Table 1: Key Cyber Threat Categories (Source: Author)
The rapid adoption of AI-driven tools further complicates this landscape. While AI offers opportunities for enhanced detection, it also enables adversaries to achieve greater scale and sophistication in phishing and social engineering attacks.\[3, 8] This environment necessitates a shift from reactive cybersecurity—focused on firewall blocks and antivirus alerts—to proactive cyber intelligence, which seeks to anticipate and mitigate threats "left of the hack".\[13, 14] There are many existing frameworks, that could be deployed, the Lockhead Martin Kill Chain, The NIST CSF, The Mitre ATT\&CK framework The CERT-EU Cyber Threat Intelligence Framework and many others. \[20] This paper proposes an approach suitable for UK Local Authorities and the Public Sector, to support the CAF version 4.0 Framework \[39] moving forward. The Whole area of Cyber Threat Intelligence is not well understood, from the anecdotal observations, through the regional WARPs (Warning, Advice and Reporting Points), \[48] over the past 20 years. #### Theoretical Foundations of Cyber Intelligence and the Public Sector Defining the distinction between cybersecurity and cyber intelligence is a vital prerequisite for organizational maturity. Cybersecurity involves the protective practices used to ensure the confidentiality, integrity, and availability of systems.\[15, 16] Cyber intelligence, conversely, is the systematic process of acquiring, processing, analysing, and disseminating information that identifies, tracks, and predicts threats and opportunities to enhance strategic decision-making.\[17] For local government, this intelligence provides the context necessary to prioritise limited resources on the most significant threats.\[9, 18]. This is a core requirement of the NCSC (National Cyber Security Centre) CAF (Cyber Assessment Framework). #### The Intelligence Cycle as an Operational Blueprint The practice of cyber intelligence is governed by a repeatable workflow known as the Intelligence Cycle. This framework ensures that intelligence activities are purposeful and aligned with organizational needs.\[19, 20] The proposed intelligence cycle is shown in figure 1. • Direction and Planning: Identifying key information assets, comprising systems, services and data, such as the electoral register or social care portals, and defining the specific questions that need answering to protect them.\[7, 9] • Collection: Gathering raw data from internal system logs, open-source intelligence (OSINT), and shared threat feeds.\[19, 20] • Processing: Filtering, normalising, and structuring raw data into a format suitable for analysis.\[9] • Analysis: Transforming and enriching data into intelligence by identifying patterns, assessing threat actor intent, and correlating threats with local vulnerabilities.\[16, 19] • Dissemination and Feedback: Delivering actionable insights to decision-makers and using their feedback to tune and refine future requirements.\[17, 19] A significant portion of the intelligence needed by local government is available through open sources. Methodical Open-Source Intelligence (OSINT) collection—defined as the purposeful exploitation of publicly available information to fulfil an intelligence requirements which would allow councils to monitor the broader threat environment without significant financial investment.\[18, 20, 21] These core elements feed into the risk management and assurance process cycles.Figure 1: The Intelligence Cycle (Source: Author)
#### Adaptation of Military Doctrine to Municipal Cyber Defence To achieve a sophisticated level of intelligence requirement identification, local government can adapt established military frameworks, such as Intelligence Preparation of the Battlefield (IPB) or Intelligence Preparation of the Environment (IPE).\[22, 23] These doctrines provide a systematic methodology for understanding the "terrain" of a digital city and the capabilities of the "enemy".\[22, 24] These approaches are widely understood in the both the military and intelligence communities. Cyber is acknowledged to be the fifth battle domain. \[50] The current global situation is manifesting through a number of cyber operations which are affecting the UK’s Critical National Infrastructure, which includes national and local government. The UK defence strategy, talks about the whole societal approach. \[51] This in turn supports the doctrine of having a resilient civic society. \[52] #### Intelligence Preparation of the Digital Environment (IPDE) The IPDE process involves four continuous steps that, when applied to local government, provide a comprehensive understanding of the risk landscape.\[22, 23] 1\. Define the Operational Environment: Identifying and mapping, the limits of the council’s digital footprint, including third-party cloud services, Internet of Things (IoT) infrastructure in smart cities, and remote access points for staff.\[22, 25] 2\. Describe Environmental Effects: Analysing how the digital terrain influences operations. For example, how a single point of failure in a shared authentication service could impact multiple council departments.\[4, 22] 3\. Evaluate the Threat: Creating threat models for specific actors, such as ransomware groups or hacktivists, and identifying their known tactics, techniques, and procedures (TTPs).\[9, 23] 4\. Determine Threat Courses of Action (COAs): Predicting the most likely and most dangerous actions a threat actor might take, such as disrupting the council’s ability to process council tax payments during a critical financial window.\[22, 23] Once gaps in the council's knowledge of the environment and threat are identified, they become the foundation for initial intelligence requirements.\[22] This needs to be considered in conjunction with a sectoral risk assessment to develop a sectoral (Local Government) Threat Profile. #### Identification of Cyber Intelligence Requirements (CIRs) Identifying Cyber Intelligence Requirements (CIRs) is an organisational responsibility that requires collaboration across various functions, including IT, finance, social services, and legal teams.\[7, 19] Requirements should not be technical "wish lists" but should be derived from the council's strategic goals and risk appetite.\[10, 26] Priority Intelligence Requirements (PIRs) and Specific Intelligence Requirements (SIRs) A structured approach involves the hierarchy of Priority Intelligence Requirements (PIRs) and Specific Intelligence Requirements (SIRs).\[19, 27] Table 2 illustrates a couple of PIR/SIR examples. • PIRs: High-level questions that a "Senior Leader" (e.g., a Chief Executive or Senior Information Risk Owner) needs answered to make a strategic decision.\[27, 28] • SIRs: Granular, answerable questions derived from PIRs that direct the collection efforts of analysts.\[19, 29] | Requirement Type | Example for Local Government | Strategic Decision Informed | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | PIR | What is the likelihood of a state-sponsored actor disrupting local electoral systems during the 2025 cycle? \[13, 28] | Allocation of emergency capital for electoral system hardening.\[2] | | SIR | Are there active phishing campaigns targeting election officials that utilise TTPs associated with known APT groups? \[9, 19] | Implementation of targeted MFA and staff awareness training.\[7, 10] | | PIR | Which of the council's third-party cloud providers pose the greatest risk to service continuity for social care? \[26, 30] | Development of a multi-cloud strategy or exit plan for critical systems.\[4] | | SIR | Have any recent data breaches been reported by Vendor X's other public sector clients in the last 6 months? \[6, 9] | Activation of enhanced monitoring and audit of Vendor X's access logs.\[4, 31] |Table 2: Example PIRs / SIRs
Figure 2: Illustration of the Intelligence Hierarchy – (Source: Author).
#### The "Strategy House" for CTI Alignment The "Strategy House" model provides a visualisation of how cyber threat intelligence (CTI) activities support broader departmental goals.\[32] In this model, the foundation is the council’s mission (e.g., providing safe and efficient community services). The pillars represent the tactical and operational intelligence functions, while the roof represents the strategic intelligence that guides the Senior Management Team (SMT).\[28, 32] This alignment prevents "wasteful spending" by ensuring that CTI efforts are moored to business context rather than chasing irrelevant technical indicators.\[10, 32] Developing Meaningful Cyber Security Metrics Having defined intelligence requirements, local authorities must transition to quantifying their security posture through metrics that reflect outcomes rather than mere activity.\[2, 33] Traditional metrics, such as "number of firewall hits," are often insufficient as they fail to reveal whether security efforts are actually reducing risk or preparing the organization for resilience.\[33, 34] The Goal-Question-Metric (GQM) Paradigm The GQM approach is a widely recognised academic framework for developing purposeful measurements.\[35, 36] It assumes that an organization must specify goals, match those goals to operational questions, and then provide quantifiable metrics to answer those questions.\[35, 36] 1\. Conceptual Level (Goal): Defined for an object (e.g., a social care database) for a specific reason (e.g., ensuring data integrity) from a particular perspective (e.g., the Data Protection Officer).\[35, 36] 2\. Operational Level (Question): A set of questions that characterise the object of study. For example, "How frequently are unauthorised attempts to modify records detected?".\[25, 36] 3\. Quantitative Level (Metric): A set of data associated with every question. For instance, "Mean Time to Detect (MTTD) unauthorised database changes".\[2, 4] The GQM paradigm is particularly effective for municipal organizations because it allows for the "quantitatively expressed reduction of uncertainty" in complex, data-heavy environments.\[36]Figure 3: The GQM Process – (Source: Author)
| GQM Level | Example Application: Council Tax System | Rationale | | --------- | -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | Goal | Ensure the resilience of tax collection against ransomware disruption.\[35, 36] | High-priority revenue driver and essential public service.\[7, 12] | | Question | How long can the system remain offline before the impact on the council’s liquidity becomes critical? \[2, 31] | Characterizes the "acceptable loss" threshold for resilience.\[34, 37] | | Metric | Percentage of backups successfully restored within the 4-hour recovery window.\[4, 34] | Provides an objective measure of the system's ability to "withstand and recover".\[4, 34] |Table 3: Example GQM Levels and Application
Internal Efficiency vs. External Effectiveness Research into cyber security performance identifies a critical distinction between internal efficiency—how well the security function operates—and external effectiveness—how well security supports the council’s mission.\[38] • Internal Efficiency Metrics: These measure the "maturity" of IT processes, such as the percentage of systems compliant with the Minimum Cyber Security Standard, patching frequency, and the cost per incident handled.\[32, 38] These are often of moderate interest to senior leaders.\[38] • External Effectiveness Metrics: These focus on "public value" outcomes. Examples include service continuity scores for citizens, inclusion metrics to ensure vulnerable groups are protected, and the "trust level" reported by residents regarding the safety of their digital data.\[2] For local government, the strategic integration of these two dimensions is necessary to justify cyber spending not as a "back-office" cost but as a "public value proposition".\[2, 38] #### The NCSC Cyber Assessment Framework (CAF) as a Performance Enabler The UK Government has set out plans to adopt the NCSC Cyber Assessment Framework (CAF) as the primary assurance framework for public sector resilience.\[7, 31] The CAF provides a systematic approach to assessing the extent to which risks to essential functions are being managed.\[31, 39] #### Mapping the CAF to Intelligence and MetricsFigure 4: Mapping the Intelligence Process to the CAF (Source: Author)
The CAF is built on four core objectives, which can be directly mapped to the intelligence requirements and metrics discussed previously.\[7, 31] • Objective A: Managing Security Risk: Requires intelligence on organizational structure and the supply chain.\[39, 40] Metrics include the "percent of critical systems with validated system architecture diagrams".\[7] • Objective B: Protecting Against Cyber Attack: Requires tactical intelligence on TTPs.\[9, 40] Metrics include the "frequency of identity and access control reviews" and "staff awareness reporting rates".\[40, 41] • Objective C: Detecting Cyber Security Events: Requires operational intelligence on active campaigns.\[9, 40] Metrics include the "percent of anomalous activity identified by proactive security monitoring".\[4, 40] • Objective D: Minimizing the Impact of Cyber Security Incidents: Requires strategic intelligence on business continuity.\[28, 40] Metrics include the "time-to-recovery for essential functions" and the "implementation rate of lessons learned from previous incidents".\[31, 34] The CAF utilises Indicators of Good Practice (IGPs) to evaluate if outcomes are 'Achieved', 'Partially Achieved', or 'Not Achieved', providing a standardised "baseline" that local authorities must meet at specified frequencies.\[7, 31, 40] #### Advanced Resilience Metrics for Cloud-and-AI-Enabled GovTech As local authorities migrate to cloud-and-AI-enabled platforms, new vulnerabilities emerge that require specialised metrics.\[4] These platforms increase the "attack surface" and create high levels of interdependency between public systems.\[4] #### The Unified Resilience Model for GovTech A proposed resilience framework for GovTech platforms integrates technical, organizational, and legal dimensions.\[4] The proposed GovTech capability lays the foundation for the Local Government Reorganisation (LGR) work, as a number of councils will be affected by the LGR, standardised approaches which will be developed through the Cyber Technical Advisory Group (CTAG) \[49], will ensure shared learning and mitigation of key risks, especially through supply chain assurance. This starts to augment the utility of the LACES framework, \[47] through practical knowledge sharing (Phronesis). \[53] The 2026 Horizon Scanning report \[54], highlights a number of key risks, threats and vulnerabilities. The summary findings are explored later in this paper.Figure 5: The "GovTech" Concept to model Cyber Intelligence Requirements (Source: Author)
Key Performance Indicators (KPIs) in this model include: • Zero Trust Maturity: Percent of micro-segmented workloads and the frequency of continuous authentication events.\[4, 25] • AI Governance: Percent of production AI models with documented provenance and adversarial robustness test pass rates.\[4] • Privacy-Preserving Computation: Usage scores for technologies like federated learning or homomorphic encryption when handling sensitive demographic data.\[4] • Organizational Capacity: Number of full-time security staff per 100 IT staff and annual cybersecurity training hours per employee.\[4, 8] These metrics allow governments to "operationalise resilience" rather than treating it as an abstract ideal.\[4] #### The Human Element: Socio-Technical Metrics and Cultural Intelligence Cybersecurity in local government is a "socio-technical" challenge that cannot be solved by technical controls alone.\[41, 42] The "human element"—including the cognitive biases and heuristics of decision-makers—plays a critical role in resilience.\[38, 42] #### Trust and Inclusion as Security Metrics In the public sector, cybersecurity is increasingly recognised as a matter of "social justice".\[2] If digital services are not secure, vulnerable populations may be disproportionately impacted or excluded from essential services.\[2] • Trust Enabler Metrics: Tracking citizen confidence in the safety of digital services as a predictor of digital transformation success.\[2] • Inclusion Metrics: Ensuring that security measures do not create barriers for citizens with low digital literacy or those relying on older, less secure devices.\[2] Furthermore, internal "cultural intelligence" is vital. Organizations must measure the stress and burnout levels of their cyber teams, as high stress (reported by 39% of victims) and burnout (32%) lead to increased human error and higher security risk.\[6, 8] #### Implementation Strategy for UK Local Government Reorganisation (LGR) For a local authority to successfully define requirements and metrics, a collaborative governance structure is essential. This involves identifying core roles such as the CAF Lead (often a cyber security specialist) and the Approver (a senior leader like a SIRO or Head of IT).\[7] #### Resource and Time Commitment Estimates Developing a robust intelligence and measurement framework is a significant undertaking. Estimates for local government CAF implementation provide a benchmark for the level of effort required \[7]: • Preparation and Role Identification: \~45 hours.\[7] • Scoping and Critical System Identification: \~35-40 hours.\[7] • Organisational Self-Assessment (Objectives A & D): \~40 hours.\[7] • Mapping Architecture of 3 Critical Systems: \~15-25 hours per system.\[7] • Critical Systems Self-Assessment (Objectives B & C): \~60 hours per system.\[7] These time commitments reflect the shift from "tick-box" exercises to actionable resilience planning that requires engagement from directors, service leads, procurement, and risk managers.\[7] These timescales especially apply to the assurance process relating to key suppliers. The author is not aware that this is actually happening at scale and it has been identified a key priority for the CTAG 2026 work programme, to facilitate a project to define and refine a common approach for UK Local Government to follow. #### The LACES Framework: A Holistic Principles Led Approach for Local Government Building upon the necessity for a strategic and intelligence-led cybersecurity posture, the **Local Authority Cyber Eco-System (LACES)** framework offers a comprehensive model designed specifically for the complexities of the UK public sector. Developed to address the limitations of rigid, policy-driven cybersecurity measures, LACES advocates for a **principles-led approach** that is better suited to managing dynamic threats and the evolving digital landscape. This supports the notion of a resilient civic society, in a digital and cloud first world. This reflects modern statecraft, understanding “Cyber” as the fifth battle domain in a “Post rules, Disinformation & Post-Truth “ era. These issues were identified and validated during the recent Chatham House 2026 Directors Lecture. \[52] While frameworks like the NCSC’s Cyber Assessment Framework (CAF) provide assurance mechanisms, LACES bridges the gap between technical controls and organisational science, ensuring that cybersecurity is treated as a holistic business issue rather than solely a technical function. #### Core Dimensions of the LACES FrameworkFigure 6: LACES Framework (Source: Author)
The framework is structured around six interconnected variables that function as a cohesive ecosystem. These variables can be viewed through a "variable-centric" lens, allowing organisations to shift focus depending on the operational context while maintaining a holistic view. 1. **Governance:** This provides the overarching oversight and direction for the ecosystem. It involves establishing clear policies, risk appetite, and structures such as a Corporate Information Governance Group (CIGG) and Senior Information Risk Owner (SIRO) to ensure cybersecurity is integrated into strategic decision-making. 2. **Assurance:** This dimension validates the effectiveness of security controls and manages risk, including supply chain vulnerabilities. It moves beyond "tick-box" compliance to a robust assessment of threats and vulnerabilities, often utilising mechanisms like penetration testing and health checks. 3. **Processes:** This covers the workflows, systems, and procedures (both manual and automated) used to deliver services. It recognises that processes bridge the physical and digital domains and must be documented and managed to ensure secure data transfer and operational integrity. 4. **Data:** Considered the "life blood" of local authorities, this variable focuses on the protection, management, and governance of information throughout its lifecycle—from creation to destruction. It emphasises the confidentiality, integrity, and availability of data in compliance with regulations like GDPR. 5. **Resilience:** Going beyond protection, this focuses on the ability to withstand, respond to, and recover from incidents. It includes business continuity planning, disaster recovery, and the implementation of "break glass" policies to restore critical services during disruptions. 6. **Knowledge Sharing:** This is the critical enabler of the ecosystem. It emphasises collaboration, peer support, and the exchange of "phronesis" (practical wisdom) through networks such as Warning, Advice and Reporting Points (WARPs) and the Cyber Technical Advisory Group (CTAG). This feedback loop ensures continuous improvement and situational awareness across the sector. #### Integration of Physical and Digital Domains A distinct feature of the LACES framework is its recognition that the cyber ecosystem exists simultaneously in **physical** and **digital** domains. * **Physical Domain (Place-based):** Includes organisational structures, hierarchies, physical security measures, personnel, and culture. * **Digital Domain (Process-based):** Encompasses the intangible aspects such as software, data flows, logic, and virtual cloud-based information. LACES encourages decision-makers to map these domains against the six variables. For example, under **Governance**, the physical domain might involve physical security audits and meeting locations for incident response, while the digital domain involves data protection policies and risk appetite statements. #### Integrating LACES into Cyber Strategy The LACES framework can be integrated into a local authority's cyber strategy to shift from a reactive compliance posture to a proactive, principles-led culture: * **Strategic Alignment and Education:** LACES serves as an educational tool to help non-technical senior leaders (such as CEOs and elected members) conceptualise cybersecurity as a complex ecosystem rather than a niche IT problem. By presenting the six variables, leaders can better understand resource allocation needs across the organisation. * **Complementing the CAF:** While the NCSC Cyber Assessment Framework (CAF) focuses on resilience and assurance, LACES provides the broader organisational context required to implement the CAF effectively. The six variables of LACES can be mapped directly to CAF objectives (e.g., LACES "Governance" aligns with CAF Objective A: Managing Security Risk), ensuring that compliance efforts are supported by robust organisational structures. * **Operational Planning and Incident Response:** LACES can be used to structure incident response playbooks. For instance, during a Distributed Denial of Service (DDoS) attack, the framework guides the response by prompting specific actions across all variables—from invoking **Governance** protocols for communication to executing **Resilience** plans for service continuity and engaging in **Knowledge Sharing** with external bodies such as the regional warps and CTAG. . * **Supply Chain Management:** In an era of cloud-first strategies and Zero Trust architectures, LACES assists in managing supply chain risks by ensuring that **Assurance** and **Governance** extends to third-party vendors and Software-as-a-Service (SaaS) providers, who are often outside direct control. By adopting LACES, local authorities can standardise their approach, foster a culture of collaboration, and build a cyber posture that is resilient enough to adapt to emerging technologies like Artificial Intelligence and the evolving threat landscape. #### Cyber Threat Horizon Scanning in 2026Figure 7: Horizon Scanning Summary Threats (Source: Author)
Introduction: The Tipping Point As local government bodies refine their cyber intelligence capabilities, they must align their requirements not just with current threats, but with a rapidly solidifying "New Order" of geopolitical instability and technological acceleration. Horizon scanning indicates that by 2026, cybersecurity will transition from a niche technical concern to a fundamental pillar of organisational survival. The landscape is no longer defined merely by isolated malware incidents but by a professionalised, adaptive industry that exploits human trust and systemic fragility. Consequently, the identification of Cyber Intelligence Requirements (CIRs) must pivot to address a world where access to "compute"—the physical technologies and talent required to process data—has become a defining geopolitical risk. The 2026 Threat Landscape: Deception and Speed To develop effective Priority Intelligence Requirements (PIRs), decision-makers must understand the five core trends expected to dominate the risk landscape: 1. AI-Driven Deception: Generative AI has enabled a new era of social engineering. Attackers now utilise "deceptive realism" to create hyper-realistic deepfakes of executives and suppliers. Intelligence requirements must specifically task analysts with monitoring for synthetic voice and video indicators that could facilitate fraud or reputational damage. 2. Machine-Speed Attacks: Adaptive malware is now capable of rewriting itself to bypass detection at speeds that outpace human-led security teams. This necessitates a shift in metrics from "time to respond" to "automation readiness" and the deployment of Managed Detection and Response (MDR) capabilities. 3. The Supply Chain as a Weapon: The "domino effect" has become a primary attack vector, where smaller, less protected vendors are breached to gain entry into major organisations. With only 14% of UK businesses currently reviewing supplier security, intelligence collection must expand to include the risk posture of the entire vendor ecosystem. 4. Triple Extortion: The threat of ransomware has evolved into multi-vector extortion, combining data encryption with theft, client harassment, and regulatory pressure. 5. OT and IoT Exposure: The push for internet connectivity into legacy Operational Technology (OT) and Internet of Things (IoT) devices has expanded the attack surface into physical infrastructure, creating pivot points for attackers to enter critical systems. The Actor Profile: Proxies and Activated Societies The distinction between state-sponsored espionage and financial cybercrime is collapsing. Hostile states increasingly use networked criminal groups as "deniable proxies" to execute sabotage and intelligence gathering. Furthermore, local authorities face a new threat from "activated societies"—groups animated by social and political grievances who may utilise cyber tactics to target institutions they perceive as unaccountable. This includes "wild card" individuals radicalised by algorithmic echo chambers, escalating the risk of insider threats and physical-digital hybrid attacks. Strategic Imperatives for Resilience Navigating this landscape requires a fundamental shift in governance and operational posture: * Fiduciary Duty: Cybersecurity failure is now viewed as a failure of corporate governance. Boards must treat cyber resilience as a standing agenda item and a fiduciary duty, with Directors and Officers facing personal accountability for negligence. * Zero Trust Architecture: The assumption that internal networks are safe is obsolete. Organisations must implement a "Zero Trust" baseline, requiring continuous verification of every user and device. · The "Golden Hour": Response planning must move from static documents to dynamic playbooks. The "Golden Hour" framework should be used to define critical first actions, empowering teams to make pre-authorised decisions during the onset of a crisis, through the use of break glass policies. \[53] Applying the LACES Framework to Future Threats The Local Authority Cyber Eco-System (LACES) framework remains the primary vehicle for managing these emerging risks, offering a holistic bridge between technical controls and organisational strategy. * Governance & Assurance: To counter supply chain weaponisation, LACES mandates a move beyond "tick-box" questionnaires to continuous assurance. This includes requiring a Software Bill of Materials (SBOM) from critical vendors and establishing "right to audit" clauses. Governance structures must also address the "human in the loop" mandate for AI-driven decisions to prevent automated errors. * Knowledge Sharing: In the face of "deceptive realism," formal policy updates are too slow. LACES emphasises the exchange of "Phronesis" (practical wisdom) through networks like Warning, Advice and Reporting Points (WARPs) to keep pace with rapidly evolving social engineering tactics. * Resilience & Processes: To manage machine-speed attacks, LACES advocates for "Agile Assurance" and "Break Glass" policies. These protocols allow for the immediate isolation of compromised cloud segments or API credentials before a board meeting can be convened, preventing systemic failure. * Data: With the rise of "triple extortion," the focus shifts to protecting the "enterprise knowledge fabric." This involves conducting Data Protection Impact Assessments (DPIAs) for all AI systems to ensure compliance and mitigate risks associated with large language models. #### Operationalising Cyber Intelligence: From Horizon Scanning to CAF Compliance **Introduction: Intelligence in the "New Order"** As the local government sector moves toward 2026, the threat landscape is defined by a volatile "New Order" characterized by the "War for Compute" and the weaponisation of trust. Horizon scanning indicates that cybersecurity has transitioned from a niche technical concern to a fundamental pillar of organisational survival, where failure is viewed as a breach of corporate governance. To navigate this, local authorities must move beyond static defence to a dynamic, intelligence-led posture. This chapter demonstrates how to apply the Intelligence Cycle to the specific threats identified in the 2026 landscape—such as AI-driven deception and supply chain contagion—and maps this process directly to the NCSC Cyber Assessment Framework (CAF). This is summarised in figure 8. **The Intelligence Cycle in the 2026 Landscape** The Intelligence Cycle provides the operational blueprint for transforming raw data regarding the 2026 threat landscape into actionable resilience strategies. 1. **Direction (Requirements):** This phase translates the organisation's strategic risks into Priority Intelligence Requirements (PIRs). In the context of 2026, PIRs must pivot to address "deceptive realism"—the use of AI to create hyper-realistic deepfakes—and the "domino effect" of supply chain breaches. 2. **Collection:** This involves gathering data to answer the PIRs. In a "Zero Trust" era, collection must extend beyond internal logs to include Real-time Software Bill of Materials (SBOMs) from vendors and "phronesis" (practical wisdom) shared through Warning, Advice and Reporting Points (WARPs). 3. **Processing & Analysis:** Raw data is converted into intelligence. Analysts must now filter for "machine-speed" indicators, as adaptive malware can rewrite itself to bypass traditional detection. 4. **Dissemination & Feedback:** Intelligence is delivered to decision-makers (e.g., the SIRO) to trigger "Golden Hour" responses or inform long-term strategy.Figure 8: Integrated Intelligence Cycle (Source: Author)
**Worked Example:** **The "Domino Effect" Supply Chain Attack** The following example illustrates how a local authority applies the Intelligence Cycle to a specific 2026 threat scenario, utilizing the LACES framework to contextualise the response and the CAF to measure compliance. **Scenario:** Horizon scanning identifies a high probability of "Triple Extortion" attacks where threat actors compromise minor vendors to gain entry into major public sector networks. **Step 1: Direction (Defining the Requirement)** The Chief Executive and SIRO establish a **Priority Intelligence Requirement (PIR):** *Which third-party suppliers possess high-level API access to critical council data and exhibit vulnerability to AI-driven social engineering?*. * **CAF Alignment:** This fulfils **Objective A (Managing Security Risk)**, specifically Principle A2 (Risk Management), by identifying risks to essential functions. **Step 2: Collection (Gathering the Data)** The cyber intelligence team initiates collection: * **Internal:** Mapping the "Information Asset Ecosystem" to identify all vendors with API integration. * **External:** Requesting real-time Software Bill of Materials (SBOMs) from top-tier vendors. * **Human Intelligence:** Monitoring WARP feeds for reports of "Vishing / Deep Fakes / Phishing" attacks targeting specific sectors (e.g., adult social care software providers). **Step 3: Analysis (Correlating the Threat)** Analysts correlate the collected data. They identify that "Vendor X," a payroll provider, uses a legacy authentication method vulnerable to AI-enhanced phishing and has recently reported a breach in a different region. * **Risk Assessment:** The analysis confirms a high likelihood of a "domino effect" breach where Vendor X becomes a pivot point for "machine-speed" lateral movement into the council’s network. * **CAF Alignment:** This supports **Objective C (Detecting Cyber Security Events)**, specifically C1 (Security Monitoring), by moving from reactive logging to proactive threat identification. **Step 4: Dissemination (Triggering the Response)** The intelligence is disseminated to the Crisis Management Team (CMT) with a clear assessment: *Imminent risk of supply chain compromise via Vendor X.* * **Action:** The SIRO invokes the **"Golden Hour"** guide. The specific "Break Glass" policy is authorised, permitting the immediate revocation of Vendor X’s API credentials before a formal board meeting can convene. **Step 5: Operationalising via CAF and LACES** The intelligence cycle concludes by cementing the response into the organisation’s assurance framework. Table 4 provides some example linkages. | CAF Objective | Intelligence-Led Action (2026 Context) | LACES Variable Applied | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | | **A: Managing Security Risk** | **Action:** Mandate "Right to Audit" clauses and SBOMs for all top 10 suppliers, moving beyond "tick-box" questionnaires. **Outcome:** Governance structures acknowledge supply chain fragility as a fiduciary duty. | **Governance & Assurance:** Ensuring oversight extends to third parties. | | **B: Protecting Against Attack** | **Action:** Implement a "Zero Trust" baseline. Enforce multi-person approval for financial transactions to counter deepfake (deceptive realism) fraud. **Outcome:**Hardening the attack surface against AI-driven social engineering. | **Processes & Data:** Bridging physical checks with digital zero-trust protocols. | | **C: Detecting Events** | **Action:** Deploy Managed Detection and Response (MDR) to counter "machine-speed" attacks that outpace human monitoring. **Outcome:** Transitioning from "time to respond" to "automation readiness" metrics. | **Assurance:** Validating controls against adaptive threats. | | **D: Minimising Impact** | **Action:** Rehearse "Rising Tide" scenarios using dynamic playbooks rather than static plans. Establish "Crash Gate" triggers for rapid escalation. **Outcome:**Ensuring "graceful degradation" of services rather than systemic collapse. | **Resilience:** Planning for recovery and continuity. |Table 4 CAF Linkages to LACES (Source: Author)
#### #### #### Conclusion #### Toward an Intelligence-Led Resilience Model to support civic society The path toward cyber resilience in UK local government requires the strategic integration of intelligence requirement identification and meaningful performance quantification. By adopting established academic and professional frameworks—such as the GQM paradigm, the NCSC CAF, and military-derived IPDE processes—local authorities can move beyond a reactive posture.\[22, 31, 36] Intelligence requirements must be become one foundational organisational goals, recognised as a corporate information risk. Every collection and analysis effort directly supports the continuity of essential public services.\[10, 32] Simultaneously, metrics must transition from measuring technical activity to measuring mission-centric outcomes, public value, and the "trust" that underpins the digital social contract between the state and its citizens.\[2, 4] This aspect of statecraft matters and supports a resilient civic society. Once a discovery process has been carried out and common local government intelligence requirements have been identified, they can the standardised, documented and shared as a polled data base of common risks, threats and vulnerabilities, affecting all UK local authorities. This artefact would be of great use as part of the LGR process and in turn support the effective managed of supply chain risk, an idented key threat to all local authorities and indeed, the wider public sector. Such a database of key threats, risks and vulnerabilities could be maintained nationally through a community peer support group such as CTAG. This also wholly supports the LACES Information and Knowledge Sharing approach. As local governments navigate the "paradox" of adopting emerging technologies while managing legacy risks, the ability to "quantify what matters" will distinguish resilient organizations from those perpetually reacting to the latest crisis.\[8, 33] The ultimate goal is to reshape cybersecurity from a "necessary cost centre" into a strategic transformation enabler of speed, scale, and safety for the digital public square.\[2] The World Economic Forum 2026 horizon scanning demands that local authorities and others transition from a posture of protection to one of resilience.\[55] This was a key message from the NCSC CyberUK 2026 conference. By integrating the LACES framework with the NCSC’s Cyber Assessment Framework (CAF), organisations can operationalise their intelligence requirements, turning abstract threats into manageable business risks. Whilst we cannot prevent cyber-attacks, careful planning and a intelligence led approach to threats, can help towards mitigating the impacts locally on what is likely to remain in the Cyber battle domain, a volatile world stage.