;
- a wireless test;
- testing of remote sites.
Councils often add call-off days to that, so they can book extra work later, such as a configuration review or a one-off scan. That is sensible. New projects rarely land on the same date as the annual test.
The same document says testing must happen no earlier than six months before the Code of Connection return is due. If your return is due in March, that pushes the work into January or February, and supplier diaries fill early. Book the slot well ahead.
Internal and external testing
External testing looks at what anyone on the internet can reach: your website, remote access gateways and mail systems. Internal testing assumes an attacker has already got a foothold, perhaps through a phished laptop, and asks how far they could go. For a council, the internal view matters a great deal, because one compromised account is how most ransomware incidents grow. Our guides to external and internal network penetration testing explain the difference in more depth.
How does the Cyber Assessment Framework fit in?
The Local Digital team at MHCLG adapted the NCSC’s Cyber Assessment Framework for councils in England. Its published process has four steps: identify your essential services and critical systems, complete a self-assessment, take an independent assurance review, then plan to fix the gaps.
The framework is voluntary, and the same page says it does not replace existing standards such as PSN. It also does not mention penetration testing. So a CAF review and a pen test do different jobs. The first tells you how well you manage cyber risk as an organisation. The second tells you whether specific systems can be broken into today. Many councils will want both. The Rossendale tender already asks suppliers to understand the CAF.
What should penetration testing for councils include?
Start with the services you cannot afford to lose, not with a list of IP addresses. Good penetration testing for councils begins with that question. The NCSC suggests involving risk owners, the technical staff who know the system and a representative of the test team when you scope, and sharing your current vulnerability assessment with the testers.
Then settle these points in writing:
- the technical boundaries and test types;
- the timeframe and the number of testing days;
- any systems that need care, such as those that support emergency services or live payments;
- whether testing should run out of hours;
- how findings will be rated, for example with CVSS scores or CHECK severity levels.
The Rossendale specification asks suppliers to flag systems that look open to denial-of-service attacks without actually exploiting them. That is a good habit for any council with fragile legacy kit.
How do you choose a testing supplier?
Ask who will actually do the work. The NCSC notes that test quality depends heavily on the testers’ abilities, because penetration tests cannot be fully scripted. A glossy brochure says little about the person who will sit in your network.
Useful questions include:
- Is the company CHECK-assured, and are the named testers the ones who will do the job?
- Have they worked in local government environments before?
- Will they tell you about unusual systems in your estate that they lack experience with?
- What does a sample report look like, and does it follow NCSC reporting guidance?
- Will they run a debrief and retest the fixes?
Procurement rules add their own steps, so allow time for a framework or tender route. Our piece on penetration testing versus a security audit may help when a committee asks what it is actually buying.
What happens after the test?
The report is where the work starts. The NCSC advises assessing it through your vulnerability management group, as you would an internal assessment. Risk decisions and fixes remain yours.
Two further points from the same guidance are worth keeping. Do not let testers’ severity ratings talk you out of an issue, since they may lack business context and can rate things higher or lower than you would. And give extra attention to vulnerabilities you did not already know about, then work out how to spot similar ones in future.
Some fixes are not a patch. You might remove unneeded software, add a control or increase monitoring instead. Whatever you choose, record the decision, and retest so that you can show the issue is closed.
FAQ
Is penetration testing mandatory for councils?
It depends on your obligations. PSN-style IT health checks have been an annual requirement for councils that connect to that network, and the CAF is voluntary. Confirm what applies to your authority with your information governance and security leads.
How often should a council test?
The NCSC does not set a fixed frequency. Many councils test every year to match their connection cycle, with extra tests after major changes and routine scanning in between.
Is a vulnerability scan the same as a penetration test?
No. A scan finds known weaknesses automatically. A penetration test adds a person who tries to chain issues together and reach real data. The Rossendale scope lists both, which shows councils usually need each one.
Do small parish and town councils need this too?
They have far smaller estates, so a full programme may be overkill. A scoped test of the website, email and any remote access is a sensible start, backed by Cyber Essentials. See Cyber Essentials and penetration testing for how the two relate.
Getting help
If you are planning this year’s round and want a second opinion on scope, Aardwolf Security can talk through a penetration test that fits your estate. You can get in touch for a scoping conversation, with no obligation.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
