The Cabinet Member for Organisation & Workforce of Carmarthenshire Council is scheduled to consider several policy updates at their meeting on Thursday 29 October 2026. These include revisions to the probationary policy, alongside updated policies on cyber and information security, internet usage, portable device usage, and the Bring Your Own Device (BYOD) scheme.

Revised Probationary Policy

A key item on the agenda is the review of the Revised Probationary Policy. This policy is being updated to align with forthcoming changes to employment legislation stemming from the Employment Rights Act 2025, which will reduce the qualifying period for an employee to claim ordinary unfair dismissal from two years to six months of continuous service, effective from 1 January 2027. The report pack indicates that the revised policy aims to strengthen the management of probationary periods by clarifying managers' responsibilities, ensuring regular review meetings, and requiring better record-keeping. It also provides clearer guidance on extending probation and ensures that any decision to terminate employment during probation is supported by a fair and proportionate process. The reasons for these changes are to reduce the increased risk of unfair dismissal claims.

Cyber and Information Security Policy

The meeting will also consider the Cyber and Information Security Policy. This revised policy aims to safeguard the confidentiality, integrity, and availability of Carmarthenshire County Council's information assets. It formally establishes itself as the Council's Acceptable Use Policy (AUP) and will be updated annually by the Cyber Security Team to remain current with evolving threats and regulatory changes. The policy integrates with a broader framework of related policies, including those on portable devices, internet usage, and BYOD. It introduces enhanced asset management and device controls, prohibits unauthorised ('shadow IT') devices, and clarifies responsibilities for staff, managers, and service heads. Furthermore, it mandates cyber security and data protection training for all staff and includes new emphasis on business continuity planning and cyber incident response. The policy also addresses the use of Generative AI tools, requiring compliance with the Council's Generative AI Policy and prohibiting the input of confidential information into AI systems without authorisation. A Zero Trust approach to cyber security is adopted, with continuous authentication and enhanced controls for privileged accounts. Detailed approval processes for access to staff accounts, activity logs, and monitoring information are also outlined.

Internet Usage and Monitoring Policy

The Internet Usage and Monitoring Policy is scheduled for review and approval. The existing policy, last updated in 2015, is being revised to ensure its continued relevance and to strengthen cyber security and monitoring protocols. Key updates include explicit inclusion of remote and hybrid working environments, coverage of cloud services, and alignment with the Council's BYOD Policy. The revised policy also updates references to current legislation, such as the UK GDPR and the Online Safety Act 2024, and provides clearer transparency regarding monitoring activities, their purpose, and governance. It details authorisation routes for accessing monitoring logs and usage reports, with distinct approval arrangements for officers and elected members. The policy also reinforces the prohibition of attempts to bypass security controls and mandates participation in cyber security and phishing awareness training.

Portable Device Usage Policy

The Portable Device Usage Policy is also up for review. This policy sets out the Council's framework for the secure and appropriate use of portable and mobile devices that connect to Council systems or handle Council data. The revision aims to ensure the policy remains fit for purpose for current working practices, including hybrid working and the use of cloud services, and to strengthen cyber and information security governance. It seeks to clearly distinguish between Corporate-Owned Devices (COD) and Bring Your Own Device (BYOD) arrangements. A significant update is the introduction of a defined approval process for the use of portable devices outside the United Kingdom, reflecting data protection, security, and risk considerations. This aligns with the Council's overarching Cyber & Information Security Policy.

Bring Your Own Device (BYOD) Policy

Finally, the Bring Your Own Device (BYOD) Policy is to be reviewed and approved. This policy outlines the framework for the secure and appropriate use of personally owned smartphones and tablets to access Council systems and information. The revised policy aims to strengthen governance, clarify responsibilities, and introduce a clearer approval process, particularly for overseas access. It confirms that BYOD is optional, requires approval before use, and is restricted to Council-managed applications. The policy is positioned as a supporting document within the Council's cyber and information security framework, aligning with the overarching Cyber & Information Security Policy. It reinforces that Council information must only be accessed through approved Council-managed applications and that personal applications must not be used to store or transmit Council information.