Council services rely on mobile apps, browser extensions and third-party applications, each with its own permissions, dependencies and privacy statements. MobSTR helps ICT, information governance and data protection teams review that evidence, record approval decisions and revisit risk as applications change.
A PRACTICAL REVIEW PROCESS
Give every app request a clear route to a decision.
Technical findings are most useful when they are considered alongside the service the application supports, the information it can access and the council’s risk appetite.
- Record the request and business purpose. Identify the app, extension or Teams app, the people who need it and the council service it supports.
- Review security and privacy evidence. Examine vulnerabilities, permissions, software dependencies, configured domains, data handling and privacy-policy findings.
- Decide in context. Approve, restrict, mitigate, reject or request more supplier evidence, with a named decision owner and recorded reasoning.
- Set the next review. Revisit the decision when the application, its privacy policy, its use or the supporting service changes.
APPLICATION EVIDENCE
Bring mobile, browser and Teams applications into view.
MobSTR assesses and monitors iOS and Android applications, bringing together code, permissions, dependencies and findings. Browser extension risk assessment supports review of Chrome and Microsoft Edge extensions.
OpenGates assesses third-party Microsoft Teams apps, including permissions, configured domains and security findings. InterroPol adds privacy-policy summaries, red flags and supporting technical evidence so privacy questions can be considered alongside the security review.
CHANGE AND EXCEPTION RECORDS
Keep the evidence with the council’s decision.
Exported assessment results can be attached to a change request or approval record. Capture the business purpose, relevant findings, supplier questions, mitigation, exception owner and review date so another reviewer can understand what was decided and why.
A rating or alert does not make the decision on its own. Permissions that are excessive for one service may be necessary for another, so findings need professional interpretation against the intended use and information involved.
LOCAL GOVERNMENT CAF CONTEXT
Use application evidence within the wider assessment.
The NCSC Cyber Assessment Framework is an outcomes-based framework for managing cyber risk. Local Digital describes the CAF for local government as a voluntary, whole-organisation approach covering essential services and critical systems, supported by self-assessment, independent assurance and an improvement plan.
Application records may contribute evidence where they relate to risk management, asset management and dependencies on suppliers. In Scotland, the Scottish Public Sector Cyber Resilience Framework also calls for a proportionate approach to supplier assurance and continuing review of third-party services.
Scope matters. MobSTR provides application risk evidence. It does not complete a council’s CAF self-assessment, provide independent CAF assurance, certify compliance or replace the council’s existing security and procurement requirements.
Read the CAF for local government overview · NCSC CAF objective A · Scottish public sector framework
CUSTOMER EVIDENCE
A clearer evidence trail at East Renfrewshire Council.
MobSTR’s published customer story describes how East Renfrewshire Council used application findings and ratings to guide reviews, while keeping business context in the decision. The council reported that assessment results could be exported and attached to a change request, providing a paper trail for IT decisions.
The story records the estate and workflow at the time of the original interview; its figures are not presented as the council’s current position.
DISCUSS YOUR PROCESS
See how an application review could work for your council.
Bring a current app request, an application list or the change process your team wants to improve. We will show you how MobSTR organises the evidence and supports continuing oversight.