Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²²⁄₂₃

Data Man­age­ment

Decem­ber 2022

---

Page 1: (Image of logo and title page)

---

Page 2:

Cairngorms Nation­al Park Authority Intern­al Audit Report ²⁰²²⁄₂₃ Data Man­age­ment

• Exec­ut­ive Sum­mary: 1
• Man­age­ment Action Plan: 4
• Appendix A – Defin­i­tions: 7

Audit Spon­sor	Key Con­tacts	Audit team
Dav­id Camer­on, Dir­ect­or of Cor­por­ate Services	Lisa MacIsaac, Gov­ernance, Data & Report­ing Manager	Neil Belton, IT Audit Dir­ect­or Ash­ley Bick­er­staff, IT Audit Man­ager Heath­er Boyle, IT Auditor

---

Page 3:

Exec­ut­ive Summary

Con­clu­sion

The Cairngorms Nation­al Park Author­ity (CNPA) does not have a com­plete suite of policies that addresses all expec­ted policy areas for the life­cycle of data. Where policies are in place these have not been maintained.

CNPA has a high-level migra­tion plan doc­u­mented for the migra­tion of data into Share­Point; how­ever, this does not fully detail all actions that are to be under­taken for the imple­ment­a­tion or migra­tion with own­er­ship and com­ple­tion dates set.

There is a sig­ni­fic­ant link between the iden­ti­fic­a­tion of require­ments and risks for data man­age­ment, the cre­ation of adequate policies, and the embed­ding of suit­able pro­ced­ures. It is this con­nec­tion of ele­ments which CNPA have not estab­lished, and which could lead to addi­tion­al work to recon­fig­ure the Share­Point if not remediated.

Back­ground and scope

Cairngorms Nation­al Park Author­ity (CNPA) is evolving the work­ing prac­tices and tech­no­logy that under­pins its sys­tems and con­trols around data man­age­ment. This evol­u­tion fol­lows on from the organisation’s response to COV­ID-19 and the changes as to how data is used and managed.

CNPA is migrat­ing data and records from its cur­rent net­work file share envir­on­ment to Share­Point. The inten­tion is that this will con­sol­id­ate data into a cloud-based, secure cent­ral loc­a­tion which, in turn, will provide a clear­er view of the data that the organ­isa­tion holds. Share­Point will be access­ible to all staff wheth­er work­ing from an office or a remote loc­a­tion; sup­ports col­lab­or­at­ive work­ing; and enables secure shar­ing of iden­ti­fied records with col­lab­or­at­ing partners.

We have reviewed the adequacy of the organisation’s approach to address­ing data man­age­ment chal­lenges as part of the planned migra­tion of data to SharePoint.

---

Page 4:

Con­trol assessment

(Image of pie chart with 1‑Amber, 2‑Amber, 3‑Amber)

1. Data life­cycle policies, stand­ards and pro­ced­ures have been reviewed and updated to sup­port the stra­tegic and oper­a­tion­al use of SharePoint.
2. The organ­isa­tion has developed a migra­tion plan for the move to Share­Point that addresses con­sol­id­a­tion and secur­ity of data as well as train­ing needs of staff.
3. The planned imple­ment­a­tion of Share­Point addresses key areas of inform­a­tion secur­ity such as; access con­trols, data labelling, secur­ity and retention.

(Image of bar chart show­ing Improve­ment actions by type and priority)

Two improve­ment actions have been iden­ti­fied from this review, both of which relate to the design of con­trols them­selves. See Appendix A for defin­i­tions of col­our coding.

---

Page 5:

Key find­ings

Areas for improvement

We have iden­ti­fied areas for improve­ment which, if addressed, would strengthen CNPA’s con­trol frame­work. These include:

• CNPA does not address all expec­ted policy areas with­in their policy suite. Where policies are in place they have not been main­tained, with some not reviewed since 2016.
• CNPA have not fully iden­ti­fied and doc­u­mented their solu­tion require­ments and the risks of data being migrated to and resid­ing in the cloud.
• The organ­isa­tion has not imple­men­ted suf­fi­ciently detailed plan­ning for the migra­tion to SharePoint.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on risk register

The CNPA cor­por­ate risk register (Janu­ary 2022) included the fol­low­ing risks rel­ev­ant to this review:

• Risk A17 — Tech­nic­al: Increas­ing ICT depend­ency for effect­ive and effi­cient oper­a­tions is not adequately backed up by ICT sys­tems support.
• Risk A13 — Resourcing: CNPA IT ser­vices are not suf­fi­ciently robust / secure / or well enough spe­cified to sup­port effect­ive and effi­cient ser­vice delivery.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Page 6:

Man­age­ment Action Plan

Con­trol Object­ive 1: Data life­cycle policies, stand­ards and pro­ced­ures have been reviewed and updated to sup­port the stra­tegic and oper­a­tion­al use of Share­Point. (Amber)

Con­trol Object­ive 3: The planned imple­ment­a­tion of Share­Point addresses key areas of inform­a­tion secur­ity such as; access con­trols, data labelling, secur­ity and reten­tion. (Amber)

1.1 Policies and Require­ments for Implementation

Key policies and pro­ced­ures sur­round­ing the life­cycle of data are not in place with­in CNPA.

An over­arch­ing ICT Policy includes ref­er­ences to accept­able use of inter­net and email, as well as elec­tron­ic fil­ing and disk space man­age­ment; this policy has not been updated since Janu­ary 2016. Policies address­ing areas of data secur­ity, such as Access Con­trol, Cloud and Data Secur­ity, and Data Labelling and Clas­si­fic­a­tion, are not addressed in exist­ing policies.

There has been no work to update any policies with rela­tion to the use of Share­Point. Policies that are in place are out­dated; the organisation’s Data Pro­tec­tion Policy and Data Secur­ity Breach Man­age­ment Policy were last updated in Septem­ber 2018, and the Email Policy in Janu­ary 2016.

It is unclear how CNPA have defined tech­nic­al require­ments for migra­tion to the cloud, as there is no form­al doc­u­ment­a­tion sup­port­ing this pro­cess and we would have expec­ted that such require­ments would be driv­en by rel­ev­ant policy. Without these policies in place, there is a lack of clar­ity around how CNPA will embed their require­ments into the con­fig­ur­a­tion of SharePoint.

Risk:

If policies and pro­ced­ures for the stor­age and pro­cessing of data are not in place and main­tained, there is a risk that CNPA will not be in a pos­i­tion to assess and identi­fy their require­ments for migra­tion to Share­Point. This could res­ult in the secur­ity of data not being in line with leg­al or organ­isa­tion­al require­ments, which may have fin­an­cial or repu­ta­tion­al consequences.

Recom­mend­a­tion:

We recom­mend that CNPA review the cur­rent policy suite that is in place and devel­op and imple­ment policies that address the fol­low­ing policy areas:

• Data Man­age­ment
• Data Reten­tion
• Inform­a­tion Transfer
• Cloud Secur­ity
• Data Pro­tec­tion

---

Page 7:

• Access Con­trol
• Back-up and Resilience
• Data Labelling and Inform­a­tion Classification
• Accept­able Use
• Remote Access

We recom­mend that CNPA intro­duce a review cycle as stand­ard for all policies, includ­ing those not dir­ectly related to the migra­tion to Share­Point. The sub­sequent review and update pro­cess should be under­taken annu­ally or in response to any sig­ni­fic­ant changes or events.

The con­fig­ur­a­tion of the Share­Point should be aligned to policy doc­u­ment­a­tion, and take into account secur­ity and data pro­tec­tion needs, organ­isa­tion­al struc­ture require­ments, and end-user exper­i­ence expectations.

Once policies have been defined, this should allow the con­fig­ur­a­tion of Share­Point in a man­ner which ful­fils the organisation’s require­ments and facil­it­ates expec­ted usage and behaviour.

Man­age­ment Action (Grade 3 (Design))

Recom­mend­a­tion agreed. This recom­mend­a­tion is in line with the estab­lished dir­ec­tion of our Share­Point Trans­ition Pro­ject and we will incor­por­ate the ele­ments of the recom­mend­a­tion in a revised pro­ject plan. Man­age­ment has sus­pen­ded the full roll out of Share­Point to allow the tech­nic­al require­ments of trans­ition and sub­sequent oper­a­tion to be defined and agreed pri­or to full roll out and imple­ment­a­tion of the system.

Note: we take the ele­ment of the recom­mend­a­tion on estab­lish­ing a policy review cycle as a wider ele­ment of action, to be estab­lished more expli­citly around all Park Author­ity policies.

Action own­er: Deputy Chief Exec­ut­ive, as seni­or spon­sor of the Share­Point Trans­ition Pro­ject and over­sight of wider organ­isa­tion­al devel­op­ment work required

Due date: 31 Decem­ber 2023 for com­ple­tion giv­en breadth of ele­ments of this recommendation

---

Page 8:

Con­trol Object­ive 2: The organ­isa­tion has developed a migra­tion plan for the move to Share­Point that addresses con­sol­id­a­tion and secur­ity of data as well as train­ing needs of staff. (Amber)

2.1 Migra­tion Plan

CNPA have not estab­lished a detailed migra­tion strategy or plan to steer the pro­ject. A timeline is in place, indic­at­ing the sched­ule of activ­it­ies. This is high-level in nature and does not include own­ers or track­ing to indic­ate if tasks have been com­pleted as planned or if the migra­tion is pro­gress­ing on sched­ule. There is an under­stand­ing of the actions that will need to be com­pleted as part of the pro­ject, from the bene­fits of migrat­ing data gradu­ally rather than in a single migra­tion, to the need for train­ing to be developed and sourced going for­ward. The migra­tion plan, how­ever, is not suf­fi­ciently detailed to doc­u­ment this.

There is engage­ment with a third party for the imple­ment­a­tion of the Share­Point solu­tion but it is not clear how engaged with the busi­ness CNPA’s IT team have been in the devel­op­ment of the migra­tion plan.

Risk:

Without a robust cloud migra­tion strategy, there is a risk that CNPA have not iden­ti­fied all actions required or the most appro­pri­ate meth­ods of trans­ition for the organ­isa­tion, which may lead to data and file struc­tures not meet­ing organ­isa­tion­al needs and data pro­tec­tion oblig­a­tions, or inap­pro­pri­ate man­age­ment of data secur­ity and resilience.

Recom­mend­a­tion:

In line with the update of policies and iden­ti­fic­a­tion of require­ments recom­men­ded in MAP 1.1, we recom­mend that CNPA estab­lishes a cloud migra­tion strategy or plan which takes into account how these require­ments will be met by Share­Point and the actions required to con­fig­ure the solu­tion to do so.

Plan­ning should be estab­lished at a lower level, with actions assigned respons­ible and account­able indi­vidu­als as well as due dates. Con­tinu­ous mon­it­or­ing should be applied to ensure work is occur­ring in line with the sched­ule with report­ing to a rel­ev­ant gov­ernance group.

Man­age­ment Action (Grade 3 (Design))

Recom­mend­a­tion agreed. Again, this is in line with the Share­Point trans­ition pro­ject we have estab­lished, which had com­menced pre­lim­in­ary work to identi­fy require­ments around this project.

Action own­er: Deputy Chief Exec­ut­ive, as seni­or spon­sor of the Share­Point Trans­ition Pro­ject and over­sight of wider organ­isa­tion­al devel­op­ment work required

Due date: 30 April 2023

---

Page 9:

Appendix A – Definitions

Con­trol assessments

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

Page 10:

© Azets 2022. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.