Senior Information Risk Owner (SIRO) - Information Governance - Assurance and Performance Report 2021-2022
North Lanarkshire Council · 16 February 2023
Back to Audit and Scrutiny Panel — 16 February 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
North Lanarkshire Council Report Audit and Scrutiny Panel ☐approval ☒noting Ref KH/RL/SC Date 16/02/23 Senior Information Risk Owner (SIRO) – Information Governance – Assurance and Performance Report 2021-2022 From Katrina Hassell, Chief Officer (Business & Digital) Email HassellK@northlan.gov.uk Telephone 07903 096 121 1. Background 1.1 There are several officers and teams across the Council with responsibility for information governance and information security, but good information governance involves everyone. This report describes how these roles collectively ensure organisational compliance with the legislative and regulatory requirements relating to the handling and processing of information. 1.2 As corporate champion for information governance, the SIRO aims to provide the Audit and Scrutiny Panel with assurances that information risks are being effectively managed. To this end, this report outlines information governance activity and performance in respect of financial year 2021-2022, detailing what is going well, and where improvements can be made. Executive Summary This SIRO report aims to provide assurances that information risks are being effectively managed to ultimately enable the Council to comply with legislative requirements and good practice. It outlines activity and performance related to information governance in respect of financial year 2021-2022 and details the improvement actions which the Data Management Team (DMT) aim to progress to further improve awareness, understanding and compliance. Recommendations It is recommended the Audit and Scrutiny Panel: (1) Note the activities which have been undertaken or are underway to enable the SIRO to provide assurances information risks are being effectively managed; and (2) Note the activities and next steps planned to further improve the Council’s information governance arrangements. The Plan for North Lanarkshire Priority All priorities Ambition statements All ambition statements
Page 2
2. Report 2.1. The Council has always been committed to effective information governance with sound arrangements for ensuring compliance with legislation and recognised best practice appropriately managed as part of the Council’s risk management and corporate governance arrangements. 2.2. SIRO responsibilities have been aligned with the Chief Officer of Business & Digital remit since September 2019. Previous details in respect of financial years 2019- 2020 and 2020-2021, considered by the Audit and Scrutiny Panel in December 2021, demonstrated significant improvements were delivered over the 2-year period to formalise and improve the Council’s information governance management arrangements. 2.3. This report relates to financial year 2021-2022, with sections 14 to 63 of the SIRO report provided as Appendix 1 detailing activity and performance undertaken to ensure personal data is held securely, and information disseminated effectively. Key highlights for Panel consideration include: ➢ Data Governance Board (DGB) Self evaluation undertaken to establish and monitor whether the Board’s arrangements adequately contribute to the achievement of the Council’s vision as detailed in the Data and Information Management Strategic Roadmap ➢ Information Security and Information Governance corporate risk monitored in accordance with residual risk ratings, with corresponding mitigating actions identified and deployed ➢ Several activities undertaken to mitigate against cyber risk, and to improve the Council’s ICT Disaster Recovery (DR) arrangements ➢ Business Data Owners and Line of Business Data Steward roles and responsibilities defined, enabling services to consider appropriate deployment of the approved Data Governance and Management Framework ➢ Mandatory information governance and security training modules tailored to suit the needs of individual roles, with Advanced Data Protection module also made mandatory for employees with staff responsibilities as well as any staff roles specifically identified by Services. ➢ Full refresh, and subsequent promotion, of the Council’s Information Governance Policy Framework 2.4. Complementing the Corporate Data Protection Officer’s annual report to the Finance and Resources Committee, sections 21 to 30 of the SIRO report highlight for Panel consideration any breaches of confidentiality and security considered by the DGB during financial year 2021-22, alongside assessment of the remedial actions identified. 2.5. Sections 31 to 36 focus specifically on ICT Security and Cyber risks, advising of the accreditations and approaches adopted by the Council to mitigate against this high-risk area. 2.6. Paragraphs 61 to 63 detail actions taken to maintain compliance with the Public Records (Scotland) Act 2011.
Page 3
Next steps 2.7. The Council is committed to a clear strategy and sustainable framework for information governance and security, and effective data and information management governance is an essential component of that. Given this report presents information assurance for financial years 2021-2022, the live improvement plan detailed in section 65 of the Appendix highlights activity planned in March 2022 to strengthen existing arrangements. These actions are progressing well and will be detailed for Panel consideration within the 2022-2023 SIRO report. 2.8. By way of summary, the key priorities identified within the improvement plan include: a. Refresh and strengthen our approach to mitigating Cyber security risks b. Implement improvement actions identified in DGB Self-evaluation exercise c. Raise profile and prioritisation of Information Governance and Data Protection responsibilities; and d. Incremental implementation of the Data and Information Management Strategic Roadmap (the Roadmap) 2.9 Improvements can always be made to our information governance arrangements, and with a residual risk score of 20 (March 2022) prevalent in respect of our Information Governance and Information Security corporate risk, it is essential this subject matter remains as a high priority improvement area for the Council. Progress against these key next steps will be managed by the DGB, who will look to further develop policies, guidance, standards, processes, and approaches as appropriate to improve awareness, understanding and compliance with legislative requirements and good practice. 3. Measures of success 3.1 Effective Information Security and Information Governance assists the Council in protecting itself from cyber-attacks and security breaches, which can both give rise to service delivery and financial pressures. Measures of success therefore flow from demonstrated and continued compliance with all information governance legislative and regulatory requirements. 4. Supporting documents 4.1 Appendix 1 – SIRO Information governance – assurance & performance – 2021- 22 Report. Katrina Hassell Chief Officer (Business & Digital)
Page 4
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Financial Solutions? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? There are no financial implications arising from this report, however the promotion and implementation of effective information governance impacts positively on the Council’s ability to mitigate its exposure to financial risk, particularly monetary penalties levied by the Information Commissioner's Office for non-compliance. Notwithstanding this, section 34 of the SIRO report so appended illustrates we must also consider costs involved in achieving compliance with good practice standards, as such can be cost prohibitive for the Council to achieve given its complex portfolio. 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People and Organisational Development? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic Solutions? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Section 4 of the SIRO report as appended outlines the legislative and regulatory requirements placed on the Council in respect of information processing, security, and management. General Data Protection Regulations (GDPR) continue to apply to the United Kingdom post-Brexit implementation.
Page 5
5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☒ No ☐ Section 4 of the SIRO report as appended outlines the legislative and regulatory requirements placed on the Council in respect of information processing, security, and management. General Data Protection Regulations (GDPR) continue to apply to the United Kingdom post-Brexit implementation. Paragraphs 21 to 30 also highlight any breaches of confidentiality and security considered by the DGB during financial year 2021-22, with corresponding remedial actions identified If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☒ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐ 5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Sections 31 to 36 of the SIRO report focus specifically on ICT Security and Cyber risks. The council operates a complex technology network, and through its DigitalNL programme, will significantly change its server, applications, and software estate, as well as the underlying connectivity. All changes will be considered by the appropriate corporate working group, with any technology components fully assessed as required by the corporate Enterprise Architecture Governance Group. Where the impact identifies a requirement for technology, has an assessment been carried out (or scheduled) by the Enterprise Architecture Governance Group (EAGG)? Yes ☒ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☒ No ☐ Sections 6 and 65 of the SIRO report highlight everyone – staff and elected members – must understand the importance of information governance and
Page 6
security, which when combined with lower than desired mandatory training take- up does illustrate a requirement for ongoing communication of requirements If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? In line with the Council’s corporate risk management arrangements and a requirement for risk to be managed at an appropriate level of the organisation, the Chief Officer of Business & Digital has lead officer responsibility for the corporate risk regarding Information Security and Information Governance. Approved risk management arrangements further require the assessment, monitoring, and review of individual risks to be assigned to relevant Corporate Working Groups, and this particular risk sits within the remit of the DGB. Improving our information governance arrangements will positively impact the Council’s risk management arrangements, consequently leading to greater confidence in the accuracy of data used to support decision-making
Page 7
SENIOR INFORMATION RISK OWNER (SIRO) INFORMATION GOVERNANCE – ASSURANCE & PERFORMANCE: 2021 – 2022 REPORT NORTH LANARKSHIRE COUNCIL December 2022
Page 8
1 Table of Contents Executive summary .............................................................................................................................. 1 Introduction........................................................................................................................................... 2 Key Roles and Responsibilities ......................................................................................................... 2 Governance and Monitoring Arrangements ...................................................................................... 4 Risk Management and Assurance ........................................................................................................ 5 Compliance with Data Protection and GDPR Requirements ................................................................ 6 ICT security and cyber risks ................................................................................................................. 8 Corporate governance activity ............................................................................................................ 10 Live Improvement plan ....................................................................................................................... 18 Conclusion.......................................................................................................................................... 21 EXECUTIVE SUMMARY This report provides an update relating to the responsibilities of North Lanarkshire Council’s Senior Information Risk Owner (SIRO). It outlines activity and performance related to information governance and provides assurances that information risks are being effectively managed. It outlines what is going well, and where improvements can be made. This report relates to financial year 2021-22, so covers activities and assessments up to March 2022.
Page 9
2 INTRODUCTION 1. The Senior Information Risk Owner (SIRO) Annual Report reflects on the Council’s information governance work, aiming to provide assurances that personal data is held securely, and information disseminated effectively. This report focuses on financial year 2021-2022. 2. The Council continues to be committed to effective information governance, with sound arrangements in place to ensure compliance with legislation and recognised best practice. Governance arrangements are closely monitored to ensure systems, policies and procedures are fit for purpose, and that all staff and elected members understand the importance of information governance and security, with good practice considered everyone’s business. 3. ICT security and cyber risks present an ever-increasing challenge to all organisations and the Council is no different. Arrangements to manage these risks, in consideration of the threat landscape, are contained within the report, with a summary included to highlight action underway and planned to maintain and strengthen defences and enhance corporate resilience. 4. Specifically, this report: a. Documents organisational compliance with the legislative and regulatory requirements relating to the handling and processing of information and provides assurance of ongoing improvements to manage information risks. This includes the Council’s consideration and performance relating to: ➢ Data Protection Act 2018 and General Data Protection Regulations (GDPR) 2016 ➢ Public Records (Scotland) Act 2011, and ➢ Information Security Standard ISO/IEC 27001:2013 b. Provides an overview of Council governance arrangements and key roles and responsibilities. c. Outlines any serious incidents which required investigation over the duration of this report, relating to any losses of personal data or breaches of confidentiality. Key Roles and Responsibilities 5. The Chief Officer of Business and Digital within the Chief Executive’s Office is the Council’s Senior Information Risk Officer. Key responsibilities include: a. Leadership and overall ownership of the Council’s Corporate Governance Action Plan, acting as corporate champion for information governance; b. Acting as Executive Sponsor and advocate for the management of information governance at a senior level; c. Providing advice and reports in respect of information incidents and risks, including the content of the council’s Annual Governance Statement relating to information risk; d. Owning the management of information governance and associated risk assessment processes within the Council; e. Understanding how the strategic priorities of the Council may be impacted by information governance risks, and how these risks need to be managed including the adequacy of resources and levels of independent scrutiny.
Page 10
3 6. There are several officers and teams across the Council that have professional expertise relating to information governance and information security, but good information governance involves everyone. All staff and elected members therefore have personal responsibility to ensure information and data is held securely, processed appropriately and safely destroyed when not required. 7. Diagram 1 below illustrates existing responsibilities and governance arrangements in respect of information governance, clearly highlighting the differing responsibilities of the SIRO, Data Protection Officer, and Records Manager, as well as the oversight responsibilities of the strategic Data Governance Board (DGB) and operational Data Management Team (DMT). Diagram 1 8. Recognising these wider responsibilities, this report complements the annual report prepared by the Chief Officer of Legal and Democratic Solutions – the Corporate Data Protection Officer (DPO) - in respect of his responsibility for data sharing, data breaches, Information Commissioner Office (ICO) complaints and training. The detail in respect of financial year 2021-22 is due to be considered by the Finance & Resources Committee on 1st March 2023.
Page 11
4 Governance and Monitoring Arrangements 9. The Council’s Data Governance Board (DGB) is responsible for developing and implementing strategies, policies, and standards in relation to data governance and management. Additionally, the board is responsible for directing improvements identified within the Data and Information Management Strategic Roadmap, and for ensuring measures are in place, through the Data Management Team, to monitor compliance with approved policies and standards. 10. The DGB is chaired by the SIRO, includes the Corporate Records Manager, Data Protection Officer (DPO), Chair of the Data Management Team (DMT) and key representation from all Council functions. 11. The key Terms of Reference of the DGB include: a. To ensure the Council’s information governance policies and management arrangements reflect current legislation, guidance/policies, and relevant professional codes of practice. b. To ensure that the Council undertakes or commissions annual assessments and/or audits of its information governance policies, procedures, and arrangements, with all findings included within improvement plans as appropriate. c. To receive the Annual Data Protection Officer report and scheduled internal audit reports, reviewing progress against required and identified actions as appropriate. d. To receive and consider reports into breaches of confidentiality and security and where appropriate undertake or recommend remedial action. e. To establish an information governance improvement plan, secure the relevant resources and monitor implementation of the plan. f. To ‘sign off’ the information governance assurance annual return and corporate information governance risk reviews prior to submission in line with the timetable issued each year. g. To promote a Council wide culture that information governance is the responsibility of all elected members and staff and to promote learning that arises out of investigations into breaches in information governance. h. To ensure that staff are trained in information governance, comply with, and understand the consequences of not adhering to relevant policies and procedures, monitoring the provision and uptake of such training in accordance with identified targets. i. To assist the Senior Information Risk Owner (SIRO) in producing information appropriate for inclusion within an annual Information Governance Report. Through this report, the Data Governance Board provides assurance to the Corporate Management Team and Audit and Scrutiny Panel. j. To ensure the Council develops and maintains an appropriate framework for the management and protection of information which is appropriately supported by information asset owners and administrators. k. To ensure the Council achieves positive movement on the data maturity curve, directing activities towards achievement of the ‘advancing’ stage of the maturity curve. 12. These Terms of Reference are reviewed annually to ensure the Board continues to meet the Council’s business needs. Terms are regularly referenced at Board meetings, with members given opportunity to identify any additional support required to enable them to fulfil their responsibilities. 13. During 2021-22, the Board also completed a self-evaluation to establish whether its Terms of Reference and oversight arrangements adequately contribute to the achievement of the council’s vision as detailed in the approved strategic roadmap. Details are contained within paragraphs 38 to 43 below.
Page 12
5 RISK MANAGEMENT AND ASSURANCE 14. The Council’s Corporate Risk Register includes a risk in respect of Information Security and Information Governance. This risk is defined as “There is a risk that information, in whatever format, is not managed securely or that Information Governance across the Council and its ALEOs is ineffective. This includes implementation of enhanced and appropriate controls to address the additional information security and information governance risks arising from the significant shift to home working triggered by the COVID-19 pandemic”. 15. The council identifies and monitors significant risk to its operations. The Information Security and Information Governance risk is assessed and monitored using the standard council- approved process for risk management. The inherent score of this risk is 25, having been assessed at the maximum score of 5 for both likelihood and impact. 16. The agreed approach to the management of key corporate risks sees all risks allocated to a member of CMT and a Corporate Working Group, with such responsible for assessing, monitoring, and reviewing in accordance with residual risk ratings. This particular risk is aligned to the Data Governance Board (DGB) with the Chief Officer of Business and Digital identified as the Corporate Risk Lead. 17. The formal annual review of the Corporate Risk Register 2021-22 was considered by the Audit and Scrutiny Panel in June 2021. This review confirmed that Information Governance and Information Security would remain as a corporate risk given the impacts which breached, inaccurate or lost data could have on the Council achieving its priorities and stated objectives. This report identified the deep dive review in respect of this corporate risk would be scheduled for Corporate Management Team and Audit & Scrutiny Panel consideration in April and June 2021 respectively. Both targets were achieved. 18. Throughout 2019-20 and 2020-21, this risk carried a residual risk assessment of 20, “almost certain” likelihood (5) and “major” impact (4) and was therefore monitored quarterly. This was revised down to 16 over the course of 2021-22 as controls implemented over the course of the COVID-19 pandemic and around remote working took effect. Owing to the worsening geopolitical climate, particularly the situation in Ukraine, the residual risk assessment was revised upwards to 20 in the March 2022 review. 19. The March 2022 review confirmed the likelihood of a breach was high, as it had been throughout 2021-22, despite minor variation in the precise level of residual risk The following provides illustrative examples of information security and governance controls documented within the Council’s risk register and enhancements made over the course of 2021-22. Control (C) / Action (A) Description ➢ CON0001054 Corporate and Service Business Continuity Plans in place and stress tested to inform priorities and decision making ➢ CON0001055 Increased suite of remote access concentrators to cope with and support increased numbers of remote users ➢ CON0001056 Guidance issued to managers and staff on home working which includes reference to data security ➢ CON0001058 Technical controls in place such as device authentication check, network-level user multi-factor authentication etc
Page 13
6 Control (C) / Action (A) Description ➢ CON0001064 Secured Premises with secure storage and monitoring of security arrangements ➢ ACT0000610 Review current training content to ensure home working risks are identified in relation to information governance and expectations of staff are fully reflected ➢ ACT0000878 Security good practice training commenced across front-line staff during Q4 of 2021/22 with uptake monitored. ➢ ACT0000879 Training reviewed in March 2022 in light of move to hybrid working and security awareness module revised as appropriate. ➢ CON0001386 The move to hybrid working and revised use of buildings following on from the COVID pandemic saw a programme launched to ensure premises are assessed and appropriate secure storage and monitoring of security arrangements put in place. ➢ CON0002060 PROTECTIVE technical controls in place such as device authentication checks, multi-factor authentication, network segmentation, web gateways, email filtering solutions, etc. ➢ CON0002061 DETECTIVE technical controls in place such as a security event and incident management, intrusion detection, and malware detection solutions, ongoing penetration testing, etc. ➢ CON0002062 RESPONSIVE technical controls in place inc. malware containment and recovery tooling. 20. The DGB will continue to review controls and actions in accordance with the residual risk rating, which is presently quarterly. Reporting to CMT and the Audit & Scrutiny Panel continues to be scheduled in accordance with the timelines recommended by the Chief Officer of Audit and Risk. COMPLIANCE WITH DATA PROTECTION AND GDPR REQUIREMENTS 21. UK GDPR and the Data Protection Act 2018 categorise the Council as a Data Controller, with the DPO tasked with ensuring compliance with all associated data protection arrangements. Responsibilities include maintaining relevant policies, monitoring compliance with such, raising awareness of those policies and ensuring relevant training is provided to all staff to enable the Council to satisfy its legal obligations. Since May 2018, the Council has also had a legal obligation to undertake Data Protection Impact Assessments (DPIA) when processing personal data. 22. This section of the report highlights any breaches of confidentiality and security considered by the DGB during financial year 2021-22, alongside assessment of the remedial actions identified.
Page 14
7 23. The Chief Officer of Legal and Democratic Solutions is scheduled to present details of the Council’s 2021-22 data protection compliance alongside the outcome of the review of Corporate Data Protection arrangements to the Finance & Resources Committee on 1st March 2023. In line with paragraph 11 (c) above, he has however submitted details of 2021-22 data protection compliance to the December 2022 meeting of the DGB for consideration and review. 24. Paragraph 11(d) above further illustrates that numbers of breaches and near misses are reported to the Data Governance Board (DGB), with remedial and learning actions arising from investigations discussed to ensure clarity of change and/or requirement, with such subsequently cascaded council wide through the Data Management Team (DMT). 25. In financial year 2021-22, the Council recorded and investigated 69 potential data breaches, a significantly higher level (41% increase) compared to the previous year level of 49. These figures can be interpreted in two ways. Firstly, higher numbers reported demonstrate employees are aware – per the approved Data Protection Policy – of the requirement to report incidents, ergo demonstrating good awareness of data protection and information security requirements. Secondly however, higher levels of breaches do give cause for concern as these have the potential to lead to information falling into the wrong hands. Considering this alongside the timescales for reporting of breaches is therefore key to ensuring the Council is compliant with the Data Protection principles. 26. To enable the Council to comply with its obligation to report high-risk personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of said breach, all NLC officers, staff, elected members and third-party contractors must inform Legal and Democratic Solutions of personal data breaches and ‘near misses’ within 72 hours of incidents occurring. The DGB considers 90% to be a realistic KPI for reporting potential breaches to Legal Services, with performance against this monitored quarterly. For financial year 2021-22, actual performance averaged 69.6%, with only 48 breaches reported within 72 hours. Improvement is therefore required, and activity to raise awareness of the 72-hour reporting timeframe will be factored into the DMT’s action plan. 27. Chart 1 below compares recorded breaches from 2018-19 to 2021-22. The high volumes recorded in November 2018 and October 2021 follow targeted promotion of mandatory training on GDPR and Data Protection, thereby demonstrating that increasing – and then maintaining - awareness of personal responsibility on the use and protection of information better enables the Council to identify and address data breaches, near misses or information security incidents. Chart 1
Page 15
8 28. Chart 2 below compares the recorded breaches, per service, over the 2018-19 to 2021-22 timeframe. Chart 2 29. In investigating recorded incidents, consideration is given to whether such should be referred to the Information Commissioner’s Office (ICO). Reportable incidents are considered to present a risk to the rights and freedoms of individuals, and for financial year 2021-22, 5 incidents satisfied this threshold and were reported accordingly. This is a significant improvement on the previous year position of 12 incidents being reported to the ICO. Notwithstanding the overall improvement, the reported incident regarding a cyber- attack on a system used by a council contractor highlights vulnerabilities can and do exist within supply chains. Business and Digital sought to actively address this risk during 2021-22 through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit. 30. Categories of breaches include device/documents left in insecure locations, unauthorised system/app use, failure to redact data and wrongful disclosure of data. Per the DPO’s Annual Data Protection report, there was no enforcement action or fines applied by the ICO in respect of these breaches, but various recommendations were made. These include reviewing existing policies and practices, working towards a high completion rate for information governance training, and reviewing the security and procedures surrounding the issue of correspondence by services which include customer details. DGB discussions confirmed learning actions were appropriately documented, with all recommendations subsequently included within the action plans of both DGB and DMT. ICT SECURITY AND CYBER RISKS 31. As the importance of digital information and networks grow, cyber security is of high importance and therefore a corporate priority. The type of risks posed include theft of sensitive corporate and personal data, theft or damage to data, threat of hacking for criminal or fraud purposes, and potential disruption to infrastructure such as Council ICT systems, intranet, and public facing website. 32. The Council complies with the requirements of the Scottish Government Cyber Resilience Framework by having the Chief Officer of Business and Digital, as SIRO, identified as responsible for organisational cyber resilience arrangements. In addition, the Council works towards adoption of recommendations published by the National Cyber Security Centre (NCSC), who advise that cyber risk has been, and is likely to continue to, increase substantially. To mitigate against cyber risks, the Council follows published NCSC guidance and adopts the following approaches:
Page 16
9 a. Full compliance with the externally inspected Public Sector Network (PSN) accreditation via submission of the required IT health check applications, and implementation of all recommendations subsequently identified as potentially high risk. Our next accreditation submission date falls due in May 2023. b. Compliance with the Payment Card Industry Data Security Standard (PCI DSS), with the Council now fully compliant across both person present and ecommerce payment channels, and work under way to achieve the same for the telephony channel. c. A suite of malware protection products fully deployed e.g., antivirus software, web filtering, and email malicious content/payload detection systems, together with real- time analysis of security threats identified and managed through deployment of Security Incident Event Management (SIEM) software. d. Firewalls installed to protect the network, systems, and devices from external attack, exploitation, and data breaches, with an external contract in place to undertake penetrative testing, and any issues, anomalies or system vulnerabilities identified, investigated, and remediated. e. Operation of a robust “patching” regime, with such automatically applied on scheduled dates or as and when critical vulnerabilities are identified, and patches made available; f. Robust authentication and access control procedures e.g.: multi-factor authentication, in place to protect Council systems from unauthorised access, with such now of significance given the increase in hybrid and mobile working by individuals in response to the Covid-19 pandemic. g. ICT systems securely configured as part of the initial commissioning process, with formal change control procedures being in place should system settings need to be modified. h. Office “based” staff required to complete Mandatory Information Security Awareness training. i. External assurance of the Council’s cyber security posture provided through accreditation against HMG’s PSN ‘Code of Connection’. As above, the Council’s current accreditation runs through to May 2023. 33. The Information Security and Information Governance risk process described in paragraphs 14 to 20 above does not record all activities underway to maintain the Council’s security posture considering the threat landscape. Business and Digital officers routinely seek to improve arrangements, with the Audit and Scrutiny Panel previously advised of the self- analysis tool used during 2020-21 to help identify priority improvement actions. In light of the findings from the self-analysis and additional input from the Council’s security, governance and operations teams, the following ICT and cyber security focussed activities were undertaken during 2021-22: ➢ Deployment of the DigitalNL agenda and migration to M365 allowing the application of improved conditional access controls. ➢ Procurement of a new anti-malware solution, Microsoft Defender for Endpoint, which offers improved integration with the Council’s Microsoft suite of products when compared with the previous toolset. ➢ The in-sourcing of Culture Leisure North Lanarkshire Limited (CLNL), offering the opportunity to embed a much-improved cyber security posture across the activities of these previously external organisations. ➢ Creation of a better resourced larger security team (the Information Risk and Security Team). This now has 4.8 FTE members of staff, in addition to one temporary member and a modern apprentice.
Page 17
10 ➢ Review of ICT disaster recovery (DR) arrangements undertaken, and improvement plan created, which is currently being worked through. ➢ Testing of ICT resiliency capability through use of the NCSC developed ‘Exercise-in-a- Box’ toolkit. ➢ Procurement of a phishing simulator solution, subsequently launched in financial year 2022-23. ➢ Improvements to supply chain management security through adoption of the Scottish Government’s ‘Cyber Security Procurement Support Toolkit.’ ➢ Commencement of a programme to develop a suite of documented security standards. The focus on 2021-22 was ICT DR and supply chain. The future document set has been identified and aligns with the international information security standard ISO 27001. ➢ Replacement of the previous web gateway with a more modern, capable, and flexible product (Netskope) which offers improved performance for the new model of hybrid working adopted by the Council. ➢ Reducing scope for hackers to access Council data by revising the password policy for council systems and devices 34. With compliance standards now including requirements to for example, fully transition to supported tools and deploy all updates/patches within 14 days of release, achieving compliance is cost and resource prohibitive for the Council. To provide some context, the council’s technology network presently includes 656 servers, circa. 200 server software/applications and approx. 1,500 different desktop/device types of software. 35. Whilst the Council’s DigitalNL transformation programme continues to transition all products to more secure and modern cloud-hosted solutions, such cannot be achieved overnight. In considering that business-critical systems such as MySwis, eFinancials and Achieve rely on older – and often unsupported – software and applications, alongside the resources (people and money) required to fully replace such, there is presently no scope for the Council to satisfy all the requirements of compliance schemes such as Cyber Essentials. Business and Digital will continue to protect the Council from common cyber-attacks through PSN accreditation and regular threat assessments, but in times of increasing cyber-attacks and continued use of ageing legacy applications, there is a growing concern regarding the Council’s ability to fully secure the data held on business-critical applications. 36. The council was not affected directly by any ICT or cyber security incidents over the course of 2021-22. However, it was and continues to be affected by day-to-day events that all organisations are affected by, and which are mitigated through the suite of technological and process controls in place, such as email filters, web gateways, network firewalls, web application firewalls, and anti-malware tools. In December 2021 the Council was notified of a major vulnerability that affected nearly all organisations globally, known as ‘Log4J’. Several Council and third-party hosted systems which the Council relies on were identified as being potentially affected. Appropriate measures were taken to address these, with workarounds in play on impacted legacy systems such as efinancials now heavily tracked to facilitate quicker identification of potential vulnerabilities. CORPORATE GOVERNANCE ACTIVITY 37. The Council is committed to a clear strategy and sustainable framework for information governance and security so deploys its requirements through its Information Governance Policy Framework, most recently reviewed and approved by the Policy and Strategy Committee in June 2021. Having also refreshed its corporate working arrangements during
Page 18
11 2019-20 to create the Data Governance Board (DGB) and Data Management Team (DMT), revised arrangements now see Business Data Owners assigned to manage the data classifications of customers, cases, people, and the organisation. DGB Self-Evaluation 38. An internal audit of Information Governance and Information Security (reported in March 2021) recommended the DGB and DMT be reviewed to ensure both groups were effectively discharging their respective roles to develop, implement, and ensure compliance with data governance and management strategies, policies, and standards. 39. With a self-assessment recommended, and the Chief Officer of Business and Digital championed to ensure alignment with the Strategic Self-Evaluation Framework, the DGB agreed in May 2021 that 17 statements from the Strategic Self-Evaluation Framework were in scope for its self-assessment exercise. 40. The evidence obtained from the self-evaluation presented to the DGB in September 2021 demonstrated the DGB has a clear vision and effective leadership with a sound approach that provides a clear direction for its work. This approach is underpinned by well-defined processes, is aligned to The Plan for North Lanarkshire, and supports the council’s aims and objectives. Findings also confirmed the DGB regularly reviews its approaches and makes improvements as a matter of course to ensure the security of the council’s information resource. 41. The self-evaluation considered the statements outlined within Table 1 below to be areas of good practice: Theme Assessment Statement Vision and Leadership Strategic plans reflect a pace and depth of improvement that will lead to the realisation of the local authority’s priorities and the long-term sustainability of services. Leadership is effective and there is good collaborative working. Members and senior managers have a culture of co-operation and working constructively in partnership, informed by a clear understanding of their respective roles and responsibilities and characterised by mutual respect, trust, honest, and openness and by appropriate behaviours. Governance and Accountability An information governance framework is in place that ensures proper recording of information, appropriate access to that information including by the public, and legislative compliance. Table 1 42. Four improvement actions were identified in respect of the efficient operation of the DGB and effective use of resources, and these are therefore reflected within the live action plan detailed within section 65 of this report. 43. Having concluded the self-evaluation and Terms of Reference review, Board membership continues to focus on the key master data entities of customers, cases, people, and organisation. All Business Data Owners remained constant throughout 2021-22, with assessments and activities focussed on actions which will improve compliance and see Council data virtualised and available as ‘a single view’ to aid decision-making.
Page 19
12 Information Governance Training 44. The DGB and DMT have responsibility for continuously monitoring the actions required to manage information issues, risks, and cultural behaviour to improve existing data governance and management. Paragraph 11(h) above specifically references the importance of information governance training, an identified area of improvement and activity over the last few years. 45. The Audit and Scrutiny Panel were previously advised through the SIRO report 2019 – 2021 of several steps being taken throughout 2019-20 and 2020-21 to refresh, promote and monitor completion of mandatory Data Protection Essentials, Records and Information Management and Information Security training modules. However, a low uptake of these mandatory modules remained as an identified improvement area within the Information Governance Internal Audit report presented to the Audit and Scrutiny Panel in March 2021. In recognising this recommendation alongside the TUPE transfer into the Council of staff formerly employed by Culture Leisure North Lanarkshire Ltd (CLNL) and a requirement to identify posts mandated to complete the Data Protection Advanced module, the DGB determined that further development and promotion of proportionate training be included as an area of focus within its live 2021-22 information governance action plan. 46. Progressing this action through the Data Management Team, the Business Data Owner for the ‘people’ data entity and Business and Digital’s Relationship Manager developed a suite of information governance and security training modules for services to tailor to suit the needs of their individual posts. Information governance training now available to support employees to ensure information/data is held securely, processed appropriately and safely destroyed when not required can therefore be summarised in Table 2 as follows: ‘Course’ Employees in scope Context Existing KPI Data Protection Essentials All except frontline workforce 12,530 √ Information Security Awareness Records and Information Management Data Protection Advanced Those with staff management responsibility 1,939 √ Frontline Toolbox Talk Frontline workforce 2,300 Table 2 47. Acknowledging that work remains ongoing to improve both training take-up and performance monitoring, and to commence the tailored toolbox training for frontline employees, chart 3 below details the level and percentage of completions, per service, for each of the mandatory modules, as well as the Data Protection Advanced training module now categorised mandatory for those employees with staff responsibilities. Chart 3 also compares the level of completions against those expected – per service – so providing an evidential base to support further targeted activity. 48. Chart 3 further illustrates that the Data Protection Essentials course has had the highest ‘attendance’ over the 2-year period to 31st March 2022, with 6,299 (50%) of employees having completed the mandatory courses. “Attendance” at each of the essential mandatory courses remains largely consistent in overall terms, with 5,969 (48%) employees having also
Page 20
13 completed Information Security Awareness and Records and Information Management mandatory modules. Chart 3 49. Initially introduced in September 2020, the Data Protection Advanced module received its mandatory classification status in June 2021, resulting in significantly higher numbers of in scope employees – 1,223 (63%) – achieving certified status by 31st March 2022. Compliance levels per service for this advanced module range though from 48% in Enterprise and Communities (485 employees) to 100% within Chief Executive (226 employees). 50. There is clearly variation present in each service’s level of compliance with the mandatory training requirements. Focussing upon the ‘essential’ modules, members may wish to note compliance levels range from 36% in Adult Health and Social Care to 66% in both Enterprise and Communities and Chief Executive office respectively. 51. Though presenting an obvious area of concern and a need for targeted activity and improvement, the low statistics within Adult Health and Social Care are understandable given the pressures facing the service following the outbreak of the Covid-19 pandemic, and the challenges faced therein in managing attendance and retaining/recruiting to essential service delivery posts. 52. Turning now to Education and Families. Whilst there has been an intensive period of training underway within Education and Families, particularly within their Active and Creative Communities functions, compliance levels within this service – circa. 46% - are visibly lower than required, highlighting further targeted activity is required. 53. Given mandatory modules need to be completed biennially, this information forms the starting point firstly for the DGB to gain assurances that staff are being trained in information governance; secondly, to identify areas requiring targeted activity, and finally, to assess the 0 2000 4000 6000 8000 10000 12000 14000 In Scope Compliance In Scope Compliance In Scope Compliance In Scope Compliance In Scope Compliance Chief Executive's Adult Health and Social CareEnterprise and Communiti es Education and Families Council Totals INFORMATION GOVERNANCE MANDATORY TRAINING COMPLIANCE AS AT 31 MARCH 2022 Records and Information Management Information Security Awareness Data Protection Advanced Data Protection Essentials
Page 21
14 impact which planned improvements regarding performance monitoring have had. Chart 4 below provides the Audit and Scrutiny Panel with additional context, through analysing the peaks and troughs of training activity progressed in the 2-year period April 2020 to March 2022. 54. As noted in the SIRO report to March 2021, the ‘essential’ mandatory completions were very low council-wide during the early months of the pandemic, with compliance vastly improving from August 2020 following promotion of modules by DGB and DMT members and regular NLC email announcements advising employees to ensure information remained secure whilst working from home. It is clear from the chart below that targeted promotion, generation of automatic ‘reminder’ emails from Learn NL and events such as the annual Information Management Week do appear to spur employees to complete their training. However, percentage compliance levels do still provide cause for concern, requiring awareness raising and GDPR compliance to remain as a key activity on the information governance improvement action plan for 2022-23. Chart 4 Data and IM Strategic Roadmap 55. As outlined in paragraph 37 above, the Council refreshed its corporate information governance arrangements following Policy & Strategy Committee approval of the Digital & IT Strategy 2019-2023. These refreshed arrangements commenced in January 2020, with the Data Governance Board and Data Management Team having opportunity to enhance their knowledge of each group’s remit, the DigitalNL transformation programme and existing information governance policies, thereby fully preparing them to support the Council to ensure that its information governance policies and management arrangements reflect current legislation, guidance/policies, and relevant professional codes of practice. 56. The development of a data-driven decision-making model is a key deliverable of the DigitalNL transformation programme and The Plan for North Lanarkshire (“The Plan”). As previously advised to the Audit and Scrutiny Panel, this model sits at the centre of the Data and Information Management Strategic Roadmap (the Roadmap), endorsed by the former Transformation and Digitisation Committee on 24th February 2021. 0 100 200 300 400 500 600 700 800 900 1000 Mandatory module completions trend April 2020 to March 2022 Data Protection Essentials Data Protection Advanced Information Security Awareness Records & Information Management
Page 22
15 57. The Roadmap provides a strategic vision for data, supported by the development of both the Data Custodian Data Governance model and a Business Intelligence Hub to transition the Council from its existing ‘basic’ data maturity score to an ‘advancing’ score, with all data being virtualised and available as ‘a single view’; firstly to assist services in monitoring performance against The Plan for NL outcomes, and secondly, to support strategic decision making, service delivery, cost reduction and risk management arrangements. 58. The Roadmap presents as a series of work packages to provide opportunities to facilitate an incremental improvement in the Council’s data maturity score. To enable the Council to establish clear timelines for the transition, the Data Governance Board: a. Successfully changed membership from service specific representation to functional master data representation. with Business Data Owners identified for the key master data entities of customers, cases, people, and organisation effective from January 2021. b. Manages the development and delivery of the Data Custodian Model including role descriptors, data quality guidance and critical data audit as outlined in paragraph 60 below. 59. The former Transformation and Digitisation Committee reviewed the roadmap progress in February 2021, noting such would be driven forward through the DGB over an envisaged 3- year timeframe. Through Business and Digital’s Programme of Work 2021-22, a further update of progress against this strategic data roadmap was reported to Committee in November 2021. 60. Four key Roadmap recommendations are detailed in Table 3 below for Audit and Scrutiny Panel information, together with the progress made during 2021-22: Roadmap Recommendation Update Formalise and cascade the Council’s data and information management vision, ensuring such aligns with The Plan for NL, DigitalNL objectives, and the approved Digital & IT Strategy. • Continued focus on the vision with ongoing oversight through the Data Governance Board and progress reviewed at each meeting. • Data Governance Board completed self-evaluation during 2021-22 and Data Management Team self-evaluation process now programmed for 2022-23. This will embed the Data Custodian model fully within the governance framework Ensure data is viewed and used as an asset by implementing a revised Data Governance and Management framework and appropriately defining and using Business Data Owners, Line of Business Data Stewards, and Data Architect roles. • In May 2021 Framework agreed. Roles of Business Data Owners and Line of Business Data Stewards defined and DGB members shared with Service Management Teams to ensure appropriate consideration in development of Delivering for Communities Transition plans. • Data Quality Checklist agreed in principle in May 2021 with data quality assessment guidance to follow. • Work continued with Line of Business Data Stewards for the Data Entities of Customers, Cases and Place identified in September 2021.
Page 23
16 • Introductory session for nominated Line of Business Data Stewards across the council took place in January 2022. This session introduced the new Data Governance Framework, outlined the role of Line of Business Data Steward role, and launched the Critical Data Audit. • As BI Hub development continues the required personas including the Data Architect role continue to be scoped and skill requirements identified. This is a key deliverable identified for Phase 4 - July 2022 - March 2023. Within the Data Governance Board, structured around four new key ‘entities’ of Master Data, Customer, Cases, Employees and Place, develop clear oversight of use and quality of data for each. • In progress - identification of Business Data Owners for each data entity complete. • Mapping exercise for each complete. • Current phase of Critical Data Audit for all council data underway to be completed Summer 2022 and thereafter analysed for consideration by DGB. Develop a hub and spoke Business Intelligence (BI) Hub, with key roles embedded in directorates, and the core hub based in Business and Digital Solutions. • In Progress – Data Intelligence team created and BI Hub in development. Data Insights Manager recruited and in post January 2022. • Phase 3 development nearing completion and was focused on the development and delivery of a wide range of data products. • Phase 4 programmed for July 2022 - March 2023 and will focus on skills and knowledge transfer from the contracted provider to Council staff to ensure the Business Intelligence Hub can be developed and maintained in-house by Council staff when the current contract expires. This will include finalisation of the Operating Model which includes role descriptors and skills requirements both basic and advanced linked to the Data Custodian model. Develop a formalised data quality improvement framework to increase trust in data, facilitate more effective data sharing, and to ultimately use a single source of information to predict future trends and demographics, thereby supporting effective resource allocation and service delivery. • In progress - draft data quality assessment guidance approved by DGB in November 2021. • Critical Data Audit launched January 2022 and will be completed Summer 2022. • Next stage will be Critical Data Audit learning fed back to DGB and thereafter quality standards will be agreed, and improvement actions identified for each data entity. • Line of Business Data Stewards identified development of a new Line of Business Data Steward Lead role underway and following Data Management Team self-evaluation will be incorporated into this team. Table 3 - Data and Information Management Strategic Roadmap (the Roadmap) Progress
Page 24
17 Records Management Plan 61. The Public Records (Scotland) Act 2011 Assessment Team has a mechanism that allows authorities to self-assess on its records management arrangements and the commitments it laid out in its current Records Management Plan (RMP). The Council was commended for submitting a Progress Update Review (PUR) and continuing to take its statutory obligations seriously in this report from February 2021. NRS – Progress Update Review (PUR) Final Report by the PRSA Assessment Team for North Lanarkshire Council and Licensing Board, February 2021 (nrscotland.gov.uk) 62. Because of the Assessment Team’s scheduling issues, no PUR was requested or submitted in 2021-22 but the Council will participate in the scheme in 2022-23. The Council continues to work on the areas that the Keeper of the Records of Scotland identified for improvement namely File Plan, Destruction Arrangements, Vital Records and Audit Trail. Much of this work is currently being addressed by migration to a file plan within O365 and implementation of automated retention periods. 63. The current RMP is now five years old, but the Corporate Records Manager has not yet received an invitation to submit a new Records Management Plan. It is known that there are some delays in issuing invitations so it may be 2023 before this invitation is received, as determined by the Assessment Teams own schedule. The Assessment Team generally give a six-month timeline to complete and submit a new Records Management Plan.
Page 25
18 LIVE IMPROVEMENT PLAN 64. Paragraph 11e above highlights the DGB Terms of Reference require the group to establish, resource and monitor an information governance improvement plan. Such an action plan is maintained, and outlines key tasks required, together with details of the responsible officers, completion timescales, status, and percentage complete. The plan is monitored by the DMT and is a standing agenda item at meetings of the DGB, enabling progress updates and escalation of specific tasks as required. 65. By its nature, the plan must be flexible and dynamic, with any new improvement areas identified by for example services, Business Data Owners, management, and Internal Audit appropriately incorporated. The following represents a summary of the key actions included within the improvement plan at March 2022. It is envisaged these will be progressed throughout 2022-2023 to further strengthen the Council’s information governance and data accuracy arrangement a. Refresh and strengthen approach to mitigating Cyber Security risks ➢ With Cyber Essentials cost prohibitive for the Council to use, our focus has shifted to using PSN accreditation as the principle means of demonstrating external oversight of the Council’s security posture. With the Council having accredited to the PSN through to May 2023, work has already commenced on ensuring this is maintained beyond then. ➢ Continual improvement to manage risk is the bedrock of information security practice within the Council. From a thematic perspective, improvement actions currently underway can crudely be separated into the adoption of technical and non-technical controls. The programme of work to improve technical security includes examination and where necessary upgrading access and authentication controls. As intimated, separation between what may be termed technical and non-technical controls is crude, and this line of activity extends to the less technical elements such as user onboarding and offboarding practices. Other technical improvements on the current roadmap include the procurement of new backup tools to provide better assurance around the integrity of backups, and the onboarding of a new security event and incident management system. ➢ The application of technical cyber security controls is one dimension where the council will continually seek to make improvements where warranted. At the same time, processes for managing risk and assuring the council’s posture will continue to be taken forward. A programme of documenting baseline security controls is under way to demonstrate alignment with Scottish Government expectations for the Scottish public sector. Awareness-raising for staff will continue to be a significant theme, with formal council training materials being scheduled for a major review. Compliance will continue to be a significant theme with PCI DSS and PSN regimes being the focus. Internally, collaboration with Internal Audit will continue to take place to ensure appropriate controls and practices are adopted as necessary. ➢ Several other initiatives are planned for 2022-23, including procuring a cyber incident retainer partnership with a third-party organisation experienced in managing major cyber outages, and on a related note improving ICT disaster recovery and incident response practice. Improving the gathering of metrics about security posture and threat will be looked at, as will elements of supply chain security, and benefits of cyber insurance.
Page 26
19 ➢ In the previous SIRO report workstreams were identified from the findings of the Information Security Maturity Assessment (IT Score) exercise carried out in January 2021. Though paragraph 33 details activities progressed to deliver on required improvements in respect of controls catalogue, monitoring risk exposure and documenting technical plans, capacity issues will always remain, and to that end, Business and Digital will look to assess itself against Gartner’s Information Security Maturity Assessment by the end of financial year 2022-23 to ensure improvement effort scheduled reflects the right priorities and business needs. b. Implement Improvement Actions identified in DGB Self-evaluation exercise Section 42 above illustrates that DGB effectiveness can be enhanced by addressing four identified improvement areas as follows: ➢ Enhancing the knowledge and understanding of all DGB members, especially those new to the role ▪ Develop induction pack for members, comprising role profile, FAQ, and jargon buster ▪ Provide opportunities for members to have oversight of Disaster Recovery plans to ensure systems remain resilient ▪ Implement membership monitoring scheme to ensure regular attendance of knowledgeable individuals ▪ DGB members to confirm completion of all mandatory e-learning ▪ Occasionally focus agendas on deployment of the Data Custodian Model. ➢ Raising awareness and understanding of information security and governance, and managing information as a strategic resource across the Council, and with the public through the Community Boards ▪ Develop a targeted communication plan to raise the profile of the work of the DGB and DMT ▪ Develop protocols regarding data sharing ➢ Fully deploying the various processes and practices more systematically and consistently across the Council ▪ Develop champion process / lead Data Steward for each master data entity ▪ Develop information governance guidance on working with O365, focussing on file creation, file migration, effective use of Teams etc ➢ Making better use of a range of tools, techniques, and measures to regularly assess and promote the effectiveness and success of the work of the DGB ▪ Develop measures of success for the DGB, establishing a baseline which facilitates measurement of outcomes
Page 27
20 c. Raise the profile and prioritisation of Information Governance and Data Protection responsibilities ➢ Section 2 above illustrates everyone - staff and elected members - must understand the importance of information governance and security, as compliance with its requirements depends on all operating good practice. ➢ Mandatory training completion rates for the last 2 years - as detailed in sections 61 and 62 above - remain lower than desired. In considering this alongside the less than satisfactory level of data breaches reported within 72 hours (paragraph 26), awareness raising, and targeted promotion clearly remain a key priority on the information governance improvement plan. To improve scope for this activity to increase compliance levels, the feedback received through LearnNL training evaluations will be used to improve and tailor course content to the needs of individual posts. ➢ Additional discretionary training, linked to the new requirements associated with Business Data Owners, Data Stewards, and Data Architects, is required, and will therefore be developed during 2022-23. ➢ The Business Data Owner for the ‘people’ data entity (Employee Service Centre Manager) and Relationship Manager within Business and Digital will continue to work with services as a priority to: ▪ Deploy tailored toolbox training for frontline employees ▪ Identify posts required to complete mandatory information governance training modules. ➢ Both will also work with the Talent and Organisation Development (TOD) team to identify training to appropriately increase the awareness of other roles and elected members regarding their responsibilities to ensure information and data is held securely, processed appropriately and safely destroyed when not required. d. Incremental implementation of the Data and IM Strategic Roadmap (the Roadmap) ➢ Section 60 above illustrates the Roadmap will be implemented through a series of work packages. Given the inherent links to the DigitalNL Programme and developing Business Intelligence Hub, aspects of the Roadmap are already underway. Other aspects will be taken forward incrementally through the DGB and DMT, with detailed timescales for delivery established. ➢ The new Data Governance and Management Framework is essential for ensuring data is viewed and used as an asset council wide. This, and the associated Data Custodian, Data Steward, and Data Architect roles, will be further defined, developed, and deployed within services through the refreshed DGB and DMT arrangements. ➢ DMT Terms of Reference to be reviewed to ensure effective alignment with the approved Data Governance and Management Framework. DMT membership to vary to ensure Data Steward representation adequately reflects all key Line of Business (LOB) systems, with joint work between services and Business and Digital planned to identify all key LOB.
Page 28
21 CONCLUSION 66. In summary, significant progress to strengthen the Council’s approach to managing its information risks continued throughout 2021-22 with sections 37 to 63 above providing relevant context and detail. 67. Improvements can always be made, and with a residual risk score of 20 prevalent in respect of our Information Governance and Information Security corporate risk (March 2022), this subject matter remains a high priority improvement area for the Council. 68. A detailed improvement plan exists and is monitored by the DMT. A summary of the priority actions at March 2022, is detailed above. Progress against these will be managed by the DGB throughout 2022-23, who will look to further develop policies, guidance, standards, processes, and approaches as appropriate to improve awareness, understanding and compliance with legislative requirements and good practice. 69. There is a growing concern however, in these times of increasing cyber-attacks, regarding the Council’s ability to fully secure the data held within older legacy business applications. Action is therefore required through existing capital and revenue resources, and Business Continuity Planning, to address this growing risk. Katrina Hassell Chief Officer of Business and Digital