This content has been automatically generated from the original PDF and some formatting may have been lost. Let us know if you find any major problems.
Text in this format is not official and should not be relied upon to extract citations or propose amendments. Please see the PDF for the official version of the document.
19-21 Broad Street | St Helier Jersey | JE2 3RR
Deputy Sam Mézec
Chair, Corporate Services Scrutiny Panel
BY EMAIL
24 November 2022 Dear Sam,
Thank you for your letter of 7 November 2022. Please see the answers, below, to your questions. Apologies for the delay in getting these answers to you.
- Are the proposed capital projects appropriate and what impact are these likely to have on Islanders and Island life?
The capital programme updates the previous programme to use the most contemporary and realistic forecasts of expenditure, to produce an affordable and deliverable plan. This investment was agreed by the previous Council of Ministers to ensure that we have the infrastructure needed to deliver high quality public services
Additional work was undertaken to ensure the programme is deliverable and does not tie up public funds unnecessarily where they can't realistically be spent.
The plan acknowledges that there are several other significant areas where future investment may be needed (Infrastructure to support more housing, Sports Facilities etc), however, more work is required to identify suitable funding mechanisms.
Grouped Heads of Expenditure have been used to improve government's ability to adapt to maximise project delivery in changing circumstances.
More work is planned to take place to further improve longer-term capital planning.
As already stated, the proposed IT capital programmes are a continuation of previous programmes and are largely foundational technology aimed at improving the usability, reliability, and security of the IT estate. As foundational programmes, they may not have a direct impact on the lives of islanders, but the indirect impact is considerable. For example:
• MS Foundations enabled thousands of Government employees being able to work from home and continue to serve islanders effectively during lockdown.
• The ITS Programme is replacing old and unsupported technology such as JD Edwards. The new ways of working will enable Government employees to be more effective in their roles and, more importantly help to ensure that there is not a catastrophic failure of the accounting system which could, for example, lead to the Government being unable to collect revenue and make payments.
• The Cyber Programme is reducing the likelihood of a successful cyber-attack. Such an attack could lead to Islanders sensitive data being leaked or services such as the hospital being shut down like happened in the UK with the Wannacry attack on the NHS.
- Have any capital projects under your remit been delayed or not provided for?
Some delays have been experienced in the delivery of capital projects as follows:
Project | Original Completion Date | Reforecast Completion Date | Reason for delay |
ITS Release 1 | March 2022 | January 2023 | Additional scope introduced generating the need to re-plan and re-baseline. This re- baseline not only had to consider the time to deliver the additional scope but factored in the finance community work required. Switching the finance systems at the end of a financial year being the more beneficial. |
ITS Release 2 | September 2022 | January 2023 | Release 2 is technically dependent upon Release 1 due to the interactive nature of the technology being deployed and as such the timing needed to be aligned. |
Cyber Programme | December 2021 | September 2023 |
|
MS Foundations | December 2021 | September 2023 |
infrastructure complexity & impact on implementation larger than expected
implementation and prioritisation
Police (Police) which along with other initiatives diluted resource utilisation |
These delays were either accommodated within existing expenditure limits or if additional expenditure was required, this was approved via a further business case in the Government Plan.
OI3 - MS FOUNDATION
- Please can you provide an update on the progress of the MS Foundation project?
The MS Foundations programme is required to put in place foundational Microsoft-based technology to allow the effective, efficient, and secure delivery of Government services. The programme has included the implementation of Microsoft 365 which has enabled c. 7000 users (including the States of Jersey Police) to collaborate effectively and work remotely through the COVID-19 pandemic and beyond. The programme also includes the implementation of modern cloud-based infrastructure and governance controls across our technical environment, from which current and future digital services can be securely and effectively provisioned. The technology provides accessible and secure access to data and provides service areas with the necessary tools to deliver modern digital services across government.
Delivered to date:
• Rapid implementation of Teams to c.2500 key workers enabling home working and efficient collaboration across teams during first Covid lockdown
• Implementation of minimum viable security standard for M365 to support secure remote working
• Phasing out of legacy & unsupported end-user compute Windows 7 devices
• Standardisation of end-user compute devices to Windows 10
• Implementation of M365 across GoJ c.7000 users
• Implementation of separate Police M365 tenant in line with Home Office security standards
• Service take-on and migration of Police users to M365
• Audit & assessment of GoJ application estate for viability of migration to cloud
• Sharepoint online architecture/standards and commenced migration of departmental unstructured data to Sharepoint online
• Pilot implementation of Managed Desktop (MMD) to enable simpler ongoing management
& maintenance of end-user compute devices
To be delivered in 2023:
• Remaining user mailbox migration to M365 (primarily Health)
• Implementation of security/cloud standards for main GoJ in line with standards adopted by Police
• Implementation of secure/scalable cloud (Azure) platform to migrate legacy services to and environment for future digital services/application provision
• Migration of unstructured data to Sharepoint online and decommission of legacy content management systems
• Rebuild of Active Directory
- The project had an approved budget of £11.5m, which has been reduced by £575,000 to £10.8m. Can you tell ushow and why a reduction of spending has been achieved?
The reduction has taken place over two years and is linked to the revenue funding element of the project. Revenue costs have been slightly lower than original forecast reflecting the pace of implementation which has resulted in lower levels of expenditure than forecast.
- No funding has been allocated to this project in 2024, can you confirm that the project will be completed by 2024? How will this timeline be adhered to?
MS Foundations programme is scheduled to complete at the end September 2023.
OI3 - CYBER & CYBER ORI
- Please can you provide an update on the progress of the Cyber & Cyber ORI project? Cyber Security Programme Delivery/Planning:
Following a Cyber Security Review in Spring 2019, this programme was established to transform the maturity of the Government with regards to cyber security and includes a range of people, process, and technology improvements. To date, the Cyber Programme has delivered upon the following key areas of scope:
Managed Security Services
Governance Improvements (Pt. 1 & 2)
Identity & Access Management
Asset Management
People Security
Network Security Services
End-Point Detection & Response
Retained Incident Response
Throughout the remainder of 2022 and into 2023, the programme is aiming to deliver the following:
Anti-Virus Enhancements*
Certificate Management (Public Key Infrastructure)
Device & System Hardening*
Ethical Hacking Framework*
Departmental Information Security Officer (DISO) Support Model*
Privileged Access Management*
Compliance Management
Third Party Risk Management
* indicates that these packages are already in flight
Cyber Security Programme Key Delivery Risks:
The following points summarise the main challenges to progress on the programme, with ongoing mitigation actions being managed both at a leadership and programme board level:
The ability of the organisation to support delivery, given the heavy reliance upon GoJ resources, that are already stretched operationally – this has resulted in extended timelines and/or delays in support of supplier package planning, which has in some instances lead to there being a commercial impact
The programme has also experienced difficulties in securing contracts in a timely manner, resulting in significant delays to progress - leading to an increase in the overhead costs to run the programme; it has also meant that completion of the programme has extended into 2023
The baseline maturity assessment carried out in 2019 was necessarily done rapidly and without full discovery and this affected the intended scope of the programme – the extent of technical and process control gaps and an understanding of their need/importance across the wider Government organisation was underestimated, leading to the identification of additional work, costs etc.
The budgetary values stated in the 2019 business case, did not take into account any consideration for inflation or general market increases – in the case of the cyber industry, there have been c.20-30% increases in costs due to the impact of the pandemic/geo- political situation and this has led to overall affordability challenges against the intended scope/budget
Cyber ORI:
In response to the Russian invasion of Ukraine the Government was put on a heightened state of alert due to the increased risk of cyber-attack from countries/states considered to be 'non-friendly' or sympathetic to the Russian war aims. A consequent review of GoJ's ability to reduce likelihood of a successful large-scale cyber-attack and the ability to respond to one led to the prioritisation of a series of short and mid-term initiatives under the broad categories of cyber incident response, public infrastructure, responsiveness, and estate weakness. Work has commenced with a strong focus on procurement activities, planning and resource mobilisation as well as remediating high priority areas considered to present greatest risk of exposure to cyber-attack.
Main areas of progress to date:
- Cyber Incident Response - Conducted major incident response simulation involving key stakeholders,
- Public Infrastructure - Focused on security patching, identified vulnerabilities, penetration testing externally facing applications and replacing legacy externally facing infrastructure that is beyond life/vulnerable to cyber-attack
- Responsive - Onboarded service delivery partner for handling of security incidents out of hours as well as providing additional cover to in-house team who are not sufficiently staffed to fully support required levels of service
- Estate weakness - A number of work packages are in progress to add additional technological capabilities designed to reduce risk/impact of cyber-attack and to replace ageing end-of-life infrastructure that can no longer be kept up to date with security patches/features.
- The project is requiring an additional £1.4m in 2023, what is the rationale for this?
In response to the Russian invasion of Ukraine an in-year reprofiling from the CYBER project was undertaken to reallocate funds to support these additional risks being addressed through ORI. The project is continuing into 2023 and work is ongoing between the CYBER projects to produce a re- baselined plan for next year.
- No funding has been allocated to this project in 2024, can you confirm that the project will be completed by 2024? How will this timeline be adhered to?
The Cyber Security Programme is planned to complete by September 2023, allowing for formal closure by the end of 2023.
In parallel, a Business Case and request for funding in relation to a new Cyber Security Programme 2.0 is being developed, with an expectation that the maturity and control improvement journey will continue from 2024-2026.
OTHER GOVERNMENT WIDE IT PROJECTS
- Given the ongoing nature of the Electronic Document Management project and the Service
Digitisation project, why have these been assigned to a new grouped head of Expenditure?
The Government Plan notes that in recent years the Government has spent markedly less on capital projects than had been allocated. One of the ways that this Government Plan seeks to address this issue is by increasing the use of Grouped Heads of Expenditure.
Grouped Heads of Expenditure provide greater flexibility within allocations. Where projects are delayed due to unforeseen circumstances, this flexibility allows other projects to be accelerated. Thereby preventing funding tied up on stalled initiatives and allowing social value to be maximised within a given year.
This Government Plan groups smaller IT and estates projects that fall within the remit of a single Accountable Officer (AO) in order to allow the AO to best empower delivery and optimise the impact they can achieve with the project funding at their disposal.
While only two projects are currently within the Other Government-wide IT Projects' Grouped Head of Expenditure in this Government Plan, it is envisaged that this number could grow where new initiatives are approved and their inclusion would be appropriate.
From a governance perspective, individual projects on the Grouped Head of Expenditure remain bound by the project total budget agreed in the related business case and additional cost could only be incurred if a further budget allocation was approved.
- Are you expecting these to become major projects?
There is no current expectation that either the Records Transformation Programme (formally EDMS) or the Service Digitisation Programme will become Major projects. Both are forecasting expenditure below the £5m threshold for Major projects.
- Please can you provide an update on the progress of the Electronic Document
Management project?
The Electronic Document Management Project has been renamed the Records Transformation Programme and has a broader scope of works.
The initial scope of the project (as approved in the Government Plan 2022) was to procure a delivery partner to digitise all of Government's records to enable secure and paperless processes and service delivery. The project delivered a procurement strategy, extensive market engagement, and a Pre- qualification Questionnaire was published. Assessment of these returns created a shortlist of five suppliers and consortia, who were to take responsibility for establishing volumes and providing a digitisation (EDMS) solution.
However, in parallel, a discovery phase established that digitisation (EDMS) is only one solution for records management, and that a unilateral decision to digitise could result in unnecessary capital spend. The procurement process was stopped while a rescoping of the project was undertaken. The rescoping of the project recognised the need for both digital and manual pathways and the revised scope was broadened to include five solution pathways including records destruction, as well as digitisation (EDMS). Given the expanded nature of the scope, the project was now deemed to be a programme of transformation and as such significantly developed the scope of the programme to encompass Records Transformation, identifying that EDMS digitisation cannot take place in isolation of other records solutions. This change of scope was approved by the Board, and subsequently the Assistant Chief Minister responsible for M&D, agreed to repurpose existing funding to extend the discovery phase to establish costs and volumes for all solution pathways, and also to commence transformation operations using GoJ resources. The Programme is being structured to consist of two projects. The first project is underway utilising existing approved funding, it will carry out further discovery and will implement non-digital solutions to optimise existing record libraries. The second project, which is subject to Government Plan approval for 2024, will procure and implement digital solutions with optimised record libraries and more certainty of the volumes requiring digitisation.
The increased certainty will reduce implementation cost as suppliers will be targeted with more certain volume expectations. The Records Transformation Programme will directly impact the quality of care and service that the Government provides for islanders. The records kept will become more relevant and efficiently stored, meaning that accessing these records will become more efficient and timelier for islanders, for support professionals and for authorities requesting records.
- Please can you provide an update on the progress of the Service Digitisation Phase 2 project?
Phase 2 is a continuation of the funding for service digitisation to enable further development of the Online Services Hub, to digitalise more services and add further capabilities to the platform.
The Digital ID project successfully delivered a new Digital ID solution (JerseyMe) as an alternative to the existing Yoti offering, enabling customers to engage with GoJ verified services online. JerseyMe was launched to the public on 27 June 2022. The new solution, delivered in partnership with Jersey Post, will cater for customers who would prefer to engage on a PC (rather than via smart phone with Yoti) coupled with a regular mobile phone for authentication purposes. There is currently no local support base for Yoti, with the supplier providing email support only. The new solution is supported face-to-face via Jersey Post retail in Broad Street and via telephone and online support.
The first phase of the Online Services Hub will deliver a minimum viable product (MVP) by the end of 2022. The Hub will allow customers to securely engage with GOJ and access services digitally. It will be integrated with existing platform components – e.g. Digital ID, People Directory and will cover both individual and non-personal (organisations) customers.
Through 2023, this programme will enhance the Hub to enable further service digitisation.
- Has Phase 1 been completed?
As noted above, the Digital ID solution (JerseyMe) has delivered and the delivery of the minimum viable product for the Online Services Hub is scheduled to complete by the end of 2022.
- Are the proposed additional revenue programmes appropriate and what impact are these likely to have on Islanders and Island life?
The Council of Ministers has judged that additional revenue projects were appropriate and represented value for money as part of the Government Plan process. These revenue projects bring both direct and indirect benefits to Islanders. All Islanders expect Government to provide a modern and effective service which in the digital age includes digital service offerings and omni-channel access to services. To enable this, Government must have in place a modern technology foundation and reduce its reliance on legacy, unsupported technology.
ENTERPRISE LICENCES I-COO-GP23-001
- Can you confirm whether the additional £1.6m will be sufficient to cover deliver the necessary requirements?
The total unfunded enterprise licensing cost at the end of 2021 totalled £2.2m, however, funding has been requested in the sum of £1.6m in the Government Plan 2023, with the delta being identified from within existing budgets.
The cost of licences has increased primarily due to an increase in the number of software licences now required to deliver effective services to GoJ colleagues and following an increase in vendor costs.
The use of Microsoft Teams through the COVID-19 pandemic allowed our staff to work remotely to resume services to Islanders. Post the pandemic, flexible working and working from home has become a part of the GoJ new ways of working. The new Government building will see this continue as the expectation is for a 6:10 office working from home ratio, meaning that our civil service staff who can work remotely will need to do so to meet reduced office desk space provision.
As the M&D continues to mature, it is making use of software to manage internal processes more effectively, for example, the management of helpdesk requests. This will allow the function to deliver more efficient services to the organisation.
- Are you expecting the annual cost to fluctuate in line with the number of employees?
Annual costs for licencing and support do fluctuate both in terms of numbers of licences required and the costs of those licences, as determined by the provider. These fluctuations are manageable where they are part of a considered increase in licence demand. Going forward, there is an expectation for all programmes and projects (for example) to identify in advance the potential for future licencing needs.
- The funding is required to make up a budget shortfall. Are you confident that the increased base budget will be sufficient for the delivery of the planned items? There is confidence in the technology landscape which M&D now manage on behalf of GoJ. However, it will be crucial that departments effectively engage with M&D in planning their requirements and demand for new/existing technology.
IT SUPPORT FOR UNSUPPORTED PRODUCTS I-COO-GP23-003
- Overall Modernisation & Digital (M&D) is requesting an increase of £3m annually to its budget base.
M&D have requested additional funding in the sum of £3m in the Government Plan 2023 onwards to support:
• Enterprise Licenses – £1.6m requested (as detailed above in response to question 15)
• IT support for unsupported products - £0.2m requested
• Unfunded run the business costs from change - £1.2m requested
- How was such a significant amount of money overlooked in previous years?
In previous years, technology projects were undertaken by other departments with no provision for the ongoing support and maintenance of the resulting technology. With the centralisation of technology teams from departments into M&D, this gap in provision became apparent, particularly in respect of firewalls and storage.
Unsupported and end of life technology solutions represent a security and business continuity risk as they are at greater likelihood of failure. It is therefore necessary to address such gaps to mitigate the risk of system failure.
The costs associated with the maintenance of new technology have been increasing in recent years and the capital asset replacement budget assumed savings through the decommissioning of legacy technology. In some cases, decommissioning has been delayed, for example the ITAX system decommissioning, due to delays in the delivery of new Revenue Management System and legislative changes in the intervening period.
One of the most significant aspects of the funding gaps relates to Azure. Azure is the Microsoft Cloud environment used by the Government of Jersey. Unlike on-premise solutions, Azure is a metered solution where charges are made on a consumption basis, for example per second for processing power and gigabyte for storage. This increasing consumption is reflective of the transformative nature of the technical landscape across Government.
- How have M&D functioned with a shortfall of £3m a year since 2019?
As mentioned above, in recent years departmental technology teams and the associated technology have been centralised into M&D. Historically, the funding for these technology teams and the technology which they support would have been through departmental base budgets. As part of the consolidation of Government's technology assets and resources, it became apparent there had been some funding deficits with respect to technology in these departments and in some cases, systems were unsupported or reaching end of life on legacy infrastructure.
In addition, the consumption requirements for cloud services have been growing steadily and is now greater than predicted due to a lack of foresight by previous technology programmes on the requirements for ongoing services.
JERSEY ADVISORY AND CONCILIATION SERVICE (JACS) - ADDITIONAL WORKLOAD I- SPPP-GP23-001
- The request is for an additional £100k annually, bringing the JACS budget to £454,900. This is £69,100 more than the highest budget in 2014. How was this estimate allocation identified as sufficient to meet the programme's aims?
JACS has experienced real-terms cuts in its funding over the last few years. Of the £100,000 additional request, £30,000 addresses the inflationary increases which have been absorbed by the Service over the years, and which are no longer sustainable. This amount returns JACS to its funding level before the cuts to its budget.
Furthermore, to put the workload increase into the context of additional funding, the number of direct contacts with JACS rose from 6,656 in 2014 to 12,669 in 2020. Queries are taking longer to deal with because of the increasing amounts of employment and discrimination legislation. For example, direct contacts relating to parental leave rights rose from 176 in 2017 to 504 in 2021; those relating to disability rights rose from 1 to 323 in the same period.
Employment and Discrimination Tribunal claims are becoming more complex, and JACS has an important role in pre-claim conciliations, designed to resolve claims before they become a burden on the public purse by proceeding to full Tribunal hearings.
The additional funding will mean that, from 2023, JACS has the appropriate level of financial security to ensure the services offered to clients are agile and responsive, by enabling JACS to buy in additional skills when they are needed; that staff absences and peaks in workload can be mitigated by additional resources to maintain the standards of service expected of the organisation; and that resources are available for succession planning and training.
- We note that business cases have not been provided for the following additional revenue programmes: Additional Resourcing for the Recruitment Team, 100 Day Plan – Living Wage Increase, Support for Ukrainians in Jersey, and 100 Day Plan – Cultural Centre. When can we expect business cases to be ready?
Where Business Cases haven't been fully developed amounts have been held in the reserve, and funds will only be released once a Business Case (or other appropriate documentation in line with the Treasury Minister's reserve policy) has been produced.
We are working with departments to get these in place as soon as is practicable. Yours sincerely,
Deputy Kristina Moore Chief Minister