APPENDIX 1 COMHAIRLE NAN EILEAN SIAR IT STRATEGY

Transcription

1 APPENDIX 1 COMHAIRLE NAN EILEAN SIAR IT STRATEGY VERSION 4.0 MAY

2 Item Table of Contents Page CHANGE HISTORY INTRODUCTION BACKGROUND AND SUPPORTING POLICIES REVIEW PROCESS POLICY STATEMENT DRIVERS FOR THE STRATEGY DEPARTMENTAL LEGISLATIVE TECHNOLOGICAL FINANCIAL KEY AREAS OF INFRASTRUCTURE DESKTOP HARDWARE DESKTOP SOFTWARE SERVERS NETWORK WEB DEVELOPMENT CORPORATE APPLICATIONS TRAINING SECURITY PARTNERSHIPS WITH EXTERNAL AGENCIES BUSINESS CONTINUITY/DISASTER RECOVERY STAFFING RISK MANAGEMENT FUTURE DEVELOPMENTS CONCLUSION

3 Change History Version Date Change By No. 2.0 March 2012 New Revised Version (Draft) A Macarthur 3.0 May 2012 Following comments from CMT A Macarthur 4.0 June 2012 Final Version for Committee Approval A Macarthur Next Review date June

4 1 Introduction 1.1 This document sets out, within the context of the last year of the current capital programme, an Information and Communications Technology (ICT) Strategy which seeks to build on existing commitments and policies by continuing to develop new IT solutions that will allow the Comhairle to conduct its business in a user-friendly and efficient manner. 1.2 The strategy sets out the general framework within which technology can be used to improve the Comhairle s front-line services and the quality of information available both to the public and to officers of the Comhairle. 1.3 The fundamental basis of strategic ICT planning is alignment with the business objectives of the organisation, taking into account individual departmental aspirations. The IT systems must not only support current business operations, but must be capable of supporting and adapting to future business plans and, where applicable, enable re-engineering of whole areas of business. 1.4 It is important to recognise that the ICT Strategy is not primarily about technology or organisational structures but about understanding the requirements of individual departments and integrating them into a coherent corporate strategy that meets both the needs of individual departments and the Comhairle as a whole. The objective is to promote change rather than simply to provide IT services. However, it is still essential to have the appropriate technical framework in place in order to support the business. 1.5 The general aim of the strategy is to exploit IT in order to improve the way that services are provided by: Improving access to the decision making processes of the Comhairle. Ensuring that IT provides the support to allow services to be organised around the user of the service. Allowing IT to transform the way the information is made available to the public and how it is accessed. Using IT to support the provision of services at times and in locations that suit the service user. Maximising the contribution that IT can make to the reduction of overheads and back office costs. 1.6 The strategy is aligned with the Comhairle s aims and objectives through the Single Outcome Agreement that means that the IT Unit therefore has to be structured in such a way as to respond effectively to the demands that are on it. The structure of the Unit depends on the objectives of the strategy and consequently on its ability to deliver its objectives. 3

5 2. Background and Supporting Policies 2.1 Shorter term strategic information is already available in the IT Business Plan which sets out major projects for the coming year and which is reported to the Comhairle quarterly. The report details progress on the key ICT projects and highlights missed milestones or unanticipated delays. 2.2 The Information Security Policy also sets out the essential framework within which IT resources are acquired, deployed and used. Its purpose is to set out an overall strategy for the management of the risks associated with information. 2.3 The Policy on Laptops and Portable Devices builds on the Information Security Policy and strengthens key areas within it. 2.4 Finally, the Comhairle s /Internet Acceptable Use Policy sets the framework for staff and Members on their use of online resources and provides guidance for general use of IT systems. 3. Review Process 3.1 The IT Strategy arises from several different areas of activity throughout the Council. Different strands of information on the development of IT are drawn together and integrated into the one Strategy. These sources include regular meetings with departments, long term business plans, the IT Business Plan, government legislation and technology developments. 3.2 The strategy itself is reviewed every three years to take account of any major shifts that occur, becoming in effect a rolling strategy that guides development on a continuing basis. The last version of the Strategy covered the period from Policy Statement 4.1 The Comhairle will take a strategic and long-term approach to the planning and implementation of its information and communications technology. 4.2 It will ensure that information and communications technology architectures serve its current needs, take into account its strategic business objectives and provide it with a sound and flexible base for future development. 4.3 In order to deliver these benefits the Comhairle will ensure that the required funding is put in place, subject to the general financial constraints under which the Comhairle operates. 4.4 It is the role of the IT Unit to articulate the detail of departmental and corporate business plans within a technical strategy that delivers the most appropriate service to the Comhairle and the public. 4

6 4.5 The acquisition of IT systems, whether hardware or software, must, under all circumstances, be first discussed with IT to ensure that the Comhairle gets value for money and that any developments fit in with the wider strategy. The procurement of IT hardware and/or software without the approval of the Head of IT & Customer Services is contrary to the Comhairle s regulations. 4.6 In order that the full benefits of the strategy are enjoyed by all areas of the Comhairle, it is important that all decisions about the acquisition of ICT should be consistent with this policy, and that all service providers and users of technology accept and adhere to the principles set out in the strategy and the policies which support it. 5. Drivers for the Strategy 5.1 Departmental Although informal discussion on specific aspects of IT continue to be held with departments on an on-going basis it is proposed that formal meetings be established, on an annual basis, to help departments evaluate how IT can help to deliver their business objectives. These meetings would provide an opportunity for departments to agree changes and developments that may be required to support their business activities with any subsequent changes being applied to the Strategy as required. 5.2 Legislative Data Protection The Comhairle will continue to ensure that it will process and manage data in line with the obligations that are placed upon it by the Data Protection Act Freedom of Information Since January 2005 the Freedom of Information (Scotland) Act has added substantially to the drive to improve the retrieval mechanisms for information. Historically, information management has proved to be a difficult area and the proliferation of IT systems, with easy creation and storage of information, has contributed towards the challenge that the Comhairle now faces. Therefore, the Strategy will look at mechanisms that will improve the way information is identified, stored and retrieved Government Initiatives This quasi-legislative requirement offers the opportunity of bringing to fruition some long-standing IT objectives. The trend over recent years has been to focus closely on nationally driven projects, with some very specific directives coming from the Scottish Executive e.g. McClelland, the Digital Futures Strategy, SPSN and specific projects such as Tell Us Once. Nevertheless, it has begun to address issues such as improved public access and seamless integration between systems. However, the IT industry still faces some challenges in agreeing suitable standards for data interchange that minimise the significant cost to bodies like the Comhairle as they move towards universal access to information across all systems. 5

7 5.2.4 Information Security Information security has emerged over recent times as one of the major challenges faced by Local Authorities and the additional powers granted to the Information Commissioner s Office has added weight to the requirement for more effective procedures and systems to protect confidential data. 5.3 Technological Technological drivers for the strategy include the increasing challenges of data storage management, convergence, the need to provide mobile access to central systems, unified communications, security along with the traditional drivers such as the customary, and regular, changes to desktop and operating system software. 5.4 Financial The main financial driver for the strategy is the on-going annual reduction in the Comhairle s capital and revenue budgets. In response, the strategy will look to make more effective use of technology, to re-engineer business processes where appropriate and to advise departments in a way that allows the Comhairle to meet some of the financial challenges it faces while at the same time maintaining and improving services With the pressures faced by front-line services, it is easy for service heads to see the solution as using more IT to drive down costs but this places even more pressure on the IT function. This is no easy challenge but it is felt that IT is in a unique position to play a key role in supporting the Comhairle as it moves forward. 6. Key Areas of Infrastructure 6.1 Desktop Hardware Current status Based on standard PC s and laptops and procured via the Procurement Scotland framework agreement. Specialist specification also available via this agreement. Increasing number of laptops. Total in use is now around Future developments Current desktop standard will continue, albeit at a decreasing rate as other devices begin to play a more significant role. This is already evident from the number of laptops now in use and the introduction of smartphones, ipads and similar technology. Desktop virtualisation will also influence the nature of desktop devices as the requirement for local processing power diminishes. Increasingly, applications will be accessed via browsers and much of the intense processing can now happen at the server end. This puts further pressure on the network and the Strategy will look at upgrading Local Area Networks (LANs) as demand increases. 6

8 6.2 Desktop Software Current status Based on Windows XP, Office 2003 and Exchange Future developments 6.3 Servers As a general rule it is an objective of the strategy to ensure consistency as far as possible and to reduce the number of different versions in use. Gradual move to Windows 7 as user PC s are replaced or as specific requirement arises. Office 2010 being rolled out on a gradual basis as new PC s are installed and where user requirements dictate. New version of Exchange (Exchange 2010) rolled out in April Desktop virtualisation will mean a change in the way that users access common Office applications such as Word, Excel, Outlook etc. Remains to be seen what the licensing implications are going to be although costs in this area are unlikely to go down Current status Largely based on Windows 2003 and Solaris as the preferred Unix platform. Physically independent units for each server. Current server estate is around 70 separate servers Future developments 6.4 Network A move towards a universal Windows environment, based, as far as possible, on a Win2008/SQL environment as the preferred platform for corporate applications. The purpose of this is to standardise the environment and to reduce technical maintenance overhead in order to reduce cost and manage the workload more effectively. Virtualisation of the server estate is seen as an opportunity to make more efficient use of existing hardware resources. The rationale of virtualisation is that the resources (Processor, Memory, Disk) of multiple systems on the same network can be aggregated into a reduced number of physical servers, and defined within software, to make more effective use of each machine s resources. This is seen as a significant change in infrastructure and one of its peripheral benefits is that it will also contribute to the Comhairle s energy saving targets. Virtualisation will also play a key part in the Comhairle s IT Disaster Recovery Plans Current status Given current changes in the service delivery model the availability of a robust network infrastructure is a key aim of the Strategy. Increasingly, the network is becoming a more significant part of IT as access to services depends more and more on a fast and effective network. This applies to both Local Area Networks (LANs) and the Wide Area Network (WAN) The implementation of IP Telephony over recent years provided an opportunity to create consistent LANs at each Comhairle office and at all schools. This means that 7

9 the network configuration and setup is essentially the same at all site types, thus reducing maintenance overhead and making it easier to manage. The Wide Area Network (WAN), which links all LANs together, is provided through Connected Communities and the Comhairle is the major user of this service with around 80% of all network traffic belonging to the Comhairle Future developments Local Area Networks (LANs) at each office have been upgraded in recent years to bring them into line with each other, and, given the increasing importance of networks to IT services, the Strategy will ensure that network infrastructure is maintained at the same high level. The future procurement of broadband at the WAN level is under consideration by the Scottish Government. Several national projects are underway which will affect the future landscape and which are expected to provide the foundation for a national broadband infrastructure. Therefore the Strategy will continue to play a role in the future of broadband services local and at national level with its involvement in Connected Communities, Pathfinder North, Next Generation Broadband (being run under the auspices of BDUK) and the Scottish Public Sector network. 6.5 Web Development Current status The website currently consists of approximately 3000 static webpages which are managed on three servers - two external servers for provision of Internet services and one internal (serving staff as an intranet). Updates and change requests are currently made via and website updates are carried out by the Business Support Section. The website is based on the traditional Local Authority approach and focuses primarily on information provision across a very wide range of areas with little in the way of online forms or self-service opportunities for the public Future developments Future change will concentrate on several key areas and will be driven by public demand for the services the Comhairle provides. Almost all public service organisations have now recognised the strategic importance of self-service via the website, not just because it is efficient, but also because it meets the expectations of many customers. The differential in cost per contact between the three main channels makes it clear that channel shift ought to be a priority. The Strategy will look at several main work streams. The first is to improve the look and feel of the web page and evolve to a more customer focused interface with improves ease of use. Secondly, the strategy will look at upgrading back-end information by converting to a database driven Content Management System. The third work-stream will be to formalise the submission of content through use of templates and forms. Some content submission will be devolved to the departments where appropriate. Against this background the strategy will also look at ways in which social media can be more effectively incorporated into the Comhairle s approach in order to support those departments that see this as another way of improving frontline services. 8

10 6.6 Corporate Applications Current status The Comhairle currently runs around 25 major systems and many smaller PC based systems. The implementation and support of such systems continues to be a significant part of the Business Support team s work Future developments Corporate applications need to be replaced/upgraded on a regular basis as user demand changes and as the technology develops. Recent changes have seen an upgrade to the Comhairle s service from Exchange 2003 to Exchange A new system will soon be required for Home Care Management. The CRM system will continue to be developed to support more online services. Core systems such as Council Tax/Benefits, Payroll and Planning will continue to be supported and developed in line with the business requirement. 7. Training 7.1 The pace of change in IT has not slackened over recent years and it is as important as ever that support and development staff are adequately trained in the right tools in order to enhance their skillset to a level that will allow them to undertake the work required and in order to deliver the strategy as set out in this paper. 7.2 It will be a key aim of the strategy to ensure that support staff are trained to a level that will allow them to make the best use of the technology and to support it as required. 7.3 Details of the staff Training Plan as agreed with staff during the SDA process, are held centrally in the department. 7.4 It is also worth noting that the training budget for IT has been reduced, from 2012 onwards, by 2,500 to 6,000 in order to meet cash planning limits. This means that the Unit risks not having the means to train its staff adequately and has to look to opportunistic funding to pay for training. One option is to build the training requirement into projects that require specialist skills. This is a route to training that is increasingly being used to augment the current shortfall. 8. Security 8.1 Comhairle policy is to ensure that IT systems, including computer systems, network components and electronic data, are adequately protected from a range of threats. The policy covers all aspects of the environment: systems, administration systems, environmental controls, hardware, software, data and networks. It will apply to all stages of the system lifecycle, from feasibility to operation and is independent of whether the system is developed in-house or purchased externally. It is the responsibility of all managers to ensure that the security policy is observed by themselves and their staff. 9

11 8.2 The Information Security Policy continues to be developed as set out in the Information Security Action Plan ( and associated policies. It has been modified and extended in the light of additional recommendations from the Information Commissioners office and the increasingly stringent requirements of the Government Secure Intranet (GSi). The Information Security Management Group (ISMG) retain an overview of activity to ensure that the plan is rolled out across the Comhairle. Recent high profile data security breaches at a national level have served to focus further attention on this key area. 9. Partnerships with External Agencies 9.1 Increasingly IT is being seen as a vehicle for enabling inter-agency collaboration and this is an area that the strategy will continue to encourage by the use of national standards for interoperability between different systems. 9.2 The IT Unit is in regular contact with colleagues at NHS Western Isles with a view to exploring options for sharing services where this is to the mutual benefit of both organisations. Examples include collaboration work within the Data Sharing Partnership, a reciprocal agreement on Disaster Recovery and on-going regular meetings between the respective Heads of IT of both organisations. 9.3 The Connected Communities network is another example of successful inter-agency co-operation that has brought broadband to all schools and Council offices in the Western Isles and is likely to continue to provide the basis for school and office broadband in the coming years. 9.4 The IT Unit is currently the contracted supplier of IT support services to HHP. This is another example of a successful local partnership the contract for which comes to an end on 30 September It is understood that HHP intend to go out to tender for this work sometime before end September 2012 and the IT Unit will be bidding for this contract once again. 9.5 The Comhairle will engage with the Scottish Government and look to work with other agencies as set out in the Government s Strategy Scotland s Digital Future: A Strategy for Scotland and particularly with the Government s ICT Procurement Strategy which is to be published by 31 st March Business Continuity/Disaster Recovery 10.1 For many years now the IT Unit has maintained a Disaster Recovery agreement with an external supplier. The plan is reviewed regularly and is tested every two years at the supplier s premises in Hitchin and Leicester The essence of the agreement is that, in the event of a disaster that renders the current office in Sandwick Road unusable, the supplier will deliver a set of servers with a pre-agreed configuration to the Balivanich office, or other agreed location, within 48 hours of notification, or as soon as possible thereafter depending on weather and transport. Subsequent setup would mean that the systems would not be operational for a further 72 hours. The most optimistic timescale to resume processing would therefore be 5 days. 10

12 10.3 The cost of this service is 12K per annum with a further 1500 per annum to test the plan. It covered a limited amount of systems that were considered to be critical when the plan was first drawn up. This is the traditional approach to IT Business Continuity Planning and is the approach that has historically been taken by many organisations However, technology has moved on making it possible to consider more sophisticated forms of Disaster Recovery. The Comhairle s also needs to consider its geographical location which makes it difficult to guarantee a fast response. Furthermore, the current plan needs to be updated to reflect the increased number of systems now being used. It also needs to reflect the fact that additional systems that were not considered critical at that time now fall into that category The Strategy will look at developing a plan to review Disaster Recovery arrangements so that more effective use is made of new technology. It will look at a local solution, based on a reciprocal agreement with NHS-WI, that will ensure much faster response times in the event of an emergency Therefore, an objective of the strategy, subject to the appropriate resources being available, will be to deliver a Business Continuity Plan that does not depend on support from an external supplier that can be invoked immediately it is required and that can resume processing of critical systems within 24 hours of a disaster. 11. Staffing 11.1 Following on from an earlier department-wide re-structuring, the Comhairle approved proposals to re-structure the IT Unit in June The main objectives of this exercise were to re-focus the Unit on its primary objectives, to make more effective use of existing resources, to respond to changing demand from the business and to take account of VER s and retirements The structure of the Unit is now simplified and comprises a Technical Support Team and a Business Support Team The Technical Support team deals with all operational activities with Support Technicians now taking front line calls in order to free up the Technical Analysts. The Business Support team, on the other hand, has been re-organised to respond to changing demand, especially around the CRM system and the development of Web forms. It also has been sized to ensure effective support is available on all systems during holidays and sickness absences. 12. Risk Management 12.1 The IT Unit Risks are incorporated within the F&CR departmental Risk Register. 13. Future Developments 13.1 As is normal in IT, the pace of change is fairly rapid and the challenges presented by technological developments means that it is important to maintain a flexible approach to IT infrastructure. However, this approach presents its own challenges as it tends to 11

13 undermine longer term certainty and makes it more difficult to imbed solutions with which users are comfortable and which are allowed the required time to develop in order to iron out flaws and inconsistencies Nevertheless, it is essential that the Comhairle continues to exploit technology in order to reduce cost and improve its own business processes. The changes, although relentless, are not fundamental and the strategy will ensure that the appropriate emphasis is laid on the core infrastructure so that future developments are built on a sound technical foundation The most significant change in technology over recent years is probably the emergence of cloud computing and the idea that the actual location of data is less important than access to it. It is no longer considered essential for data to reside onsite but that it can be stored and managed anywhere, given the appropriate network links and security infrastructure This in turn puts enormous pressure on the network and the demand for fast, reliable and secure networks is increasing as cloud technology begins to make serious inroads into the traditional models of IT infrastructure. The issue of cloud technology will form a key part of the strategy over the coming years Although the Comhairle now has in place an appropriate security infrastructure, it is important that adequate protection is maintained as technology develops. The other areas of data presentation and data storage have yet to be seriously addressed and it will be an objective of the strategy, subject to the appropriate resources being available, to bring forward proposals that will begin to address those issues The key thing for the Comhairle is to ensure that an overall corporate view is maintained across all applications in order to ensure that it is best placed to make effective use of technology and to be in a position where its systems meet the appropriate standards for potential data sharing opportunities with external partners. This means tighter data management and consistency across the board so that more effective procedures are in place Leading on from this is the need to support Electronic Service delivery (ESD) over the website so that services are available to the public from their own homes without the need to visit a Comhairle office to transact fairly straightforward business. The strategy will look at developing effective self-service via the website and will work closely with the Customer Services team in order to move as much traffic as possible into the online channel thus reducing overheads at Customer Service Points A great deal of attention in IT is currently focussed on issues such as server virtualisation and desktop virtualisation as attempts are made to make more efficient use of existing hardware resources. The strategy will look at plans to implement virtualisation to reduce hardware overheads and generate savings Furthermore, the technology used for server virtualisation lends itself to rapid recreation of servers and as such will provide the basis for a new Disaster Recovery Plan Developments in this area are also being monitored for opportunities to apply corporate savings to the central infrastructure especially with regard to reduced carbon emissions by reducing energy demand and saving on overall power consumption. The deployment of new, less power-hungry devices such as ipads will also contribute to the Comhairle s energy saving targets One of the consequences of all this is that, for the ordinary user, local computing power is no longer as important as it used to be, and that the key issue is more about universal access and security rather than about the idea of a powerful PC on each 12

14 desk. This is largely the premise on which desktop virtualisation is based and the strategy will look at exploiting opportunities for reducing the deployment of expensive and powerful PC s in favour of more easily managed and less expensive devices Although it is too early yet to consider widespread de-commissioning of PC s it is becoming increasingly apparent that the PC-centric era is coming to an end and that other devices are being used that more effectively meet the needs of those that use them. Into this category come devices such as smartphones and ipads which are highly effective for most purposes and provide users with access to a broad range of services. The strategy will look at deploying the most appropriate device to users rather than the default position of a PC for everyone This idea of ubiquitous computing where the emphasis is on universal access, irrespective of location, is already being seen in proposals for the use of personal devices for access to organisational data. Although the data security challenges are still to be fully understood and addressed, it is anticipated that this move towards personal devices for work purposes is one that will continue to gain popularity in the future In essence then, future developments in IT will consider an increased emphasis on information security, options for virtualisation at both server and desktop level, more effective data management, storage and archiving, a gradual change in the way PC s and personal devices are used, application of common standards across systems, further convergence between voice, video and data, improved business continuity and an increasing emphasis on online services. 14. Conclusion 14.1 In conclusion therefore, the Comhairle has a sound hardware and software infrastructure and is reasonably well placed to respond flexibly to the changing requirements of a modern IT environment Furthermore, the restructuring which took place in June 2011 has established a new basis for moving forward with all required staff now in place and the overall complement reduced. This is a key asset for the Unit and the skills, experience and enthusiasm of the staff will assist with many of the innovations and developments that will shape IT services in the coming years The technical infrastructure (both hardware and software) should be maintained and upgraded along the lines suggested in the Strategy in order to keep pace with changing technology and to improve the way in which information is handled. Hand in hand with this is a continuing requirement to ensure that appropriate security policies are in place to protect confidential data and to promote effective information management The underlying network is of course a key element of infrastructure and it is imperative that a reliable and affordable structure is in place to deliver the services described in the strategy. To this end, it is vital that the Comhairle provide substantial input into the various broadband projects currently underway with a view to safeguarding the future of broadband services in the Western Isles The IT Unit should be encouraged to continue to explore alternative technologies that reduce cost while maintaining core systems, increasing the efficiency of the Council s internal procedures and providing an improved service to the public. 13

15 14 APPENDIX 1