FOI Request - Citizen Facing Online Services

Request 101003895892

This request is made under the Freedom of Information Act 2000 and relates only to citizen-facing online services (for example, housing portals, council tax accounts, or benefits portals). It does not concern internal staff systems or administrative tools. The research does involve information on detailed technical configurations for public-facing web portals. Please provide the following information/documents:

1. A copy of (or extract from) your current policy that governs user authentication for citizen-facing online services.

2. The specific password rules that apply when citizens create an account or perform a password reset. Fore example, password character minimum and maximum limits, special character enforcement.

3. Whether MFA is offered or required for citizen-facing services, and, if so, what types are supported (e.g. SMS, email, or authenticator app).

4. A brief description or document outlining how password resets or account recovery are handled for public users (e.g. email verification, security questions, or other processes).

5. The date these policies were last reviewed or updated, and whether the policies align with any national or international guidance (e.g. NCSC, NIST SP 800-63, or ISO 27001).

Response 08-01-2026

1. We currently do not have a Moray Council specific policy governing user authentication for citizen-facing online services. All our citizen facing authentication services are controlled by third parties.

Our main customer portal, together with the 3rd party Parent's Portal, iPayimpact and Blue Badge services, all use "myGovScot myAccount" which is operated and managed by the Scottish Government Improvement Service - https://www.mygov.scot/myaccount. In addition to password controls, myAccount authentication supports Passkeys, 2FA and access via the digital identity app, YOTI.

Our other public facing online services use modules or extensions from the main, associated applications, as below. These all contain / control their own account / registration facilities.

             · Housing Applications - NEC Housing Online

             · Leisure Bookings - Gladstone

             · Libraries Reservations, eBooks, etc. - Spydus / BorrowBox

             · Library PC Booking - Netloan

             · Job Applications - myjobscotland

             · Public Engagement - Granicus Engage

             · Planning Portal - IDOX / Uniform

             · Online Shop – X-Cart

             · Parking payments - PayByPhone app

Other online services e.g. Libindex, Recycling Centre Booking and Online Payments do not require registration.

2. N/A

3. N/A

4. N/A

5. N/A