Innovation Case Study: Stronger Together: A Shared Cyber Security Model for Local Government

Greater Bendigo City Council

Delivering affordable, scalable cyber protection through collaboration

An innovative shared cyber security model redefining how councils access critical capability. Leveraging a flexible, fit-for-purpose managed SOC/SIEM solution, this initiative enables affordable, scalable protection for diverse environments. Led by the City of Greater Bendigo, it pioneers a new approach to shared services, delivering practical and affordable innovation that can be replicated across the local government sector.

2026 MAVlab Innovation Awards Finalist:

The Dollars and Sense Award for Impactful and Innovative Business Operations, supported by SenSen Networks.

The Skilled to Serve Award for Capability Uplift, supported by Datascape.

The Smooth Operator Award for Service and Systems Optimisation and Transformation, supported by Atturra.

Project goals:

The project aimed to design and deliver an innovative shared cyber security model that provides affordable, scalable, and accessible protection for councils of all sizes. A central objective was to leverage the City of Greater Bendigo’s capability and expertise to support smaller councils, reducing the need for them to invest in their own specialised resources.

The initiative focused on overcoming sector-wide constraints through a fit-for-purpose managed SOC/SIEM solution with a flexible, agnostic integration layer, ensuring compatibility across diverse environments.

By absorbing the design, implementation, and governance effort, the City removed barriers to entry and accelerated adoption.

It also aimed to establish a sustainable and repeatable shared services model, creating a foundation for expanding collaborative cyber and IT capabilities across the local government sector.

Project team:

2 Councils, across 3 levels of the organisation. Total 9 project members.

Team or contributors:

• James Stokie, Manager Information Technology
• Daniel Hirth, Coordinator Technical Services
• Jovic Trinidad, Coordinator Information Security
• Claire Holland, IT Continuous Improvement Lead
• Ashley Nokes, Cyber Security Analyst
• Michael Ralph, IT Network & Systems Administrator
• Matthew Brown, IT Network & Systems Administrator
• Eric Walkden, IT Manager, Loddon Shire Council
• Mark Whitford – Enterprise Architect, Whitford Consulting Pty. Ltd.

Project duration:

Twelve months – Including initial Discovery, Design, Tender, Managed SOC/SIEM Vendor Selection, Onboarding and Roll out across councils.

Challenge and context:

Regional councils face a rapidly escalating cyber threat landscape, alongside increasing regulatory, audit, and community expectations. The risk landscape is evolving rapidly with the increasing use of artificial intelligence significantly accelerating the scale, sophistication and frequency of cyber threats. However, most councils operate with limited funding, lean IT teams, and constrained access to specialist cyber security expertise.

The challenge extends beyond technology. Regional councils needed to urgently address vulnerabilities and manage their significant technology debt, they were operating at varying levels of cyber maturity, with some requiring urgent operational threat detection and response, while others needed foundational uplift in governance, risk management and compliance. Traditional approaches of individual procurement or one-size-fits-all solutions were not viable, affordable or effective.

Delivering 24/7 security monitoring independently with internal capability, was financially prohibitive, while fragmented approaches to governance and risk created inconsistency and reduced overall resilience. For these regional councils competing organisational priorities and limited internal capacity further constrained the ability to implement proactive cyber security improvements.

Additionally, the initiative required building trust across multiple independent councils, each with its own governance structures, risk appetite, and decision-making processes. Achieving alignment without compromising autonomy became a significant challenge to be addressed.

The problem was therefore complex and multi-dimensional: how to deliver scalable, enterprise-grade cyber capability across multiple different sized councils, while maintaining flexibility, affordability, and local ownership, leading to a conclusion that any solution needed to be provided as a tailored for local government federated managed service.

This combination of operational, financial, and organisational constraints made the challenge both significant and highly suited to an innovative, collaborative solution.

Solution and innovation:

The Shared Cyber Security Services initiative introduced a sector-leading, collaborative model that redefined how regional councils access cyber capability.

The model was designed to be affordable for small councils, provide City-led implementation support to identify priorities and vulnerabilities, and operate as a federated, flexible service allowing councils to opt in or out while maintaining independence.

At its core is a dual-stream, modular approach:

• A managed SOC/SIEM delivered by a specialised partner, providing 24/7 monitoring, threat detection, and response tailored to local government.
• A Cyber Governance, Risk and Compliance (GRC) advisory service delivered by the City of Greater Bendigo, offering frameworks, templates, and expert guidance, with pre-purchased support days at cost.

As Lead Council, the City also facilitates regional forums, provides standardised artefacts, and manages vendor engagement, reducing administrative burden for partners. Councils can adopt one or both components based on their needs and maturity, moving away from rigid, one-size-fits-all models.

Key innovations included:

• Shared, scalable access to enterprise-grade capability
• Modular adoption supporting incremental uplift
• Embedded knowledge transfer to build internal capability
• Rapid delivery, achieving operational capability within weeks.

The solution was co-designed with councils to ensure alignment with real-world needs. Following a rigorous procurement process assessing 25 vendors, 3columns was selected as a partner aligned to regional requirements.

Flexible integration across diverse environments, combined with aligned operational and governance streams, delivers both immediate protection and long-term resilience—representing a step-change in cyber service delivery for local government.

A central objective was to leverage the City of Greater Bendigo’s capability and expertise to support smaller councils, reducing the need for them to invest in their own specialised resources.

Project impacts and short-term outcomes:

The initiative delivered immediate, measurable improvements in cyber capability across participating councils.

The streamlined implementation of managed SOC/SIEM services enabled continuous monitoring and rapid threat detection, significantly improving councils’ ability to identify and respond to cyber incidents. This marked a shift from largely reactive approaches to proactive, intelligence-led security operations.

Key outcomes include:

• Cost reduction of previous provider of over 30%
• Enhanced threat detection and response capability, with active 24/7 monitoring and triage in place
• Increased visibility of vulnerabilities and risk, enabling better-informed decision-making, through identifying highest value and biggest weaknesses and prioritising issues for remediation
• Improved incident readiness, supported by updated response plans and structured processes
• Strengthened governance artefacts, including policies, frameworks, and risk registers
• Improved staff awareness and engagement through targeted training and advisory support.

Importantly, these outcomes were achieved within a compressed timeframe through an accelerated implementation approach and strong vendor partnership.

The flexible service model drove strong engagement, allowing councils to adopt services quickly aligned with their needs. This ensured high relevance, immediate value, and sustained participation.

These outcomes demonstrate clear, attributable improvements in both operational cyber defence and governance maturity within the life of the project.

Capability and long-term impacts:

The initiative has created enduring capability and transformed how participating councils approach cyber security.

The shared services model provides participating councils the ability to continuously improve their Cyber posture over the ongoing journey, in a sustainable and cost-effective way that supports skilled resources in the region.  Additionally, it gives Local Governments a genuine opportunity to have a holistic and sufficient cyber security capability in an affordable framework.

A key achievement is the establishment of a shared regional cyber capability, enabling councils to access expertise, tools, and services that would not be feasible independently. This has significantly strengthened collective resilience across the region.

The governance and advisory component has embedded sustainable capability uplift, equipping councils with reusable frameworks, tools, and knowledge. This ensures that cyber maturity continues to improve beyond the life of the project.

The project has also fostered stronger cross-council collaboration, creating a network of shared learning, alignment, and mutual support. This collaborative model enhances the sector’s ability to respond to emerging threats and evolving regulatory expectations.

Importantly, the initiative has shifted cyber security from a reactive, fragmented approach to a proactive, structured, and integrated capability embedded in everyday operations.

The flexible model supports ongoing adaptation, allowing councils to scale services, prioritise risks, and respond to future challenges without significant reinvestment.

This enduring capability positions councils to better protect critical services and the communities they serve.

In August 2026, the City will host, in partnership with 3Columns and other preselected vendors a showcase event.  The event will focus on Emerging Threats, Practical Strategies, Expert Insights and building Stronger Connections across the region.

Scalability and transferability:

The Shared Cyber Security Services model provides a highly scalable and transferable blueprint for the local government sector.

Its modular design allows councils to adopt services based on need and maturity, making it suitable for a wide range of organisational contexts—from small rural councils to larger regional entities, all whilst maintaining independence.

The City is currently talking to the partner councils to gauge interest in extending the current cyber offering to other Information Technology areas, such as: Network architecture, Service Desk, application administration, data analytics and web services.

The initiative demonstrates how collaboration can overcome resource constraints and unlock capability at scale, making it particularly valuable in resource-limited environments.

Knowledge, artefacts, and lessons learned can be easily shared, accelerating adoption and reducing duplication across the sector.

The project also contributes to broader public sector resilience and aligns with key priorities such as secure, reliable service delivery and strong institutional governance.

By providing a practical, cost-effective, and people-centred approach, this initiative offers a compelling and replicable model for strengthening cyber resilience across Australia’s local government sector.