Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²¹⁄₂₂

Cyber Secur­ity Review

April 2022

---

Page 1

(Image of logo and cov­er page)

A AZETS

CAIRNGORMS NATION­AL PARK AUTHORITY Audit & Risk Com­mit­tee Paper 2 Annex I 27/05/22

Cairngorms Nation­al Park Authority Intern­al Audit Report ²⁰²¹⁄₂₂ Cyber Secur­ity Review April 2022

---

Page 3

Cairngorms Nation­al Park Authority Intern­al Audit Report ²⁰²¹⁄₂₂ Cyber Secur­ity Review

Sec­tion	Page
Exec­ut­ive Summary	1
Man­age­ment Action Plan	4
Appendix A – Definitions	8

Audit Spon­sor	Key Con­tacts	Audit team
Dav­id Camer­on- Dir­ect­or of Cor­por­ate Services	Sandy Allan- Inform­a­tion Sys­tems Man­ager Daniel Ral­ph- Fin­ance Manager	Paul Kelly- IT Audit Dir­ect­or Ash­ley Bick­er­staff- IT Audit Man­ager Domin­ic O’Neill- IT Aud­it­or Nata­sha Wil­li­ams- IT Auditor

---

Page 5

Exec­ut­ive Summary

Con­clu­sion

Our review of the CNPA’s cyber secur­ity risk man­age­ment found that improve­ments could be made to enhance the organisation’s abil­ity to man­age and handle cyber-related events. The organ­isa­tion would bene­fit from estab­lish­ing a more form­al­ised and struc­tured approach to the man­age­ment of lower-level cyber-related risks. The organ­isa­tion would also bene­fit from form­al­ising the pro­ced­ures that should be fol­lowed when a cyber-related event occurs.

Our review has also iden­ti­fied that although cyber secur­ity train­ing is in place, the com­ple­tion rate of this is low with 58% of staff com­plet­ing this.

Back­ground and Scope

Cyber secur­ity rep­res­ents a sig­ni­fic­ant risk to the major­ity of pub­lic bod­ies, with the risk hav­ing increased dur­ing the Cov­id-19 pandemic.

It is import­ant that organ­isa­tions have well-defined approaches in place to min­im­ise risks asso­ci­ated with tech­nic­al, policy, and beha­vi­our­al ele­ments of cyber security.

The Cairngorms Nation­al Park Author­ity (CNPA) is going through a sig­ni­fic­ant change pro­cess in rela­tion to cyber secur­ity with invest­ment in cyber secur­ity defences.

Our review has sought to con­firm that the CNPA has adequate meas­ures in place for cyber secur­ity and that the strategy for man­aging cyber secur­ity risks is aligned to lead­ing practice.

---

Page 6

Con­trol Assessment

(Image of a four-part chart with Amber and Yel­low indicators)

1. There are adequate tech­nic­al con­trols in place to pro­tect the cor­por­ate net­work from cyber secur­ity threats.
2. There is adequate cyber secur­ity train­ing and aware­ness for staff and third parties.
3. There are defined pro­cesses for iden­ti­fic­a­tion, record­ing, and man­age­ment of cyber secur­ity risks.
4. The pro­posed stra­tegic approach to man­aging cyber secur­ity risk is aligned to lead­ing practice.

Improve­ment Actions by Type and Priority

(Image of a bar chart show­ing improve­ment actions by grade)

Three improve­ment actions have been iden­ti­fied from this review, all of which relate to the design of con­trols them­selves. See Appendix A for defin­i­tions of col­our coding.

---

Page 7

Key Find­ings

Areas for Improvement

We have iden­ti­fied areas for improve­ment which, if addressed, would strengthen CNPA’s con­trol frame­work. These include:

• There is a react­ive approach to man­aging cyber secur­ity risks. There are two high-level cyber-related risks on the Stra­tegic Risk Register, but there is no lower-level man­age­ment of cyber-related risks.
• Train­ing in rela­tion to cyber secur­ity is in place; how­ever, com­ple­tion is low with 58% com­plet­ing the course.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Page 8

Man­age­ment Action Plan

Con­trol Object­ive 1: There are adequate tech­nic­al con­trols in place to pro­tect the cor­por­ate net­work from cyber secur­ity threats.

1.1 Pro­ced­ures and testing

Yel­low

Our high-level review in this area iden­ti­fied that CNPA has imple­men­ted tech­nic­al solu­tions that assist in the mit­ig­a­tion and pro­tec­tion against cyber threats. Solu­tions have been imple­men­ted at a net­work and a device level. Fire­walls are in place with the sup­port of a third party for main­ten­ance. Anti-vir­us is also in place, which scans and updates reg­u­larly. A log­ging solu­tion has been intro­duced to enhance the abil­ity to under­stand what has happened in the event of an attack.

How­ever, we found that while there are defens­ive meas­ures in place, the cur­rent approach to cyber secur­ity is react­ive in nature. A form­al cyber secur­ity incid­ent response plan is not in place to sup­port the response to and man­age­ment of ser­vice con­tinu­ity in the event of an incident.

Risk

Without tested pro­ced­ures to handle a cyber event, there is an increased risk of a suc­cess­ful cyber event lead­ing to down­time, repu­ta­tion, and fin­an­cial damage.

Recom­mend­a­tion

We recom­mend that CNPA estab­lish pro­ced­ures for hand­ling cyber secur­ity events. These pro­ced­ures may take the form of play­books that spe­cific­ally detail which actions should be taken in the event of a cyber attack. We also recom­mend that fol­low­ing the devel­op­ment of the pro­ced­ures CNPA should test the pro­ced­ures to con­firm that they enable an effect­ive and effi­cient response to an event. We also recom­mend that man­age­ment reg­u­larly reviews its tech­nic­al cyber­se­cur­ity pos­ture. This should include ongo­ing assess­ment of the adequacy of tech­nic­al solu­tions as well as their con­fig­ur­a­tion to ensure that secur­ity risk from intern­al and extern­al threats is minimised.

Man­age­ment Action	Grade 2 (Design)
Recom­mend­a­tion accepted
Action own­er: Inform­a­tion Sys­tems Manager	Due date: 31 Decem­ber 2022

---

Page 9

Con­trol Object­ive 2: There is adequate cyber secur­ity train­ing and aware­ness for staff and third parties.

2.1 Cyber Secur­ity Train­ing and Awareness

Amber

CNPA has staff cyber secur­ity train­ing in place. This makes use of the UK Nation­al Parks Elec­tron­ic Learn­ing Man­age­ment Sys­tem (ELMS). As part of the man­dat­ory train­ing courses, cyber secur­ity, data secur­ity, and data pro­tec­tion courses are included.

Com­ple­tion of the man­dat­ory train­ing courses is low with­in CNPA. The cyber secur­ity train­ing course has 69 act­ive staff enrolled, of which 40 (58%) have com­pleted the course. There is no pro­cess estab­lished to mon­it­or the com­ple­tion of the man­dat­ory train­ing courses.

The train­ing is not refreshed, with the cyber secur­ity train­ing course launched in Feb­ru­ary 2018 with no require­ment for staff to refresh the training.

We also iden­ti­fied that CNPA has not yet cre­ated an ongo­ing cam­paign of staff aware­ness to rein­force the train­ing and to peri­od­ic­ally provide updates on risks.

Risk

Without adequate train­ing and aware­ness, there is a risk that staff will not be informed of how to pro­tect them­selves and organ­isa­tions’ data and sys­tems from a cyber secur­ity attack. This may res­ult in organ­isa­tion­al data being com­prom­ised and sig­ni­fic­ant busi­ness dis­rup­tion. There is also the risk of repu­ta­tion­al dam­age and fin­an­cial pen­alty for the organisation.

Recom­mend­a­tion

We recom­mend that man­age­ment should update and refresh the man­dat­ory cyber­se­cur­ity train­ing annu­ally for all staff and that the train­ing should form part of induc­tion train­ing for new staff. We also recom­mend that, when train­ing com­mences, there is reg­u­lar mon­it­or­ing of com­ple­tion rates with appro­pri­ate mech­an­isms for escal­a­tion where staff per­sist­ently do not com­plete this.

Man­age­ment Action	Grade 3 (Design)
We will rein­vig­or­ate train­ing and ensure all staff com­plete the man­dat­ory mod­ules as a mat­ter of pri­or­ity, mon­it­or­ing com­ple­tion rates to ensure com­pli­ance. We will also liaise with the train­ing mod­ule pro­vider to ensure the train­ing is appro­pri­ately and reg­u­larly refreshed.
Action own­er: Head of Organ­isa­tion­al Development	Due date: 31 August 2022

---

Page 10

Con­trol Object­ive 3: There are defined pro­cesses for iden­ti­fic­a­tion, record­ing, and man­age­ment of cyber secur­ity risks.

Con­trol Object­ive 4: The pro­posed stra­tegic approach to man­aging cyber secur­ity risk is aligned to lead­ing practice.

3.1 Cyber Risk Management

Amber

Our audit found that CNPA could enhance the cyber risk man­age­ment prac­tices and that the organ­isa­tion would bene­fit from great­er form­al­ity in con­trols and pro­cesses to sup­port more effect­ive man­age­ment of its cyber secur­ity risks.

Whilst we acknow­ledge that the organ­isa­tion has taken pos­it­ive steps to improve man­age­ment of its cyber secur­ity risks, by record­ing high-level cyber-related risks on the Stra­tegic Risk Register, there is no pro­cess for doc­u­ment­ing and man­aging lower-level cyber risks.

Risk

There is the risk that there are no pro­cesses in place for identi­fy­ing, record­ing, and man­aging cyber secur­ity risks. As a res­ult, these risks may mani­fest more reg­u­larly. There is the risk that the pro­posed stra­tegic approach to risk man­age­ment does not align with lead­ing prac­tice and, as a res­ult, is not as effect­ive as it should be.

Recom­mend­a­tion

We recom­mend that CNPA should per­form a risk assess­ment as well as a gap ana­lys­is of the cur­rent tech­no­logy, policy, and busi­ness envir­on­ment, to identi­fy the key cyber secur­ity risks. In con­duct­ing that risk assess­ment and gap ana­lys­is, CNPA should refer to recog­nised lead­ing cyber secur­ity frame­works includ­ing the Scot­tish Gov­ern­ment Cyber Resi­li­ence Frame­work. We recom­mend the intro­duc­tion of a cyber risk register informed by the risk assess­ment and gap ana­lys­is, which includes input from all rel­ev­ant stake­hold­ers. We recom­mend that there is a pro­cess estab­lished for the ongo­ing iden­ti­fic­a­tion and man­age­ment of cyber secur­ity risks. We recom­mend that there is reg­u­lar form­al report­ing of the organisation’s cyber secur­ity pos­ture to appro­pri­ate gov­ernance groups. This should include inform­a­tion on incid­ents that have occurred (ideally on a sum­mary or them­at­ic basis to avoid the risk of weak­nesses being widely pub­li­cised), actions being taken in response to incid­ents as well as assur­ance activ­ity that has taken place, includ­ing the res­ults of these.

---

Page 11

Man­age­ment Action	Grade 3 (Design)
We will under­take a risk ana­lys­is of cyber risk and estab­lish a map­ping of risk against pro­tec­tion pro­vi­sion, with con­sequent iden­ti­fic­a­tion of any gaps. We will estab­lish an action plan to address any such gaps arising.
Action own­er: Inform­a­tion Sys­tems Manager	Due date: 31 August 2022

---

Page 12

Appendix A – Definitions

Con­trol Assessments

Indic­at­or	Descrip­tion
R	Fun­da­ment­al absence or fail­ure of key controls.
A	Con­trol object­ive not achieved – con­trols are inad­equate or ineffective.
Y	Con­trol object­ive achieved – no major weak­nesses but scope for improvement.
G	Con­trol object­ive achieved – con­trols are adequate, effect­ive, and efficient.

Man­age­ment Action Grades

Grade	Descrip­tion
4	Very high risk expos­ure – major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
3	High risk expos­ure – absence/​failure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
2	Mod­er­ate risk expos­ure – con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
1	Lim­ited risk expos­ure – con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

Page 13

© Azets 2022. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales. Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.