Cyber Security Training in Local Government: The Expectations Have Changed. Is Your Council Ready?
Local councils hold some of the most sensitive data in their communities: ratepayer details, development applications, payment information and the systems that keep essential services running. They have also become a clear target for cybercriminals.
Over the past two years, the NSW Audit Office has looked closely at how councils manage cyber risk. The findings make one thing clear: technology alone won't fix this. People are both the biggest risk and the strongest defence.
What the audits found
In its 2024 performance audit Cyber Security in Local Government, the Audit Office examined three councils. None had an up-to-date incident response plan, none maintained a proper incident register, and none was managing third-party cyber risk effectively. On training, two councils brought in mandatory training during the audit period but had no regular schedule for it. The third offered only optional training for most of that time.
The audit cited research showing that 82% of breaches involve stolen credentials, phishing or simple human error. One of its key recommendations was for councils to set regular, mandatory training schedules for staff.
The Cyber Security Insights 2025 report showed progress across the sector. 74% of councils now have a formal cyber security policy, up from just 20% in 2019. But there are still gaps:
- Only 69% of councils provided cyber awareness training in 2024
- 45% did not run phishing simulations
- Some councils that ran simulations gave staff no corrective feedback
- Only 57% had a cyber incident response plan
What councils are now expected to do
The NSW Cyber Security Guidelines for Local Government set out what good practice looks like. They are clear about training:
- Cyber security awareness training made mandatory for all staff, every year and at onboarding
- Periodic phishing simulations for all staff
- Extra mandatory training for people in high-risk roles
- Ongoing awareness activities beyond formal training
Importantly, this covers more than council employees. The guidelines extend to mayors, councillors, consultants, contractors and outsourced service providers, all of whom need to understand the cyber security requirements of their roles.
Compliance with the NSW Cyber Security Guidelines is still voluntary, but expectations are rising. The Audit Office continues to scrutinise the sector: its Local government 2025 report gave councils until 30 June 2026 to strengthen supply chain risk management and improve accountability for cyber security spending. That deadline has now passed. Communities and audit committees will expect councils to show they are meeting this standard.
Why generic training falls short
Many councils use off-the-shelf awareness modules built for corporate settings. These rarely reflect how councils actually work: outdoor staff using shared devices, elected members who are not employees, heavy reliance on contractors, and public-facing teams handling sensitive community data every day.
Training works best when people see their own work in it. A rates officer, a depot supervisor and a councillor face different threats and need different examples.
How Upskilled is helping
At Upskilled, we believe the right training should be practical, relevant and easy for councils to roll out. That's why we're partnering with cyber security specialist Simona Dimovski to develop a course designed specifically for local government, built around the training expectations in the NSW guidelines and informed by Simona's research into the sector.
The course is designed to help councils give staff, elected members and contractors meaningful, role-relevant training, and to build a repeatable program councils can run each year and at onboarding.
Where to start
If you're responsible for cyber, governance or people capability in a council, a few questions are worth asking now:
- Is cyber training mandatory for all staff, and is it on a regular schedule?
- Are councillors and contractors included?
- Do you run phishing simulations and follow up with feedback?
- Can you show your Audit, Risk and Improvement Committee what's in place?
If any answer is "not yet", you're not alone, and there's a clear path forward.
Interested in learning more about our local government cyber security training? Get in touch with the Upskilled team.
)
)
