Disclosure Log

MSc in Cyber Security (FOI/6900)

Message from Nottinghamshire County Council - 30 December 2025

Dear *********                                                               

Freedom of Information Request – Ref: FOI/00006900

Thank you for your email of 5th December 2025 where you requested information about MSc in Cyber Security. The response to your request is provided below.
 
  1. A copy of (or extract from) your current policy that governs user authentication for citizen-facing online services.
All published policies are available here Policy Library | Nottinghamshire County Council in accordance with Section 21 of the Freedom of Information Act, information accessible to the applicant by other means.
 
  1. The specific password rules that apply when citizens create an account or perform a password reset. Fore example, password character minimum and maximum limits, special character enforcement.*
 
  1. Whether MFA is offered or required for citizen-facing services, and, if so, what types are supported (e.g. SMS, email, or authenticator app).*
 
  1. A brief description or document outlining how password resets or account recovery are handled for public users (e.g. email verification, security questions, or other processes).*
 
  1. The date these policies were last reviewed or updated, and whether the policies align with any national or international guidance (e.g. NCSC, NIST SP 800-63, or ISO 27001).
The date is on each policy.  Policies align with the NCSC.

*For this FOI, we are not supplying any specific policy information or procedures for account or password resets. 
This is exemption information under section 31 of Freedom of Information Act. The public interest in disclosure for transparency, scrutiny and accountability of public bodies is outweighed by the public interest in ensuring the risks to operations and assets of public authorities are not exposed to malicious actors. 
 
This is due to the following: 
 
  1. Any information that could be used by hackers, scammers, and other malicious actors to compromise the Council’s ICT systems and cyber security should not bedisclosedto external organisations,partnersor members of the public. 
 
  1. Examples of information which could be used by malicious actors, particularly ifcomprisedof details relating toshort timeperiods of less than a year, include: 
 
  • Use of external cyber/online security contractors, firms; and 
  • Details of ICT and cyber security systems, procedures,policiesand contracts particular to the Council 

Your privacy: we use your personal information such as name and address so that we can comply with our legal obligations to respond to FOI requests.  For further details about the use of information about you, please see the information handling privacy notice on our website at https://www.nottinghamshire.gov.uk/media/4323566/informationgovernanceandinformationrightsprivacynotice.pdf.

If you are dissatisfied with the handling of your request, you have the right to ask for an internal review.  Internal review requests should be submitted within 40 working days of the date of receipt of the response to your original request and should be addressed to: Complaints and Information – Team Manager, Nottinghamshire County Council, County Hall, Loughborough Road, West Bridgford, NOTTINGHAM, NG2 7QP or [email protected].

Please remember to quote the reference number above in any future communications. 

If you are not content with the outcome of the internal review, you have the right to apply directly to the Information Commissioner for a decision.  The Information Commissioner can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, WILMSLOW, SK9 5AF or https://ico.org.uk/make-a-complaint/foi-and-eir-complaints/.

Yours sincerely

The Complaints and Information Team
Nottinghamshire County Council