Chamber and committees

Supporting cyber resilience in local authorities is a priority for the Scottish Government. We provide a range of measures to support both immediate incidents as well as helping strengthen local authorities’ cyber resilience in the longer term.

The Scottish Cyber Coordination Centre’s (SC3) core function is to work with the Scottish public sector to help them improve their preparedness, reduce vulnerabilities and learn from best practice. SC3 has 24/7 on-call arrangements to immediately engage multi-agency response, where necessary, for any public sector organisation who is subject to a cyber attack. When the cyber incidents occurred in Glasgow City and West Lothian councils, the SC3 quickly stood up a multi-agency response to support the councils.

SC3 provides several important services including:

• sharing of relevant threat intelligence and early warnings,
• liaising with partners such as NCSC and Police Scotland,
• advising on consequence and data leak management, and
• guiding on Cyber Incident Response support options.

Specific post-incident lessons learned are shared in appropriate channels. These continue to feed into scenario-based exercising through the Exercising Workstream to improve organisational preparedness. The SC3 has worked with the Digital Office CISO to deliver strategic level cyber exercising to several local authorities with more planned for later this year. Under the Standards & Insights Workstream, SC3 has also initiated two pieces of research targeted at the most common lessons from ransomware incidents, to provide additional guidance for organisations on legacy technology and multi-factor authentication.

We recognise the crucial role that councils and their employees play in communities across Scotland. That’s why the Scottish Government has made a record £15.1 billion available for local authorities for 2025-26, a real terms increase of 5.5% compared with last year.

It should be noted that local authorities are entirely separate entities from the Scottish Government. Their powers are set out in statute, and it is up to each local authority to manage its day-to-day business, including the management of its IT systems. The Verity House Agreement reinforces this principle of local autonomy, while also encouraging collaboration and shared learning across the sector.

The public sector provides a range of digital public services and it is critical that these are secure and resilient.

The Scottish Government has been encouraging public sector organisations to adopt a proactive, risk based governance approach, with board-level accountability to build their cyber resilience.

To support the sector’s ability to prevent, detect and manage cyber threats, the Scottish Government has set out a framework that provides an approach for public bodies to follow. It includes guidance on how to:

Assess their cyber resilience maturity

Align with minimum security standards

Benchmark performance, and

Prioritise investment based on risk.

It is supported by practical tools such as self-assessment templates and critical systems mapping resources which enables organisations to identify needs, engage leadership and prioritise budget and support.

The Scottish Cyber Coordination Centre (the SC3) provides:

24/7 national incident response coordination

Daily threat intelligence and early warning notifications

Cyber exercising and preparedness programmes, and

Guidance on standards and best practice.

This national support is helping to equip our public bodies with the tools, intelligence and skills needed to build and maintain strong cyber resilience.

Scottish Government commissioned Public Health Scotland (PHS) to implement and deliver the national Fracture Liaison Service (FLS) audit.

As part of the implementation, PHS is consulting with all NHS Boards to review services currently in place across Scotland and to consider how local examples of good practice feed into a national audit and are shared across the country.

PHS is collaborating with NHS Glasgow and Greater Clyde’s (NHS GGC) South Sector team and have met with the external provider of the digital solution technology for patient identification use in their service to understand the results achieved.

NHS Boards are responsible for the services they deliver. The decision to implement an external IT system to support service delivery is therefore the responsibility of NHS Boards.

The FLS audit has been commissioned to drive improvements and support clinical decision-making in effectively evaluating gaps in osteoporosis care. This will reduce health inequalities for the people of Scotland, especially for those most at risk of fractures.

Public Health Scotland (PHS) is responsible for delivering and implementing the Fracture Liaison Service (FLS) audit. While they identified some initial recruitment-related delays, these have been addressed and completed.

PHS do not anticipate any further impact following this initial delay and progress is continuing at pace, on track and within the guidance set out by Scottish National Audit Programme (SNAP).

We are unable to provide the information requested. The aquaculture sector is governed by multiple agencies in both Scotland and the UK, for example APHA (Animal and Plant Health Agency). These agencies provide different legislative functions and charging schemes. The agencies and their respective employees who work on aquaculture undertake a wide range of duties relating to the governance of aquaculture in the round, not only to the salmon sector.

The Islands Cost Crisis Emergency Fund (ICCEF) is distributed to island local authorities, which decide where funding will be directed based on their local knowledge and understanding of the impacts of the cost crisis on their island populations.

The six island local authorities have provided, where possible, a breakdown of how the monies have been distributed.

Several recipients could reasonably be classified as both third sector and community organisations. For the purposes of this question, local authorities have assigned each recipient to the category they consider most appropriate.

In this instance, the Scottish Government has assumed ‘private’ to mean private individuals and families

The Scottish Government has been engaging in ongoing discussions with the UK Government regarding the introduction of a “Hillsborough Law”, including a legal duty of candour for public servants and accompanying criminal sanctions. The Scottish Government is considering the extension of this to Scotland and the work in relation to this is ongoing.

The Scottish Government is aware of the Law Commission’s report on the common law offence of misconduct in public office in England and Wales and its recommendation that this is replaced with two statutory offences. The common law offence of misconduct in public office does not exist in Scots law. However, there is a comparable common law offence in Scots law of wilful neglect of duty. The Scottish Government has had some early engagement with the UK Government in relation to the Law Commission’s report.

I refer the member to the answer to question S6W-38966 on 22 July 2025. All answers to written Parliamentary Questions are available on the Parliament's website, the search facility for which can be found at https://www.parliament.scot/chamber-and-committees/written-questions-and-answers

Addressing allegations of sexual misconduct is an operational matter for the Chief Constable. The information requested is not held by the Scottish Government.

I have asked Teresa Medhurst, Chief Executive of the Scottish Prison Service (SPS), to respond. Her response is as follows:

I refer the member to the answer to question S6W-39151 on 24 July 2025. All answers to written Parliamentary Questions are available on the Parliament's website, the search facility for which can be found at https://www.parliament.scot/chamber-and-committees/written-questions-and-answers.