## Ict Review Recommendation Implementation Schedule - March 2014 Recommendation Management Response Updated Position

| No change                                           | Recommendation 1:    |
|-----------------------------------------------------|----------------------|
| Formalise and document the ICT strategy in          |                      |
| line with the business requirements.                |                      |
| The current ICT Strategy was ratified in June       |                      |
| 2005 so is due for revision. The Corporate          |                      |
| Management Board has agreed that the                |                      |
| revised strategy will be consulted upon and         |                      |
| produced post April 2014. This will give the        |                      |
| organisation sufficient time to instigate and       |                      |
| complete critical mail, server and infrastructure   |                      |
| improvement projects by March 2014.                 |                      |
|                                                     |                      |
| Responsibility: London Councils - Frank Smith       |                      |
|                                                     |                      |
| Target Implementation Date: August 2014             |                      |
| No change                                           | Recommendation 2:    |
| LC are recommended implement an                     |                      |
| appropriate programme of training in line with      |                      |
| industry guidelines.                                |                      |
| London Councils has been trying to implement        |                      |
| an appropriate programme of training in line        |                      |
| with what the City of London does for some          |                      |
| time. However, the on-line/e-learning courses       |                      |
| on protecting Information and Data Security         |                      |
| which City of London employees are required         |                      |
| to complete is only  now  available to London       |                      |
| Councils staff. The DPA and FOI modules are         |                      |
| still not.                                          |                      |
|                                                     |                      |
| A training package will be developed which          |                      |
| extracts the relevant parts of the on-line training |                      |
| with a bespoke London Councils element,             |                      |
| which will be delivered to all staff at Southwark   |                      |
| Street/Angel Square.                                |                      |
|                                                     |                      |
| Responsibility: London Councils - Christiane        |                      |
| Jenkins                                             |                      |
|                                                     |                      |
| Target Implementation Date: From April 2014         |                      |
| Recommendation                                     | Management Response    |
|----------------------------------------------------|------------------------|
| No change                                          | Recommendation 3:      |
| LC are recommended to review all aspects of        |                        |
| the computer room and improve/align them with      |                        |
| industry best practice guidelines.                 |                        |
| All redundant kit and cabling has already been     |                        |
| removed from the computer room and as              |                        |
| exiting server hosts are being virtualised         |                        |
| remaining redundant hardware will be               |                        |
| decommissioned. The mail server hosts will be      |                        |
| decommissioned post the Office365 migration        |                        |
| in April/May 2014.  A UPS has also been            |                        |
| installed to support the new virtual server        |                        |
| environment. The remaining phone and PBX           |                        |
| servers will also be virtualised.                  |                        |
|                                                    |                        |
| A second permanent air cooling unit was            |                        |
| commissioned and installed in January 2014         |                        |
| providing the required air cooling temperature     |                        |
| throughout this space.                             |                        |
|                                                    |                        |
| Any other required improvements are building       |                        |
| works changes. As the building is owned by the     |                        |
| City of London Corporation, it is suggested that   |                        |
| the City Surveyors provide costs for these         |                        |
| improvements, as a refurbishment of the server     |                        |
| room together with any 3rd party equipment         |                        |
| should be completed as a single project.           |                        |
|                                                    |                        |
| Responsibility: London Councils - Roy Stanley      |                        |
|                                                    |                        |
| Target Implementation Date: January 2015           |                        |
| Testing of the cloud service commenced with        |                        |
| full migration still scheduled for mid-April 2014. |                        |

Recommendation 4: LC and CoL are aware of the risks (from the LC technology report) of the current software and timescales. A project to replace the Email system (implementation scheduled for first quarter of 2014) with the cloud based Office 365 is underway, however  delays are already occurring.  The project and the interdependencies need to be carefully and regularly monitored to ensure delays are minimised otherwise an interim solution should be investigated and implemented prior to the expiry of the extended support date. 

These issues will be resolved with migration of LCs email stores to cloud storage (Office 365). This project is has been scoped in conjunction with CoL and cloud consultants Content & Code. Progress and project plan is reviewed weekly with controls in place. Tests will begin with a testing group during February 2014 with full roll-out projected to be completed early April 2014. 
Responsibility: London Councils - Roy Stanley 
 
Target Implementation Date: April 2014 
| Recommendation                                    | Management Response    |
|---------------------------------------------------|------------------------|
| No change                                         | Recommendation 5:      |
| The London Councils Reports highlighted this      |                        |
| issue however a proposed solution has not         |                        |
| been confirmed yet. Consider implementation       |                        |
| of a proper IP subnet to improve security and     |                        |
| conform to best practice standards to avoid       |                        |
| future problems.                                  |                        |
| The London Councils network in its present        |                        |
| topology could support multiple subnets           |                        |
| however additional or replacement networking      |                        |
| equipment would be required to achieve this.      |                        |
| Agilisys, the City of London's ICT contractor     |                        |
| can provide London Councils with a proposal       |                        |
| for this network infrastructure upgrade and the   |                        |
| project plan for migrating to a new IP            |                        |
| addressing scheme. This would be a new            |                        |
| service request that would need to be further     |                        |
| scoped. City estimates are at present around      |                        |
| £40,000 for this piece of work.                   |                        |
|                                                   |                        |
| Responsibility: London Councils - Roy Stanley     |                        |
|                                                   |                        |
| Target Implementation Date:  January 2015         |                        |
| No change                                         | Recommendation 6:      |
| Establish and implement LC password security      |                        |
| standard in line with industry best practice and  |                        |
| apply to all systems.                             |                        |
| London Councils Active Directory domain           |                        |
| logons follow a best practice password policy     |                        |
| adopted from the City of London. London           |                        |
| Councils will carry out a further scoping         |                        |
| exercise of all our existing systems that do not  |                        |
| meet best practice password policies and this     |                        |
| can be managed as separate project.               |                        |
|                                                   |                        |
| All staff are issued with a password and all the  |                        |
| Internet/Email/Telephone Policy states:           |                        |
|                                                   |                        |
| "individuals are required to follow the necessary |                        |
| security disciplines and to keep their passwords  |                        |
| totally confidential"                             |                        |
| .                                                 |                        |
|                                                   |                        |
| London Councils will periodically remind staff    |                        |
| that this is the case.                            |                        |
|                                                   |                        |
| Responsibility: London Councils - Roy Stanley     |                        |
|                                                   |                        |
| Target Implementation Date: January 2015          |                        |
| Recommendation                                   | Management Response    |
|--------------------------------------------------|------------------------|
| Recommendation 7:                                |                        |
| Install suitable access measures which include   |                        |
| two factor authentication which requires the     |                        |
| current user logon and password, and             |                        |
| additionally a security fob or similar.          |                        |
| All staff have been migrated over to the         |                        |
| transitional remote access server. The new       |                        |
| Remote Desktop Service farm was completed        |                        |
| on 28                                            |                        |
|                                                  |                        |
| February 2014 and load balance testing           |                        |
| completed on the       7 March 2014. Migration   |                        |
| from transitional server to Live remote access   |                        |
| farm to completed by 28 March 2014               |                        |
| London Councils are in the process of            |                        |
| migrating their remote access solution onto a    |                        |
| server farm built on Windows Server 2008.        |                        |
| Staff will now be required to access the remote  |                        |
| service using a secure desktop icon which        |                        |
| contains additional security and gateway data.   |                        |
| The IP address gateway access will be            |                        |
| switched off in March 2014.                      |                        |
|                                                  |                        |
| Responsibility: London Councils - Roy Stanley    |                        |
|                                                  |                        |
| Target Implementation Date: March 2014           |                        |
| No change                                        | Recommendation 8:      |
| LC are recommended to implement a                |                        |
| procedure to include logging, monitoring and     |                        |
| reporting to allow assessment of the data for    |                        |
| corrective action.                               |                        |
|                                                  |                        |
| Agilysis and the City of London have been        |                        |
| asked to provide a  proposal for additional      |                        |
| security for the monitoring of network logons,   |                        |
| which will be reviewed by the ICT and Facilities |                        |
| Manager.                                         |                        |
|                                                  |                        |
| Responsibility: London Councils - Roy Stanley    |                        |
|                                                  |                        |
| Target Implementation Date: January 2015         |                        |
| Recommendation                                       | Management Response    |
|------------------------------------------------------|------------------------|
| Recommendation 9:                                    |                        |
| Create an responsible internet access policy         |                        |
| and disseminate to staff.                            |                        |
| Further detailed testing of white listed and         |                        |
| Internet Watch Foundation sites is necessary.        |                        |
| Revised completion date of April 2014                |                        |
| London Councils has a well-documented and            |                        |
| intranet accessible Internet/Email/telephone         |                        |
| Policy which clearly sets out what is                |                        |
| acceptable/not acceptable. Access to                 |                        |
| unacceptable sites was blocked in 2010 and           |                        |
| allowable access was discussed at length by          |                        |
| London Councils Corporate Management                 |                        |
| Board and as a consequence the                       |                        |
| Internet/Email/telephone Policy alongside the        |                        |
| equally accessible Social Media Guidelines are       |                        |
| considered adequate for London Councils.             |                        |
|                                                      |                        |
| The current Ironport web proxy and URL               |                        |
| filtering system is currently not filtering due to a |                        |
| fault. The implementation of Webroot would           |                        |
| allow London councils to enforce its internet        |                        |
| access policy. Webroot testing is due to start in    |                        |
| February with implementation later that month.       |                        |
|                                                      |                        |
| Responsibility: London Councils - Roy Stanley        |                        |
|                                                      |                        |
| Target Implementation Date: Webroot                  |                        |
| implementation - February 2014                       |                        |
| No change                                            | Recommendation 10:     |
| Consider restricting access to administration        |                        |
| users only and locking down PC's  so data            |                        |
| cannot be easily copied and additionally             |                        |
| implement a process to enable data copy              |                        |
| requests with suitable controls.                     |                        |
| Agilysis have been asked to provide a proposal       |                        |
| for installing appropriate software to make the      |                        |
| use of portable media more secure. The               |                        |
| proposal will be considered by the ICT and           |                        |
| Facilities Manager.                                  |                        |
|                                                      |                        |
| Responsibility: London Councils - Roy Stanley        |                        |
|                                                      |                        |
| Target Implementation Date: July 2014                |                        |
| Recommendation                                    | Management Response                        |
|---------------------------------------------------|--------------------------------------------|
| No change                                         | Recommendation 11:                         |
| Implement suitable controls for monitoring and    |                                            |
| management of disk capacity for the email         |                                            |
| system and other critical systems.                |                                            |
| Daily checks are in place monitored by the City   |                                            |
| ICT team for LCCOMMS as this server has had       |                                            |
| some disk space issues. Further work is due to    |                                            |
| be carried out to reduce mailbox database         |                                            |
| sizes prior to migration to the cloud services.   |                                            |
| Mutiny alert software is currently used on all    |                                            |
| systems to alert on disk usage over 80%.          |                                            |
|                                                   |                                            |
| Responsibility: London Councils - Roy Stanley     |                                            |
|                                                   |                                            |
| Target Implementation Date: May 2014              |                                            |
| No change                                         | This server is now decommissioned and only |
| secure data transfer will now be permitted.       |                                            |
|                                                   |                                            |
| Responsibility: London Councils - Roy Stanley     |                                            |
|                                                   |                                            |
| Target Implementation Date: December 2013         |                                            |
| Recommendation 12:                                |                                            |
| The LC are aware of this issue from the report    |                                            |
| produced by CoL which resulted in the move of     |                                            |
| the FTP server  into more secure area,            |                                            |
| however,  further improvements are                |                                            |
| recommended.                                      |                                            |
|                                                   |                                            |
| As a minimum modify the server to only allow      |                                            |
| only secure data transfer using Secure File       |                                            |
| Transfer Protocol (SFTP) as opposed to FTP.       |                                            |
| Implement a process for assessing and             |                                            |
| authorising use of this facility and document     |                                            |
| user and data transfer information.               |                                            |
| No change                                         | Recommendation 13:                         |
| A monthly review of support calls that exceed     |                                            |
| SLA is advised with a view to identifying         |                                            |
| problem areas and acceptable delays for a         |                                            |
| more accurate assessment of the level of          |                                            |
| service provided.                                 |                                            |
| Since January 2014 Agilisys have now have         |                                            |
| implemented a new service management tool         |                                            |
| Hornbill which will be available to provide more  |                                            |
| accurate information on SLA and areas where       |                                            |
| call resolution is not meeting targets. The ICT & |                                            |
| Facilities Manager, who is responsible for the    |                                            |
| client-side management of the ICT service         |                                            |
| provided by the City, now has access to           |                                            |
| thCity's call logging portal so is nowable to     |                                            |
| monitor all logged and breached incidents and     |                                            |
| service requests                                  |                                            |
|                                                   |                                            |
| Responsibility: London Councils - Roy Stanley     |                                            |
|                                                   |                                            |
| Target Implementation Date: February 2014         |                                            |
| Recommendation                                   | Management Response    |
|--------------------------------------------------|------------------------|
| Revised completion date of March 2014            | Recommendation 14:     |
| Consolidate important information into a ICT     |                        |
| contracts register with a procedure to regularly |                        |
| review and update the contents.                  |                        |
| Contract data is being compiled and will be      |                        |
| held in a single contracts register.             |                        |
|                                                  |                        |
| Responsibility: London Councils - Roy Stanley    |                        |
|                                                  |                        |
| Target Implementation Date: February 2014        |                        |
| No change                                        | Recommendation 15:     |
| Enforce voicemail pin code functionality which   |                        |
| is already available.                            |                        |
| London Councils currently manage telephony       |                        |
| and voicemail system. All telephones are         |                        |
| accessible for all staff to use and to monitor   |                        |
| and pick-up and to ensure any voicemail          |                        |
| messages are dealt with.                         |                        |
|                                                  |                        |
| London Councils does not consider that a         |                        |
| voicemail pin code is necessary - this will      |                        |
| mitigate staff being able to cover for one       |                        |
| another and provide a proper service to our      |                        |
| customers/stakeholders.                          |                        |
|                                                  |                        |
|                                                  |                        |
| Responsibility: London Councils - Roy Stanley    |                        |
|                                                  |                        |
| Target Implementation Date: Already in place     |                        |
| No change                                        | Recommendation 16:     |
| Install latest security patches and implement a  |                        |
| procedure to regularly patch all systems         |                        |
| An SCCM server is currently in place and will    |                        |
| be configured to automate the MS Windows         |                        |
| Server patching.                                 |                        |
|                                                  |                        |
| MS SQL servers are not patched automatically     |                        |
| due to the complexity and impact of patches      |                        |
| across a MS SQL server hosting multiple          |                        |
| databases. A review of existing 3rd party        |                        |
| database application will be carried and the MS  |                        |
| SQL server patches will be applied               |                        |
|                                                  |                        |
| Responsibility: London Councils - Roy Stanley    |                        |
|                                                  |                        |
| Target Implementation Date: Already in place     |                        |
| Recommendation                                        | Management Response    |
|-------------------------------------------------------|------------------------|
| No change                                             | Recommendation 17:     |
| Investigate infrastructure for all points of failure  |                        |
| and initiate a project to improve resilience          |                        |
| otherwise include reasons for risk acceptance.        |                        |
| In the meantime ensure the firewall                   |                        |
| configuration is backed up regularly.                 |                        |
| The City of London site is the DR site for            |                        |
| London Councils and the need for dual firewalls       |                        |
| at this site may not be cost effective. The           |                        |
| London Councils site firewall is managed by a         |                        |
| third party (BIS) who provide backups of the          |                        |
| firewall configuration and an SLA for hardware        |                        |
| faults.                                               |                        |
|                                                       |                        |
| The existing Virgin media Internet link currently     |                        |
| has an SLA call out target of 8 hours.                |                        |
|                                                       |                        |
| Aglisys have estimated an additional annual           |                        |
| cost of £10,000  for a fully resilient internet fail- |                        |
| over connection                                       |                        |
|                                                       |                        |
| Responsibility: London Councils - Roy Stanley         |                        |
|                                                       |                        |
| Target Implementation Date: July 2014                 |                        |
| No change                                             | Recommendation 18:     |
| Update the current BCP plans and regularly            |                        |
| review (at least annually).                           |                        |
| Both documents for 59½ Southwark Street and           |                        |
| Angel Square are in the process of consultation       |                        |
| and review. This will be conducted in                 |                        |
| conjunction with Recommendation 19                    |                        |
|                                                       |                        |
| Responsibility: London Councils - Roy Stanley         |                        |
|                                                       |                        |
| Target Implementation Date: June 2014                 |                        |
| No change                                             | Recommendation 19:     |
| Produce a comprehensive DR plan inclusive of          |                        |
| testing.                                              |                        |
| In conjunction with Recommendation 18 a               |                        |
| single comprehensive DR with test plan will be        |                        |
| devised. A test of the DR plan will be                |                        |
| undertaken post the Office365 implementation.         |                        |
|                                                       |                        |
| Responsibility: London Councils - Roy Stanley         |                        |
|                                                       |                        |
| Target Implementation Date: June 2014                 |                        |
|                                                       |                        |