two years on a progress review

Transcription

1 IG Strategy tw years n delivering ECC s Infrmatin Gvernance strategy tw years n a prgress review Nvember 2013 Nvember 2013 Page 1 f 12

2 Cntents Intrductin 2 Highlights f the secnd year 3 Next steps and new directins 4 Activity plan 5 Delivering the strategy we said we did 6 Versin cntrl Stakehlder Versin Date Cmments DW /11/2013 CMB 1.0 9/12/2013 Intrductin The Cuncil has been delivering services t Essex since 1889 and it is hard t imagine the changes since then but sme f ur recrds are required fr decades which creates quite a challenge. As we cme t the end f ur secnd year against the Infrmatin Gvernance Strategy we are seeing the impact f the alignment f new technical capabilities with imprved infrmatin management and assurance. We have effective prcesses and reprting in place t make infrmed decisins and mnitr prgress f infrmatin management and ur cntrl f risk. Our staff have clear infrmatin abut what is expected f them. We wrk mre clsely with ther functins, in particular arund prperty, prjects and change which is key t delivering transfrmatin effectively. Our next fcus is n the cultural changes needed t wrk with minimal bureaucracy while prviding reliable and IG Strategy tw years n accessible infrmatin whether that be detailed case infrmatin t scial wrkers r up t the minute business intelligence t cmmissiners. This means embracing digital by default driving dwn the verheads f mving paper t peple r peple t paper Mst activities are prgressing in line with ur riginal expectatins while sme have adapted t new challenges and changes t natinal and partner agendas. Our infrmatin sharing is aligning with natinal develpments, particularly arund health and scial care. The Cuncil has radically restructured which requires us t change the way we use infrmatin between cmmissining and peratinal delivery. It is exciting t see the recgnitin f the rle f infrmatin management in delivering these changes, nt as an verhead but as part f delivering value fr mney and imprved utcmes fr ur citizens. David Wilde, CIO Nvember 2013 Page 2 f 12

3 Highlights f the secnd year This has been an exciting and interesting year building n the secure fundatins established last year. We have seen psitive changes in behaviurs and understanding acrss the rganisatin. The Cuncil has embarked n an ambitius prgramme f transfrmatin t address the financial pressures facing the public sectr while embracing pprtunities t wrk clsely with ther rganisatins t jin up ur cmmissining and deliver better utcmes fr Essex citizens. Infrmatin has been recgnised as a fundamental part f this jurney, supprting cmmissining, integrated wrking and ur increasingly flexible ways f wrking. Having imprved ur plicy, cmmunicatin, prcurement and risk management we have respnded pragmatically and safely t transfrmatin. Our new infrmatin gvernance is wrking Infrmatin is central t ur transfrmatin with prjects earlier allwing us t supprt and advise the rganisatin n the impact f change. Cmmunity Budgets has develped further as part f the natinal Public Service Transfrmatin Netwrk (PSTN) and we have shared ur learning arund data sharing with ther bdies and kept pace with natinal develpments. In particular we have engaged actively with the Cabinet Office and thers t explre the myths, realities and implicatins f the current legislative landscape and hw these differences affect central and lcal agencies. We have jined the discussins helping t shape the future rle f the natinal Infrmatin Sharing Centre f Excellence and wrked with a range f gvernment and lcal agencies in mving frwards with ur visin fr Whle Essex Cmmunity Budgets. We cntinue t refresh ur Essex wide Infrmatin Sharing apprach incrprating the implicatins f Integrated Cmmissining, Caldictt 2 recmmendatins, and ther changes, particularly thse affecting ur health partners. We are nw in a psitin t take these implicatins int a refreshed apprach by wrking with ur partners acrss Essex building n natinal NHS requirements t deliver a cmprehensive and effective framewrk fr multi-agency wrking. We are jining up acrss the public sectr The Chief Infrmatin Officer Bard has frmed prviding a frum fr engagement and strategic decisin making arund technlgy and infrmatin pprtunities with active participatin frm universities, lcal authrities, emergency services and ther lcal partnership grups. Our relatinship with health clleagues acrss the new Clinical Cmmissining Grups, Trusts and the Cmmissining Supprt Unit is nw established and drawing us clser arund Integrated Cmmissining and the creatin f streamlined prcesses. The Cuncil has redefined it s structure t strengthen ur ability t cmmissin strng utcmes fr ur citizens and lcal ecnmy. We have aligned hw we are designing ur technlgy and infrmatin IG Strategy tw years n management t supprt this change. We have established Master Data principles which will allw us t ratinalise ur data when we cnslidate fragmented systems and prcesses in the future. Alngside this Metadata principles have been develped t define hw we describe and understand ur data and infrmatin which is a fundamental building blck t lcate, track and manage ur infrmatin and cnnect peple and prcesses acrss the rganisatin. We have increased access t ur infrmatin by refining ur apprach t Freedm f Infrmatin, Envirnmental Infrmatin and Re-Use f Public Sectr Infrmatin as well as maintaining ur cmmitment t prvide peple s access t the infrmatin we hld abut them. Our Subject Access Request team has adpted specialist scanning equipment and imprvements in mbile and flexible wrking t help manage these cmplex requests while ur strategic prgrammes fr Scial Care Case Management and Nvember 2013 Page 3 f 12

4 Transfrming Crprate Systems are driving frwards t cnslidate ur cre infrmatin. Freedm f Infrmatin, Envirnmental Infrmatin and Re- Use f Public Sectr Infrmatin requests are nw crdinated thrugh the Infrmatin Management team driving cnsistency in ur respnses and prviding a supprt hub fr ur netwrk f Infrmatin Champins. Our respnses are nw published and available n the Cuncil s internet allwing anyne t find ut mre abut ur perfrmance and decisin making. Infrmatin management imprvements are already delivering results. Fr the first time ur recrds management csts are reducing. We cntinue t wrk with ur supplier t use their capabilities t drive greater value thrugh the digitisatin f recrds and use f similar tls t deliver infrmatin t the requestr rather than making them cllect frm a designated ffice. We have cmpleted the prcurement f a replacement crprate Gegraphic Infrmatin System (GIS) which will deliver imprved access t gegraphic infrmatin fr ECC staff, Essex citizens, businesses and partner rganisatins. We can see the impact f ur wrk where staff have a clearer understanding f ur standards and prcesses, asking the right questins and wrking with us t identify better ways f wrking with infrmatin and citizens. Next steps and new directins In rder t realise the full benefits and true ptential f ur strategic transfrmatin prjects we nw need t address sme f ur mst challenging issues in making the right infrmatin available t the right peple at the right time. In the cming year we will be lking clsely at the new skills and knwledge ur staff need t make the mst f new technlgies and build a culture f gd infrmatin use. Strategic prjects arund ur Scial Care Case Management, Transfrming Crprate Systems Wrking with cmmunities and partners require us t bring tgether data frm multiple systems and t reslve issues arund archived infrmatin thrugh a pragmatic apprach t digitisatin. Our new Gegraphic Infrmatin capabilities will allw Essex Authrities t publish key envirnmental datasets in line with EU INSPIRE regulatins. As we mve nt the new Public Sectr Netwrk in the first quarter f 2014 we will be seeking t replace the cmplexity f current secure cmmunicatins tls with an integrated apprach that can cnnect everyne we wrk with. A fresh framewrk f tls and a standard apprach fr Infrmatin Sharing remains a pririty as we cntinue t wrk with natinal and lcal partners t ensure the crrect balance between multi-agency wrking, privacy and security. Infrmatin Audits and the develpment f ur Infrmatin Asset Register will be aligned t the new rganisatin structure enabling us t keep track with IG Strategy tw years n change and identify further pprtunities fr imprvement. Our apprach t Privacy Impact Assessments will be further refined t make the prcess easier t understand fr thse prviding infrmatin while building frm cncept t delivery and thrugh future changes. Nvember 2013 Page 4 f 12. Diagram : Figure 1 The timeline n the fllwing page (Figure 1) depicts the majr milestnes and deliverables f the IG strategy. Triangles indicate milestnes, either frm last year s strategy review r new milestnes. The tables n pages 6 t 10 give mre details abut what we are ding t achieve the utcmes described in the IG Strategy.

5 IG Strategy created Grup IG Strategy tw years n year n 2 year n IM Grup established Rles & Respnsibilities Identify training requirements IM Team frmed Review IPDG apprach Begin audit & cmpliance plan Recrds Management transferred Light tuch review Infrmatin Management Framewrk Initiate cmprehensive review Annual review FOI Publicatin prject IM Framewrk in place Integratin with ther plicies Infrmatin request prcess re-design Annual review Established Terms f Reference Apprach develped ESH Audit cmplete SCF Audit initiated ASC Audit cmplete Infrmatin Audit Initiate secnd cycle audits ESH Audit secnd cycle audit Initiate third cycle audits Identify best practice Identify requirements Infrmatin Asset Register Define & develp IAR Prcess fr maintenance File Classificatin Cntribute t SharePint develpment Develp perfrmance standards Develp prpsals Retentin Schedule review Charging and Incme Audit current regimes Develp plicy Add charging t Asset Register Implement strategy fr re-use & charging Audit cmmercial value Re-use plicy apprved Infrmatin Gvernance Prtecting Infrmatin & Prtective Marking Cmmunicatins Plan Cmmunicatin & Training PCI Training Risk assessment tl Prfile further training requirements Intranet cntent replacement Refresh training cntent Evaluate cmmunicatins Cmmunity Budgets requirements GIS prject initiatin Data Sharing & Data Ratinalisatin Emerging inter-agency capabilities Enhanced Essex Trust Charter Digitisatin & Recrds Management Cnslidate Secure Cmmunicatins Octber 2011 IS restructure Octber 2012 IS restructure Octber 2013 IS restructure Octber 2014 Key: Delivery themes (shading indicates mre cncentrated fcus) Establishing the Fundatin Building Capability Delivering Value Cmpleted In prgress Scheduled IG Strategy milestnes new milestnes Nvember 2013 Page 5 f 12 Figure 1: milestne diagram

6 IG Strategy tw years n Delivering the strategy We said we wuld We did Next we will Establish a clear framewrk f rles and respnsibilities, thrugh Identify infrmatin gvernance training requirements Cntinue t develp a prtfli f IG training Supprt Infrmatin Champins t respnd t rganisatinal change Wrk with Infrmatin Champins t imprve ur agility f decisin making Define the IG audit and cmpliance plan Maintained high perfrmance in respnding t Freedm f Infrmatin and Envirnmental Infrmatin Regulatin requests remains high with requests. The Infrmatin Plicy Develpment Grup is making greater use f wrking grups and virtual decisin making t increase agility at a time f significant change acrss the rganisatin We have started develping a prfile f training needs against rles within the rganisatin We have reviewed ur cre training materials t identify where cntent will need t adapt t new ways f wrking and updated guidance Review the rles f respnsibilities in line with the ur changing perating mdel t align gvernance with new functins and bards Cmplete wrk t establish infrmatin gvernance training requirements fr staff acrss the rganisatin and fr specific functinal areas Cntinue t develp a prtfli f IG training in line with the identified requirements Wrk with Infrmatin Champins t further increase the agility f ur decisin making in respnse t rganisatinal changes Define the IG audit and cmpliance plan ensuring we can mnitr ur effectiveness thrugh apprpriate and meaningful measures feeding int crprate perfrmance reprting mechanisms In additin we will re-engineer ur prcesses fr managing Infrmatin Security Incidents Nvember 2013 Page 6 f 12

7 IG Strategy tw years n We said we wuld We did Next we will Develp the Infrmatin Framewrk thrugh Develpment f a cmprehensive IG plicy framewrk Develpment f an IG apprach that is prprtinate t the level f risk Intrductin f a change cntrl apprach Further engage with partner grups t ensure gd alignment between plicies Cntinue t imprve ur prcesses fr respnding t requests fr infrmatin Issued a cmprehensive IG plicy framewrk in April 2013 designed t meet the principles f quality management fr Infrmatin Security Mapped ur plicies and standards t ISO27001 principles and cntrl areas Established a quarterly review prcess t allw revisins t be change managed int plicies Embedded plicy awareness int ur annual cmmunicatins plan. Aligned ur plicies, standards and prcedures with the requirements f ther rganisatins, including: Public Service Netwrk cmpliance PCIDSS Payment Card Standards NHS Infrmatin Security Incidents Embedded imprvements in prcurement and prject delivery prcesses Ensure ur plicies keep track with emerging technlgy use taking accunt f unified cmmunicatins, scial media, cmmissining activities and ur mbile and flexible wrking apprach. Ensure ur plicy and standards are supprted by guidance, defined targets and perfrmance data. Ensure the financial implicatins f recrds management is crrectly factred int rganisatinal changes r services held accuntable fr excess csts if they fail t meet agreed targets. Drive imprvements in standards and perfrmance against infrmatin and data management supprting the rganisatin t be mre flexible Drive standards and cmpliance int ur management f unstructured data Privacy Impact Assessments Infrmatin Terms and Cnditins Alignment f security assurance with stages f prcurement t reduce prcedural burdens n ptential bidders while maintaining assurance Re-engineered ur prcesses t deliver quality assurance and well managed delivery fr: Exceptin t plicy requests Nvember 2013 Page 7 f 12

8 IG Strategy tw years n We said we wuld We did Next we will Secure cmmunicatins FOI & EIR respnses Publicatin f Freedm f Infrmatin respnses. Develp the Crprate Recrds Management Plicy, thrugh Fully embed Recrds Management within the plicy and guidance framewrk Identify single issues arising ut f audits r industry standards Identify issues and pprtunities frm Recrds Management Recrds Management Plicy is nw integrated int ur IG plicy framewrk Infrmatin Audits have identified single issues relating t: Tracking respnsible wners thrugh rganisatinal change Assigning retentin requirements, security classificatins and identifying data sharing risks Identifying lcatins fr unstructured recrds Transfer f recrds frm n-site t cmmercial strage Managing review f archived dcuments prir t destructin Explred the csts and implicatins f transitin frm physical recrds t scanned recrds Reviewed retentin perids t supprt data migratin prjects with a re-issue in prgress fr ur Enterprise Retentin Schedule driving imprvement t access and presentatin. Develped revised prcedural guidance fr recrds Nvember 2013 Page 8 f 12 Drive standards and accuntability int recrds management and rganisatinal prcesses Review the budgetary psitin fr management f recrds in bth physical and electrnic frmats Imprve assurance f timely destructin f recrds in line with the Data Prtectin Act and ur rganisatinal retentin schedule Identify issues and pprtunities where Recrds Management can imprve efficiency, effectiveness and reduce csts fr the Cuncil. Develping a financial mdel t ensure rganisatinal requirements are managed with an ptimum mix f scanning, physical and electrnic retentin Supprt the delivery f financial savings fr the rganisatin arising ut f Scial Care Case Management and Transfrming Crprate Systems prjects. Imprving ur ability t reprt recrds management perfrmance against the new rganisatinal structure allwing management

9 IG Strategy tw years n We said we wuld We did Next we will retentin f issues and targeted imprvements Managedur cmmercial supplier maintaining perfrmance in line with r exceeding industry standards and cntract prvisins Implement Infrmatin Audits thrugh Engagement with further service areas Engagement with related activities Agreement f effective infrmatin actin plans Initiatin f the secnd cycle f infrmatin audits Identificatin f cmmn themes t be prgressed thrugh ther wrkstreams Schls, Children and Families audit has prgressed with analysis in prgress Envirnment Sustainability and Highways has prgressed thrugh secnd cycle driving imprvements in line with the actin plan Adult Scial Care Audit has been cmpleted Appraches t digitisatin and destructin have been evaluated and csted with alignment t Scial Care Case Management and Transfrming Crprate Systems Crprate audit t align with Transfrming Crprate Systems activities t avid duplicatin f effrt Engage with new functins t cnfirm Audit plans and Actin Plans in line with Internal Audit recmmendatins Engage with related activities t prevent duplicatin f effrt and develp better understanding by bringing reviews tgether Identify cmmn themes that can be prgressed thrugh ther wrkstreams Develp an Infrmatin Asset Register thrugh Agreement f the frmat and cntent fr the Infrmatin Asset Register Ppulatin f the Register Cllatin f new infrmatin (frm the Infrmatin Audits) Establishment f systems fr maintaining Asset Register requirements have been drafted based n lessns learnt frm audits, plicy reviews and prcedural imprvements Requirements dcument apprved by ur Infrmatin Plicy Develpment Grup Audit findings are being maintained in a searchable frmat Nvember 2013 Page 9 f 12 Identify requirements relating t changes in prtective marking, implicatins fr data sharing and, where apprpriate, charging Seek funding fr develpment f the crprate IAR Define and develp an apprach fr maintenance f the Infrmatin Asset register with clear rles, respnsibilities and

10 IG Strategy tw years n We said we wuld We did Next we will the register Establishment and delivery f a cmmunicatins plan prcesses nce tls is in place Develp a File Classificatin Scheme (t be cmpleted as part f the EDRM Prject) thrugh Agreement f a crprate file classificatin system Setting a timetable fr implementatin Develp cmmunicatins and training n the scheme Mnitring perfrmance Metadata principles have been develped in supprt f EDRM and Sharepint adptin Assurance standards fr ur recrds management cntract have been agreed and are in place nw frming part f mnthly cmpliance reprting frm MITIE Develp prpsals fr a single, easy t understand file classificatin scheme Cntribute t SharePint develpment activities t prmte effective use f file classificatin and recrds management Wrk with service areas and internal audit t identify and implement further apprpriate perfrmance standards fr bth physical and electrnic file management Service Level File Management thrugh Develping agreed guidance Establishing a system fr mnitring f service-level implementatin f standards Develp ur apprach t charging and incme thrugh Audit current charging regimes and incme generatin Develpment f a Crprate Infrmatin Charging Plicy Incrpratin f charging int the Infrmatin Asset Register The Infrmatin Audit apprach captures published and publishable assets. As the audits prgress this will infrm future publicatin and charging decisins. The new apprach will need t take int accunt the implicatin f ur new perating mdel and the interactin between Cmmissining and Delivery Our apprach fr Re-use f Public Sectr Infrmatin Nvember 2013 Page 10 f 12 Begin t revise the crprate apprach t charging fr infrmatin in line with the develpment f the Infrmatin Asset Register Further extend ur apprach t Freedm f Infrmatin requests, Envirnmental Infrmatin and data transparency mving twards a publicatin by default apprach We will publish revised guidance fr staff and citizens t supprt Re-Use and Open Data

11 IG Strategy tw years n We said we wuld We did Next we will Implementatin f the strategy fr Re-use f Public Sectr Infrmatin Regulatins 2005 and charging under LGA 2003 Regulatins has been reviewed t ensure alignment with the EU INSPIRE directive and Prtectin f Freedms requirements initiatives Cnducting an audit f Cuncil infrmatin f cmmercial value Re-use f Public Sectr Infrmatin Regulatins plicy apprved and implemented Imprved cmmunicatin and training thrugh Review f existing training and cmmunicatins n Infrmatin Management Develpment f a cmprehensive crprate Infrmatin Management training prgramme using a range f training methds Develp a cmmunicatins plan fr the IM Strategy implementatin Integrate Infrmatin Management int HR plicy and the inductin prcess Imprve infrmatin management tls and infrmatin n the intranet The Cmmunicatin Plan has been develped int an effective and maintained prcess allwing us t deliver a range f messages thrugh the right channels and we are starting t see the implicatins f better understanding in the requests and queries raised with the team Infrmatin gvernance training prgrammes have been reviewed taking int accunt service specific requirements and rganisatinal wide requirements Cre training updates have been identified and changes cmmissined Payment Card Industry Data Security Standard training has been develped and rlled ut The risk assessment tl fr infrmatin types and sensitivity is nw actively used t supprt infrmatin management decisins Wrk with Infrmatin Champins t develp a prfile f training needs against jb rles and respnsibilities Further imprve ur intranet cntent t ensure ur staff can wrk effectively with us and be clear n what is expected f them Extend ur cmmunicatins and training imprvements t engage mre clsely with suppliers and partners Align Infrmatin Gvernance training with the wider training apprach fr IT use t integrate gd gvernance and management int technical and ther training, fr example sharing dcuments and infrmatin n a vide cnference needs staff t understand hw t use the sftware and hw t behave t share infrmatin safely. Infrmatin Management as part f the revised inductin checklists and prcesses has been maintained and strengthened Nvember 2013 Page 11 f 12

12 IG Strategy tw years n We said we wuld We did Next we will Integratin with ther plicies thrugh Identify impact f Infrmatin Management plicies n ther Cuncil plicies Identify slutins where required Integrate Infrmatin Management int existing plicies Identified key relatinships with: Cde f Practice Crprate Cmplaints Prcurement practice Facilities management Business Cntinuity practice Wrk with clleagues acrss the rganisatin t cntinue t imprve the integratin f IG with key plicies and prcess. Starters and leavers prcesses, and Hme wrking Cntributin t Surveillance and CCTV standards derived frm Office f the Surveillance Cmmissiner (OSC) Cde f Practice June 2013 Nvember 2013 Page 12 f 12