Scottish Government updates national cyber resilience framework

The Scottish Government has today issued a refresh of its Strategic Framework for a Cyber Resilient Scotland. 

In the face of an ever-changing cyber threat landscape, it builds on progress to date and addresses ongoing and new challenges in the cyber and digital world, ensuring Scotland thrives by being a digitally secure and resilient nation.

https://www.gov.scot/publications/strategic-framework-cyber-resilient-scotland-2025-2030

David Ferbrache OBE, managing director at Beyond Blue, commented in response to the news:

“Scotland is leading the way in the UK with its updated cyber resilience framework.

As the framework notes, major cyber attacks are no longer an outlier, they are becoming the norm, directly impacting Scotland’s economy, its public services and its citizens.

It’s essential the country’s cyber defences and resilience efforts keep pace.

What really stands out about the framework is Scotland’s recognition of the importance of community collaboration to meet its objectives. 

The framework lays out how SC3, Police Scotland, the NCSC, the National Cyber Resilience Advisory Board and CyberScotland will work together to collaborate on resilience efforts, track and analyse threats, prevent crimes, coordinate incident response, drive awareness and support victims of crime.

This is clear recognition that national cyber resilience is a community effort, it can’t be achieved by working in silos.

The framework also sets out seven bold outcomes to drive a more resilient nation.

Among the seven key steps, there is a focus on ensuring digital public services are cyber resilient, and the effective management of cyber risks in public sector organisations. These are vital objectives, however, in practice, these services do not operate in isolation. 

The framework itself acknowledges that Scotland’s digital public services are deeply interconnected with the third sector, which comprises around 46,000 organisations delivering vital support in areas such as health, social care, and education.

This interdependence presents a significant challenge: while some services clearly fall within the scope of Critical National Infrastructure, many others do not, yet when outages or cyber attacks occur, the impacts can be cascading.

As we drive for greater accessibility and interconnectedness, we must also recognise that this increases the complexity of building resilience. 

To establish true resilience in an ever more interconnected world,  this requires more than mere awareness; substantial investment and strong leadership are essential.

Overall, the primary goal must be to ensure that the ambitions of the framework are achieved not only within public services, but across the entire ecosystem of organisations we depend on. 

While the framework rightly focuses on security professionals, tooling and technology alone are not enough.

The greatest impact will come from boards and leaders in all sectors actively acknowledging and managing these risks and prioritising their own resilience.”