Is attribute based data policy & access applied to ensure authorized data usage? Is data usage monitored and logged? Can the registry keeper verify who has accessed and what data?

Has the local authority put in place a risk mitigation and risk management processes, governance in place in case of miss use or attacks on digital customer services? Does the local authority has a communication plan in case the digital customer services are unavailable or has to be shot down?