The Cabinet Member for Organisation & Workforce was scheduled to consider a series of policy updates related to employment and digital security. These were scheduled to include a revised probationary policy, and updated policies on cyber and information security, internet usage and monitoring, portable device usage, and the Bring Your Own Device (BYOD) scheme.

Revised Probationary Policy

The Cabinet Member for Organisation & Workforce was scheduled to consider a revised probationary policy. This policy was intended to address forthcoming changes to employment legislation arising from the Employment Rights Act 2025, which was scheduled to come into effect on 1 January 2027. A key change highlighted was the reduction in the qualifying period for an employee to claim ordinary unfair dismissal from two years to six months of continuous service. The report pack indicated that the revised policy was scheduled to aim to strengthen the management of probationary periods by clarifying managers' responsibilities, ensuring regular review meetings, requiring better record-keeping, and providing clearer guidance on extending probation where performance measures were not met. The reasons for the revision were to reduce the increased risks of unfair dismissal claims.

Cyber and Information Security Policy

The meeting was scheduled to review and endorse an updated Cyber and Information Security Policy. This policy was designed to safeguard the confidentiality, integrity, and availability of Carmarthenshire County Council's information assets. Key changes from the previous 2018 policy were scheduled to include the formal establishment of this policy as the Council's Acceptable Use Policy (AUP), its integration with a broader suite of related policies, enhanced asset management and device controls, expanded responsibilities, and mandatory training. The updated policy was also scheduled to address the use of Generative AI tools, adopt a Zero Trust approach to cyber security, and include detailed approval processes for access and monitoring. Furthermore, it was intended to strengthen supply chain and third-party risk management. The reasons for the revision were to ensure the Council's information security framework remained robust, up-to-date, and responsive to the evolving threat landscape, and to comply with statutory and regulatory requirements.

Internet Usage and Monitoring Policy

The Cabinet Member for Organisation & Workforce was scheduled to review and approve a revised Internet Usage and Monitoring Policy. The existing policy, approved in 2015, was scheduled for revision to ensure its continued relevance and to strengthen cyber security and monitoring protocols. The updated policy was intended to reflect modern working practices, including remote and hybrid working, and to align with current legislation such as the UK GDPR and the Online Safety Act 2024. It was also scheduled to provide greater transparency regarding monitoring activities, clarify authorisation routes for accessing monitoring logs, and reinforce the principles of proportionality and necessity. The reasons for the revision were to reflect modern working practices, strengthen cyber resilience, and ensure legal compliance and transparency.

Portable Device Usage Policy

A revised Portable Device Usage Policy was scheduled for review. This policy was intended to set out the Council's framework for the secure and appropriate use of portable and mobile devices that connect to Council systems or handle Council data. The revision aimed to ensure the policy remained fit for purpose for current working practices, strengthen cyber and information security governance, and clearly distinguish between Corporate-Owned Devices (COD) and Bring Your Own Device (BYOD) arrangements. A key proposed change was the introduction of a defined approval process for the use of portable devices outside the United Kingdom, reflecting data protection, security, and risk considerations. The policy was also scheduled to align with the Council's Cyber & Information Security Policy and related governance controls.

Bring Your Own Device (BYOD) Policy

The Cabinet Member for Organisation & Workforce was scheduled to review and approve a revised Bring Your Own Device (BYOD) Policy. This policy was designed to set out the Council's framework for the secure and appropriate use of personally owned smartphones and tablets to access Council systems and information. The revised policy was intended to strengthen governance, clarify responsibilities, and introduce a clearer approval process. It was positioned as a supporting policy within the Council's cyber and information security framework, aligning with the overarching Cyber & Information Security Policy. Key updates were scheduled to clarify the purpose and scope of BYOD, strengthen device controls and user responsibilities, and introduce clearer approval arrangements, particularly for overseas access. The reasons for the revision were to ensure the policy remained fit for purpose for current working practices and to support the Council's wider cyber resilience approach.