Decision

(i)                That approval is given for GMPF to procure cyber security detection and response services from a specialist partner to be in place by the end of the existing contract to avoid a lapse in support.

(ii)             GMPF has had a contract in place for Cyber Incident Response services since October 2022.  This will expire in October 2026, so a replacement contract is required to ensure continuity of service in this area. In addition to this the scope of services being procured will be expanded to include a greater suite of products and services to offer a more robust cyber security defence posture.

(iii)           An increase in budget for risk management of £220,000 per annum is approved to fund these additional services.

Reasons for the decision

GMPF operates a dedicated IT function, independent of the Council’s centralised IT service. Unlike the Council, which has a dedicated cyber security function, GMPF does not have defined cyber security roles with cyber security responsibilities being shared across the IT team.

In October 2022, GMPF entered into a contract with an external partner to provide cyber incident response support. This contract is coming to an end in October 2026.

GMPF recognises the increasing risks associated with cyber security and is seeking to enhance cyber resilience, threat detection and accelerate incident response capabilities.

Given the increasingly hostile cyber threat landscape, evolving technologies, and heightened regulatory expectations, GMPF recognises that the implementation of cyber security tooling alone is insufficient. Without dedicated resources to monitor and respond to threats on a 24/7 basis, the Fund remains exposed, particularly outside standard working hours, when many cyber incidents occur.

To address this risk, GMPF is seeking a managed security service capable of delivering continuous monitoring, analysis, investigation and response solutions.

Market research has been undertaken in the form of a Request for Information to gather input into the proposed specification, and an indication of likely costs. Estimated costings varied quite significantly between suppliers, however, so did the services they could provide in this field. Having reviewed the responses an estimated annual budget of £300,000 has been set. 

Alternative options considered

Option 1: Do nothing and allow the existing contract to expire. This will result in the Fund having no support available should a cyber incident occur, so support would have to be procured at the time, significantly increasing the risk of loss due to delayed detection and response to a cyber threat/incident.

Option 2: Obtain cyber defence tooling without the input of a partner. Whilst this would be a cheaper alternative, as explained in the section above, there is not adequate resource within the GMPF team to effectively monitor them, so their efficacy would be limited.