You asked
I'd like to request the following information please:
- Name of SIRO (Senior Information Risk Owner) or similar post (Chief Information Governance Officer etc), or responsible person for SIRO duties.
- Contact email of person named in request No. 1.
- Name of DPO (Data Protection Officer) or responsible person for DPO duties.
- Contact email of DPO.
- Name of person with overall responsibility for Cyber security or equivalent (excluding persons in q1 and q3).
- Contact email of person in Q5.
- Name of person with overall responsibility for information security or equivalent (excluding persons in q1, q3 and 5).
- Contact email of person in Q7.
- Name of person with overall responsibility for information Governance or equivalent (excluding persons in q1, q3, q5 and q7).
- Contact email of person in Q9
- Do you have appointed IAO's? If so, whom are they, if they have been defined?
- Are you or have you considered becoming ISO 27001 compliant or certified? If so whom is responsible for maintaining this? (as in, the person)
- Contact email of person in Q: 11.
- Are you required to connect to the PSN Code of Connection (CoCo)? If so whom is responsible for complying with its requirements? (as in, the person)
- Contact email of person in Q:13.
- What is the annual budget for Cyber Security?
- What was the annual spend on external assistance for cyber security last financial year? (Excluding products/systems, when I refer to external assistance I mean things like consultancy/training)
- What is the annual budget for data protection activities?
- What was the annual spend on external assistance for data protection activities last year? (Excluding products/systems, when I refer to external assistance I mean things like consultancy/training)
We said
Thank you for your request. The Security team here covers UKSA, ONS and OSR and so the following answers reflect this:
We do not have a SIRO, this is no longer a mandatory role for a Government Department.
Not applicable.
Our Data Protection Officer (DPO) is Ross Young.
The contact email of our DPO is DPO@statistics.gov.uk
The person with overall responsibility for Cyber security or equivalent is Andy Wall, Chief Security Officer.
The contact email is security@ons.gov.uk
The name of the person with overall responsibility for information security or equivalent is Andy Wall, Chief Security Officer.
The contact email is security@ons.gov.uk
The name of the person with overall responsibility for information governance or equivalent is Andy Wall, Chief Security Officer.
The contact email is security@ons.gov.uk
We operate Information Asset Owner Roles across the organisation. This is a defined role specification in accordance with Government requirements and are typically senior managers within the different business areas.
Our security approach is based on UK Government standards; we incorporate compliant ISO 27001 controls within this. We are not certified to ISO 27001. The ownership of the security approach rests with the Chief Security Officer.
Not applicable.
No, the PSN is no longer in operation.
Not applicable.
Funding for cyber security is not as a single fixed budget to the Security team. Many security functions are embedded and devolved across business areas and so unfortunetly we do not hold this.
We utilise limited external consultancy in support of security and this is not specific to cyber security. The security team invests in internal and wider organisation training but this is not specific to cyber security.
Funding for data protection is not as a single fixed budget. Many requirements for data protection are embedded and devolved across business areas. Specific costs for this are not collated.
We do not use external consultancy in support of data protection. Training is provided internally and via civil service e-learning.
Please note
The first line of this response was updated on 2 December 2019 to provide more clarity and context to the answers.