Government Tests Gibraltar’s Resilience During Cyber Security Exercise

Around 50 participants from across Government, the emergency services, public agencies and authorities, utility providers and partner organisations took part in a Cyber Security Tabletop Exercise at Sunborn Gibraltar on Wednesday 14 October 2026.

The exercise was jointly planned and delivered by the Office of Civil Contingencies and the Cyber Division of the Government’s Information Technology & Logistics Department (ITLD).

The scenario simulated a sophisticated ransomware attack affecting HM Government of Gibraltar’s information technology systems and disrupting the delivery of important public services. It was designed to evaluate the response of Government IT teams, emergency services, Government departments and agencies and other key partners during a major cyber incident.

In addition to testing the technical and strategic response to the simulated attack, the exercise examined participants’ business continuity arrangements. This included how organisations would maintain critical functions, coordinate decisions, communicate with stakeholders and support the restoration of essential services while normal systems remained unavailable.

The exercise brought together representatives from:

• Office of Civil Contingencies;

• Information Technology & Logistics Department;

• Gibraltar Health Authority;

• Treasury;

• Royal Gibraltar Police;

• Gibraltar Fire & Rescue Service;

• Airport Fire & Rescue Service;

• HM Customs;

• Borders & Coastguard Agency;

• Gibraltar Port Authority;

• Joshua Hassan Gibraltar International Airport;

• Environmental Agency;

• Department of Personnel & Development;

• Department of Immigration & Home Affairs;

• No.6 Press Office;

• Department of Education;

• Technical Services Department;

• Gibtelecom;

• Gibraltar Electricity Authority;

• AquaGib;

• Ministry of Defence;

• Foreign, Commonwealth & Development Office; and

• Gibraltar Regulatory Authority.

The exercise provided participants with an opportunity to work through the complex consequences of a large-scale cyber incident in a controlled environment. It tested established procedures, decision-making structures, information-sharing arrangements and the coordination required between technical specialists, operational responders and senior leaders.

Cyber incidents have the potential to affect far more than computers and data. They can interrupt healthcare, communications, transport, utilities, financial systems and other services on which the community depends. The UK’s National Cyber Security Centre warned in its 2025 Annual Review that cyberattacks increasingly have real-world consequences for businesses, products, services and people, underlining the importance of preparing before an incident occurs.

Speaking at CYBERUK 2026, Richard Horne, Chief Executive of the National Cyber Security Centre, said that ransomware remained the most prevalent cyber threat to most organisations. He also stressed that cyber security must become a shared organisational mission, extending from senior leadership to operational and technical teams, rather than remaining the responsibility of IT specialists alone.

This whole-community approach was also reflected in the annual threat update delivered by Sir Ken McCallum, Director General of MI5, on 13 October 2026. He highlighted the importance of systemic, societal and technological resilience and warned that cyberattacks can directly affect critical infrastructure, public services, businesses and communities. His message emphasised that resilience requires a “whole-of-society effort” and that preparation must take place before disruption occurs.

The Minister for Industrial Relations, Civil Contingencies and Sport, the Hon Leslie Bruzon MP, said:

“Cyber threats are constantly evolving and have the potential to disrupt the services on which our community relies. Exercises of this kind allow us to test our preparedness in a realistic but controlled environment, identify areas for improvement and strengthen cooperation across Government, the emergency services and our key partners.

“Cyber resilience is not solely a technical responsibility. It depends on effective leadership, sound business continuity arrangements and people across every organisation understanding the part they have to play. I am grateful to everyone who contributed to the planning and delivery of this important exercise.”

Reflecting on the exercise, the Director of ITLD, Tyrone Manasco, said:

“A major cyber incident would require a coordinated response across the whole of Government and cannot be managed by technical teams in isolation. This exercise enabled us to test how technical information is shared, how operational priorities are established and how decisions are taken when systems and services are under significant pressure.

“It also reinforced the importance of maintaining robust security practices, keeping systems updated, reporting suspicious activity promptly and ensuring that recovery arrangements are regularly reviewed and exercised.”

The Civil Contingencies Coordinator, Lieutenant Colonel (Retired) Ivor Lopez MBE, said:

“The purpose of an exercise is not simply to demonstrate what already works. It is to challenge our assumptions, identify gaps and generate practical lessons which can improve our collective preparedness.

“The wide range of organisations represented at the exercise reflects the interconnected nature of modern public services. A cyberattack affecting one organisation can quickly have consequences for many others, so effective communication, coordination and business continuity planning are essential.”

Cyber security is a shared responsibility. Individuals and organisations can contribute by using strong and unique passwords, enabling multi-factor authentication, keeping devices and software updated, handling emails and links with care, and promptly reporting suspected cyber incidents.