Background
In January 2008, ASE was asked to provide CLAS consultancy support to lead and manage IT Security for HM Prison Service.
Approach
The support included:
- reviews of Information Assurance (IA) policy and practices resulting from recent Government data losses and the subsequent Cabinet Office directives to departments and 'Hannigan' letters.
- developing an ISO27001 and subsequent Information Security Management System (ISMS) for NOMS and is currently undertaking a review of IT Security Policy and standards across the whole service to ensure, amongst other requirements, that the requirements of the Offender Management Act 2008 are adequately encompassed by the policy
- managing a civil service team of HMPS InfoSec specialists, all of whom are trained HMG Departmental Accreditors and IT Security Officers
- deputising as Head of Information Security for NOMS
- providing advice to business entities and IT projects on Information Security policy, HMG Infosec standards and practices.
- providing NOMS with an in-house CLAS capability and skills to enable peer review of work done by suppliers and their CLAS resources
- managing incident reporting, to Secretary of State level, and briefing senior managers and Ministers on Information Security issues within NOMS
- dealing with major organisational change on two levels - the merging of the two Offender Management Executive Agencies (NOMS and HMPS) into a single Agency and the wider change brought about as a result of the creation of the Ministry of Justice. (MoJ) ASE's work includes developing new IA structures within the new NOMS Agency, whilst also working with MoJ headquarters to align existing IA work with the MoJ IA Programme
- providing specialist advice and guidance to elements of NOMS working with CONFIDENTIAL (IL4) and SECRET (IL5) assets and liaison between NOMS, the Security Service, CPNI and CESG.
Outcome
ASE's support has been critical to this Agency's ability to respond the extraordinary range and number of events and influencing factors on Information Security that have impacted NOMS during 2008. Pre- and post-sales support has been good.