Government tests cyber resilience in tabletop exercise

Around 50 participants from across the Gibraltar Government, emergency services, public agencies, utilities and partner organisations took part in a cyber security tabletop exercise at Sunborn Gibraltar on October 14.

The exercise, jointly planned and delivered by the Office of Civil Contingencies and the Cyber Division of the Information Technology and Logistics Department, simulated a sophisticated ransomware attack affecting Gibraltar Government IT systems and disrupting public services.

It was designed to test the response of Government IT teams, emergency services, departments, agencies and other organisations during a major cyber incident.

The exercise also examined business continuity arrangements, including how critical functions would be maintained, decisions coordinated, stakeholders kept informed and essential services restored while normal systems remained unavailable.

Participants included representatives from the Office of Civil Contingencies, the Gibraltar Health Authority, Treasury, Royal Gibraltar Police, Gibraltar Fire and Rescue Service, Airport Fire and Rescue Service, HM Customs, Borders and Coastguard Agency, Gibraltar Port Authority, Gibraltar Electricity Authority, AquaGib, Gibtelecom and other public bodies and partner organisations.

The simulated incident tested established procedures, decision-making structures, information sharing and coordination between technical specialists, operational responders and senior leaders.

Cyber incidents have the potential to affect far more than computers and data. They can interrupt healthcare, communications, transport, utilities, financial systems and other services on which the community depends. The UK’s National Cyber Security Centre warned in its 2025 Annual Review that cyberattacks increasingly have real-world consequences for businesses, products, services and people, underlining the importance of preparing before an incident occurs.

Speaking at CYBERUK 2026, Richard Horne, Chief Executive of the National Cyber Security Centre, said that ransomware remained the most prevalent cyber threat to most organisations. He also stressed that cyber security must become a shared organisational mission, extending from senior leadership to operational and technical teams, rather than remaining the responsibility of IT specialists alone.

This whole-community approach was also reflected in the annual threat update delivered by Sir Ken McCallum, Director General of MI5, on 13 October 2026. He highlighted the importance of systemic, societal and technological resilience and warned that cyberattacks can directly affect critical infrastructure, public services, businesses and communities. His message emphasised that resilience requires a “whole-of-society effort” and that preparation must take place before disruption occurs.

The Minister for Civil Contingencies, Leslie Bruzon, said: ““Cyber threats are constantly evolving and have the potential to disrupt the services on which our community relies. Exercises of this kind allow us to test our preparedness in a realistic but controlled environment, identify areas for improvement and strengthen cooperation across Government, the emergency services and our key partners.”

“Cyber resilience is not solely a technical responsibility. It depends on effective leadership, sound
business continuity arrangements and people across every organisation understanding the part they have to play. I am grateful to everyone who contributed to the planning and delivery of this important
exercise.”

Director of ITLD Tyrone Manasco said: ““A major cyber incident would require a coordinated response across the whole of Government and cannot be managed by technical teams in isolation. This exercise enabled us to test how technical information is shared, how operational priorities are established and how decisions are taken when systems and services are under significant pressure."

“It also reinforced the importance of maintaining robust security practices, keeping systems updated, reporting suspicious activity promptly and ensuring that recovery arrangements are regularly reviewed and exercised.”

Civil Contingencies Coordinator Ivor Lopez said: “The purpose of an exercise is not simply to demonstrate what already works. It is to challenge our assumptions, identify gaps and generate practical lessons which can improve our collective preparedness.”

“The wide range of organisations represented at the exercise reflects the interconnected nature of modern public services. A cyberattack affecting one organisation can quickly have consequences for many others, so effective communication, coordination and business continuity planning are essential.”

Cyber security is a shared responsibility. Individuals and organisations can contribute by using strong and unique passwords, enabling multi-factor authentication, keeping devices and software updated, handling emails and links with care, and promptly reporting suspected cyber incidents.