Norfolk County Council CIO renegotiates terms on HPE contract and beefs up cyber security

Geoff Connell says council is now ‘better prepared’ to stop data breaches after ICO audit

Norfolk County Council is better equipped to deal with data breaches after it completed an audit from the Information Commissioner's Office, according to CIO Geoff Connell.

Connell, who took over as head of ICT and information management in August 2016, tells IT Pro that his two main objectives since joining the council have been to work with the ICO on the audit, and to work with one its biggest providers HPE to renegotiate terms on its contract for the troubled Digital Norfolk Ambition' project.

Cyber security

Norfolk Council does not have a good record when it comes to data breaches; it was fined 80,000 by watchdogs in 2012 after a social worker hand-delivered highly sensitive child welfare information to the wrong address. The council recorded 59 breaches between 2011 and 2014, with one of the most shocking incidents being when confidential files containing details of adults and children was left in a filing cabinet which was sold following an office move.

But after an audit completed by the ICO in January, Connell believes the council is much better prepared.

"We had to do quite a lot of work to improve our processes and we're well on track with that to make sure we have the right information sharing agreements in place," he says.

Connell emphasises that the audit is not a compulsory programme to catch the council out, but is instead an optional audit to help the organisation to improve its policies.

The council has now resolved its historical data loss cases and has implemented new policies, procedures and awareness training. It is the latter, which Connell believes is most crucial.

"Of course you need policies but if people don't know what they are or how to use them then it's no good," he states.

He will be testing staff by sending out phishing e-mails to see who clicks on malicious' links the idea is to understand what more can be done to train staff.

Cyber security is something Connell has also been focused on in his role as president of SOCITM. He wants to put together activities for local authorities within the new national cyber security centre.

"It's a really important focus area for local authorities it's not just about making sure we're in good shape, but that we can join up and work with central government agencies and other public sector organisations safely," he states.

Connell is passionate about data being shared across public sector organisations more easily. He says that it would enable social workers to know about medicines that people are on, and hospitals to know what social care arrangements have been made.

"Up until now, this has all been on an ad hoc basis. We need to make it more systematic and share data when it is appropriate to do so," he says.

But as public sector organisations are funded separately, and budget cuts continue to be made across the board, it makes it increasingly difficult for all parts of the public sector to continue to invest in technology that can help with data-sharing. By work together, the money could be spent more efficiently.

"For example, councils spend a lot of money on technology that helps elderly people to live more independently in their homes, such as IoT, but if local authorities are spending the money then health organisations save the money. Likewise if care homes aren't being adequately funded it is difficult for elderly people to be discharged from hospitals.

"So we need to have ways of working that enable joint investment," he says.

Renegotiating terms with HPE

Connell is in charge of Digital Norfolk Ambition' a 26m IT transformation project which one councillor referred to as a "looming catastrophe" in an interview with the Eastern Daily Press.

The project was signed back in December 2013 with HPE, Microsoft and Vodafone as the three key suppliers but it has been beset by issues such as an increase in costs, a build-up of delays and technical issues with laptops.

In order to solve some of these problems, Connell has held talks with HPE to reshape the agreement.

"We only have another year and half on the contract and we've agreed certain things we don't want to do with them anymore that we will take in-house, and other things which they're doing well which we will continue with but ultimately we need to be planning to exit from that contract," he states.

Despite the need to move away from the contract, Connell has been satisfied with how HPE have dealt with the contract review.

"Give them credit, they were flexible and they've recognised that times have changed and that not everything will pan out as you'd expect it to. It's important that vendors are able to alter the contract scope to ensure it is most cost-effective," he says.

Indeed, HPE is not one of the big vendors that Connell would say it hard to work with.

"There are some vendors that are notoriously difficult when it comes to licensing because they have complexity that you may call borderline fraud because they are simply inflexible," he states.

"Some view their products as cash cows so they're taking money and not reinvesting it, and some that don't keep up to date with patching, browsers and versions of different products we use so it's difficult for us to keep up to date," he adds.

Connell says that it is up to public sector organisations to  work together to help to shift this kind of behaviour from these big vendors, either by buying from other suppliers or lobbying through user groups.

Featured Resources

Virtual desktops and apps for dummies

An easy guide to virtual desktop infrastructure, end-user computing, and more

Download now

The total economic impact of optimising and managing your hybrid multi-cloud

Cost savings and business benefits of accelerating the cloud journey

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

What’s next for the education sector?

A new learning experience

Download now

Recommended

Cyber attacks against organizations increasing as more staff work from home
cyber security

Cyber attacks against organizations increasing as more staff work from home

17 May 2021
What is phishing?
phishing

What is phishing?

17 May 2021
Cisco to acquire threat intelligence provider Kenna Security
Acquisition

Cisco to acquire threat intelligence provider Kenna Security

14 May 2021
What is the Computer Misuse Act?
Policy & legislation

What is the Computer Misuse Act?

14 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021