Digital and Cyber

A fire and rescue service must:

1. Maintain a continually evolving strategy for implementing and managing ICT to achieve its organisational objectives.
2. Know what its information and Digital assets are and publish policies and procedures that protect those assets, including, but not limited to:
   1. Protection from and response to Cyber Security threats
   2. Lifecycle management for ICT services and assets, aligned to the Procurement and Commercial Fire Standard where appropriate
   3. Acceptable use expectations and obligations
   4. Major incident management and disaster recovery
   5. Procurement and supplier management, aligned to the Procurement and Commercial Management Fire Standard where appropriate
3. Understand its Digital and Cyber Security related risks and put in place controls to manage them, demonstrating good practice in Cyber Security that meets or exceeds nationally accepted baselines.
4. Ensure that effective organisational security management is led at board level.
5. Align to a Cyber Security framework as directed by Government, following guidance and tools including relevant Cyber Security tools provided by the National Cyber Security Centre (NCSC).
6. Deploy and actively maintain security toolsets to safeguard sensitive data, prevent security incidents and ensure the integrity of production status technology, that include at a minimum:
   1. Endpoint detection and response
   2. Secure infrastructure, including firewalls, storage and networks
   3. Multi factor authentication
   4. Privileged identity management
   5. Encrypted transmission (information and communications) where necessary
   6. Assured security where third parties supply elements of ICT service, e.g. software/platform/infrastructure-as-a-service, outsourced infrastructure or desktop management
7. Identify and implement information and communications technologies which support and enhance emergency response capabilities.
8. Deploy mobilisation and incident management solutions that provide efficient co-ordination, communication and resource allocation during emergencies.
9. Provide solutions to connect Employees to the information they require to effectively and efficiently undertake their roles, e.g. 4G/5G, wide area networks, local area networks.
10. Provide solutions to connect Employees to each other, and to other agencies when required, for effective and efficient voice and data communications as part of their roles.
11. Continually assess security threats and controls to identify vulnerabilities, assess risks and control measures, and implement corrective measures when necessary to maintain or reinstate uncompromised ICT services.
12. Ensure the whole organisation is prepared to continue its essential operations in the event of ICT Solution or service failures.
13. Effectively recover its use of ICT solutions or services in the aftermath of a failure, to agreed timescales appropriate to criticality, and periodically exercise such failures, thereafter, applying lessons learnt.
14. Ensure all appropriate information assets are backed up and that backups are secure and encrypted.
15. Demonstrate continual development of Digital skill to the standard determined necessary for people in their workforce to conduct their duties well.
16. Ensure sufficient ICT skills and roles are available to it, irrespective of governance and delivery model. These skills include but are not limited to:
    1. Technology strategy and ICT service design
    2. Information and infrastructure security
    3. Availability and service continuity management
    4. Fixed and mobile networks management
    5. ICT asset and device management
    6. Management of changes, problems, incidents and service requests
17. Deliver inclusive and accessible ICT solutions and toolsets, recognising that each workforce and community has different and diverse needs.
18. Engage across the organisation to ensure the ICT needs for the whole service are met.
19. Understand the reliance the service places on ICT in the delivery of its statutory duties and provide strategic investment that enables sustainable technology service provision.
20. Establish clear data governance policies about the responsible and compliant handling of sensitive information held in the service’s information and communication technologies, aligning these policies with the requirements of the Data Management Fire Standard and NFCC Data Management Framework.

A fire and rescue service should:

21. Adopt Government provided or advocated ICT and Cyber Security solutions when:
    1. Clear benefits for doing so can be articulated, and
    2. Existing solutions reach the end of their contracted period.
22. When appropriate, and likely to deliver better outcomes for communities and people, collaborate with stakeholders and similar organisations to deliver solutions.
23. Evaluate the ICT services it relies on to ensure the technological solutions and infrastructure remain fit for purpose, and that ICT practices are operated in line with service expectations.
24. Stay informed about emerging technologies and use cases, so that ICT strategy, solutions and processes evolve appropriately, and investment is forward planned.
25. Invest in research or innovation to deliver improved ICT solutions or to improve effectiveness and efficiency within existing ICT solutions.
26. In the interest of cost avoidance and to increase productivity, prevent the use of multiple solutions with duplicated functionality or outcomes, except where an alternative Solution is provided to deliver specific requirements, such as enabling accessibility.

A fire and rescue service may:

27. Align its ICT services to ITIL®4 practices or similar recognised best practice frameworks, proportionately implemented in line with the needs of the service.
28. Maintain professional ICT delivery by investing in continued professional development through membership of relevant recognised professional bodies.
29. Work with accreditation bodies or agencies to raise the standards of its ICT delivery and that of its supply chain.

1. Decreased risk of data breach or data loss
2. Enhanced professionalism and improved competence
3. Statutory duties are underpinned by technology to deliver improved safety, health and wellbeing of communities
4. Improved quality of service provided to the public
5. Improved trust in and reputation of the service
6. Greater regional and national collaboration leading to increased consistency and reduced organisational risk
7. A more positive working culture generated

This Fire Standard reflects only the most appropriate legislation to this topic. We recognise that fire and rescue services must comply with a broader list of legislation to undertake their duties, which would be applicable to all standards. View the legislation which applies to all Fire Standards.

Some of the of the most pertinent legislation to this Fire Standard can be found below:

• Data Protection Act
• General Data Protection Regulation
• Freedom of Information Act
• Environmental Information Regulations

All Fire Standards work together and should be viewed as a suite. Those listed below are especially relevant to consider alongside this Fire Standard, however all Fire Standards are likely to have relevance.

• Communications and Engagement
• Data Management
• Emergency, Preparedness and Resilience
• Fire Control
• Operational Preparedness

Accreditations:

Services should be working towards achieving a Cyber Security framework; however, the below accreditations support an approach to protecting organisations against cyber threat, these include, but are not limited to:

• Cyber Essentials / Cyber Essentials Plus
• ISO 27001

We recognise that fire and rescue services must comply with a broader list of legislation (as amended from time to time) to undertake their duties, which would be applicable to all standards. View the key pieces of legislation which applies to all fire standards.

National Protective Security Authority guidance:

• Security-Minded approach to Digital Engineering 
• Security-Minded approach to Open and Shared Data
• Triage Process – For Publication or Disclosure of Information 
• Digitalisation Initiatives – Establishing High-Level Information Need and Management Requirements
• Developing a Security-Mindedness Approach

Other relevant guidance:

• Secure By Design
• Active Cyber Defence (ACD)
• Cyber Assessment Framework (CAF)
• Web Content Accessibility Guidelines (WCAG) 2.2
• Understanding Accessibility Guidance
• Supply Chain
• Privacy and Electronic Communications Regulations Guidance
• Information Commissioners Office Security Guidance