IT Checklist for Parish and Town Councils

Most council IT problems are not technical. They come from unclear ownership: who holds the domain, who can reach the email, who knows when the website renews. Use this checklist to find the gaps. Anything you cannot answer with a confident yes is where to start.

This is practical IT guidance, not legal advice. Requirements change, so check current guidance from your county association, NALC or SLCC, and the ICO.

Email and accounts

• Do the clerk and councillors use council-controlled email addresses rather than personal accounts?
• Is one named person responsible for creating and removing accounts when people join or leave?
• Is multifactor authentication switched on, especially for the clerk and any administrator accounts?
• Do you know who holds the administrator login for your email and Microsoft 365?

Domain and website

• Who owns the domain name, and who holds the registrar login?
• Is it registered in the council's name, rather than a former clerk, a councillor or the website supplier?
• When does it renew, and who receives the reminder?
• Do you know where the website is hosted and who can change it?
• Has the council considered a .gov.uk address?
• Is there an up-to-date accessibility statement, and does the site publish what the council is expected to publish, for example under the Transparency Code for smaller authorities?

Security

• Are council records backed up, and has anyone tested restoring them?
• Are computers and phones used for council business kept up to date?
• Is there a simple plan for a compromised account or a lost device?
• Do the clerk and councillors know how to spot a phishing email?

Devices and data

• Which devices belong to the council, and who has them?
• Is there a clear rule on using personal devices for council business?
• Where are agendas, minutes and financial records stored, and who can access them?

Information requests and records

• Could you find and export a person's emails and documents if you received a subject access or information request?
• Do you have an approach to how long email and files are kept?
• Is personal data stored only where it needs to be?

Suppliers and renewals

• Do you have a list of suppliers (broadband, phones, website, IT support, software) with contacts and renewal dates?
• Are contracts reviewed before they renew?
• Do you know what you are paying for, and is it still needed?