Cyber Security Arrangements

Background

The Government of Jersey provides critical operations and services to citizens and businesses across the Island.  All its services depend on the security and availability of Information Technology (IT) and Operational Technology (OT) systems. 

In 2020 the Government of Jersey commenced a Government-wide cyber security transformation programme, to be delivered in two, 12 month tranches. Tranche 1 comprises six distinct projects: 

• Programme Management 
• Managed Service Security Provider (MSSP) 
• Governance Improvement 
• Identity and Access Management 
• Asset Management; and 
• People Security. 

 Work commenced on the programme in March 2020, with Tranche 1 originally scheduled for completion by March 2021. However, the global COVID-19 pandemic and associated public health measures and restrictions have inevitably led to some programme delays. 

Scope

This review evaluated the progress of Tranche 1 activities.  Any Tranche 2 activities are outside the scope of this review. 

The review did not consider cyber security arrangements in arm’s-length organisations. 

Conclusions

Tranche one of the CSP has been delivered in a challenging environment, as the COVID-19 pandemic changed operational priorities and stretched resources across the Government of Jersey.  

 Cyber security maturity has increased across all operational areas covered by the tranche one workstreams.  

 However, delays to the CSP cannot solely be attributed to the effects of the COVID-19 pandemic and the associated restrictions and changes to operational priorities.  

The success of large transformation projects is reliant on effective prioritisation, communication and engagement. The CSP has implemented communication pathways with business units across Government. However, the prioritisation of transformation programmes and projects and of the interdependencies between concurrent transformation programmes and projects could be further improved. In particular there should be increased communication at the leadership level and more effective planning and prioritisation processes.