Cyber Resilient Scotland 2025 to 2030: strategic framework

Annex C

Policy progress in Scotland

2015–2020 - Building the foundations

• First cyber resilience strategy for Scotland published alongside Action Plans.
• National Cyber Resilience Leaders’ Board established to guide strategic direction.
• National partnerships and collaboration with the National Cyber Security Centre and the UK Government established.
• Cyber resilience learning embedded in Scotland’s 3-18 school curriculum.
• Scottish Government leads by example, embedding resilience in digital public services.
• Public Sector Cyber Resilience Framework v1 published to set baseline standards.
• Cyber Security Procurement Tool embedded into Scottish procurement processes.
• Cyber Incident Response Toolkit launched to help organisations plan for cyber incidents.
• CyberUK 2019 in Glasgow, Scotland – over 2,000 visitors.

2020–2024 - Creating the right conditions

• Strategic Framework for a Cyber Resilient Scotland launched.
• CyberScotland Partnership (CSP) established.
• National partnerships with UK, Wales and Northern Ireland Governments strengthened.
• Public Sector Cyber Resilience Network expands to over 200 members.
• NCSC Active Cyber Defence tools grow in use.
• Third Sector cyber awareness activity increased including appointment of Third Sector lead.
• Scotland’s cyber security industry almost triples to over 400 companies since 2018.
• Civtech Challenge 9.5 launched to develop a successor to the Cyber Security Procurement Tool.
• SC3 established to coordinate response to national cyber incidents.
• Public Sector Upskilling - more than 200 courses funded.
• Public Sector Cyber Resilience Framework v2.0 launched.
• The Bongles book distributed to all P1 school children.

2024–2030 - Scaling and strengthening Scotland’s cyber maturity

• SC3 continues to lead national coordination of incident response and intelligence sharing; the Cyber Observatory launches to improve understanding of public sector cyber security.
• Public Sector actively engages through the Public Sector Cyber Resilience Network to share experiences and improve their cyber security posture.
• Cyber Resilience and You! a free online cyber training resource launched for all students at Scottish universities and colleges.
• Outreach expanded to third sector organisations, SMEs and vulnerable people.
• CivTech Challenge 11.8 launched to make the adoption of robotics by the public sector safe and cyber secure.
• Public Sector Cyber security workforce development prioritised, with focus on apprenticeships and supporting the professionalisation of the sector.
• CyberFirst schools expand.
• CyberUK 2026 in Glasgow.