1-20 of 27 results for subject:Databases
Librarians' tools
- Search time
- 0.239 seconds
- Solr query time
- 0.006 seconds
- Search query
- subject:Databases
- We searched for
- subject_t:Databases OR subject_t:"Data banks" OR subject_ses:90822
Primary member
X
Miller, Maria
Type
House
Session
Year
Department
Member
Primary member
More
Miller, Maria (27)
Answering member
Legislative stage
Legislation
Subject
Publisher
To ask the Secretary of State for Justice what information on the dependent children of prisoners is held on the C-NOMIS database.
To ask the Secretary of State for Justice what information on the dependent children of prisoners is held on the C-NOMIS database.
Asked by
Maria Miller
(Conservative)
Answered by
Maria Eagle
(Labour)
Answering body
Ministry of Justice
Type
Written questions
Status
Answered
Tabled on
4 November 2009
For answer on
9 November 2009
Answered on
11 November 2009
The C-NOMIS database, now known as Prison-NOMIS, holds information on the number of children of prisoners, it is not a mandatory entry, so information is incomplete.
Subjects
Databases; Offenders
Date
11 November 2009
Reference
298708; 499 c482W
House
House of Commons
To ask the Secretary of State for Children, Schools and Families with reference to the Answer of 8 October 2008, Official Report, column 474W, on children: databases, which usability issues his Department is resolving before the ContactPoint system is user tested.
To ask the Secretary of State for Children, Schools and Families with reference to the Answer of 8 October 2008, Official Report, column 474W, on children: databases, which usability issues his Department is resolving before the ContactPoint system is user tested.
Asked by
Maria Miller
(Conservative)
Answered by
Baroness Hughes of Stretford
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
22 January 2009
For answer on
26 January 2009
Answered on
10 February 2009
ContactPoint is designed to save time for professionals working with children, therefore ensuring smooth working for users is very important.The purpose of testing is to uncover issues and deal with them before deployment. We discovered a number of issues that we wanted to rectify before commencing the final stages of testing with users. They were typical for this stage of project delivery and included minor functional changes and enhancements to screens. If not rectified, these issues can cause frustration to those involved in testing activity and can restrict the benefit that the activity can provide.We have always said that we will take the time to get ContactPoint right. We wanted to ensure that testing provided the maximum benefit possible and therefore took the decision to fix these issues before commencing testing with users on 13 October 2008. The user testing phase completed successfully on 28 November 2008.
Subjects
Children; Databases
Date
10 February 2009
Reference
487 c1949W; 252077
House
House of Commons
To ask the Secretary of State for Children, Schools and Families (1) what procedures are in place to request that a child's personal data be shielded on the ContactPoint database; and what appeals procedure is in place in respect of decisions taken on shielding requests;
To ask the Secretary of State for Children, Schools and Families (1) what procedures are in place to request that a child's personal data be shielded on the ContactPoint database; and what appeals procedure is in place in respect of decisions taken on shielding requests;
Asked by
Maria Miller
(Conservative)
Answered by
Baroness Hughes of Stretford
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 January 2009
For answer on
29 January 2009
Answered on
29 January 2009
ContactPoint is an online tool to enable support for children and young people to be effectively coordinated and ensure that they do not slip through the net. It will contain basic identifying information about all children and young people in England, up to their 18th birthday, and contact details for their parents/carers and for services working with a child or young person and nothing more. ContactPoint will be the quick way for practitioners to find out who else is working with the same child.Shielding of a small proportion of records on ContactPoint is an additional precautionary measure appropriate in the case of children who are at risk of significant harm if their whereabouts were to become known. Parents who believe this to be the case can contact their local authority and make a request for the record to be shielded on ContactPoint. Local authorities will apply the criteria set out in statutory guidance to determine whether it is appropriate to shield the record on ContactPoint. Such decisions will be made on a case-by-case basis and may take into account the level of threat posed, and the views of the child or young person in question, their parents or carers and any practitioners involved with the child.Where the child, young person, parent/carer or practitioner disagrees with a shielding decision, they should follow existing procedures in the local authority for complaints and appeals.Comprehensive national guidance on shielding policy and processes has been made available to all local authorities:"The ContactPoint Guidance, which was made available to local authorities in July 2008, sets out the policy on shielding.""Best Practice Processes: Manage Data, which was made available to local authorities in August 2008, sets out the recommended business processes for shielding.""Additional guidance, produced in response to specific questions asked by local authorities, was made available in December 2008."The policy and processes for shielding have been informed by the experience of a range of bodies including the Children's Society, Women's Aid, the Greater London Domestic Violence Project, the National Police Improvement Agency and the Association of Chief Police Officers.We are not in a position at this early point to provide a definitive figure for numbers of records that may be shielded. However, early indications are that between one and two hundred records on average may be shielded in each local authority.
Subjects
Children; Databases
Date
29 January 2009
Reference
487 c832-3W; 252893
House
House of Commons
(2) what guidance his Department has given to local authorities on the shielding of children's personal data on the ContactPoint database;
(2) what guidance his Department has given to local authorities on the shielding of children's personal data on the ContactPoint database;
Asked by
Maria Miller
(Conservative)
Answered by
Baroness Hughes of Stretford
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 January 2009
For answer on
29 January 2009
Answered on
29 January 2009
ContactPoint is an online tool to enable support for children and young people to be effectively coordinated and ensure that they do not slip through the net. It will contain basic identifying information about all children and young people in England, up to their 18th birthday, and contact details for their parents/carers and for services working with a child or young person and nothing more. ContactPoint will be the quick way for practitioners to find out who else is working with the same child.Shielding of a small proportion of records on ContactPoint is an additional precautionary measure appropriate in the case of children who are at risk of significant harm if their whereabouts were to become known. Parents who believe this to be the case can contact their local authority and make a request for the record to be shielded on ContactPoint. Local authorities will apply the criteria set out in statutory guidance to determine whether it is appropriate to shield the record on ContactPoint. Such decisions will be made on a case-by-case basis and may take into account the level of threat posed, and the views of the child or young person in question, their parents or carers and any practitioners involved with the child.Where the child, young person, parent/carer or practitioner disagrees with a shielding decision, they should follow existing procedures in the local authority for complaints and appeals.Comprehensive national guidance on shielding policy and processes has been made available to all local authorities:"The ContactPoint Guidance, which was made available to local authorities in July 2008, sets out the policy on shielding.""Best Practice Processes: Manage Data, which was made available to local authorities in August 2008, sets out the recommended business processes for shielding.""Additional guidance, produced in response to specific questions asked by local authorities, was made available in December 2008."The policy and processes for shielding have been informed by the experience of a range of bodies including the Children's Society, Women's Aid, the Greater London Domestic Violence Project, the National Police Improvement Agency and the Association of Chief Police Officers.We are not in a position at this early point to provide a definitive figure for numbers of records that may be shielded. However, early indications are that between one and two hundred records on average may be shielded in each local authority.
Subjects
Children; Databases
Date
29 January 2009
Reference
487 c832-3W; 252894
House
House of Commons
(4) what recent estimate he has made of the number of records that will be subject to shielding on the ContactPoint database.
(4) what recent estimate he has made of the number of records that will be subject to shielding on the ContactPoint database.
Asked by
Maria Miller
(Conservative)
Answered by
Baroness Hughes of Stretford
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 January 2009
For answer on
29 January 2009
Answered on
29 January 2009
ContactPoint is an online tool to enable support for children and young people to be effectively coordinated and ensure that they do not slip through the net. It will contain basic identifying information about all children and young people in England, up to their 18th birthday, and contact details for their parents/carers and for services working with a child or young person and nothing more. ContactPoint will be the quick way for practitioners to find out who else is working with the same child.Shielding of a small proportion of records on ContactPoint is an additional precautionary measure appropriate in the case of children who are at risk of significant harm if their whereabouts were to become known. Parents who believe this to be the case can contact their local authority and make a request for the record to be shielded on ContactPoint. Local authorities will apply the criteria set out in statutory guidance to determine whether it is appropriate to shield the record on ContactPoint. Such decisions will be made on a case-by-case basis and may take into account the level of threat posed, and the views of the child or young person in question, their parents or carers and any practitioners involved with the child.Where the child, young person, parent/carer or practitioner disagrees with a shielding decision, they should follow existing procedures in the local authority for complaints and appeals.Comprehensive national guidance on shielding policy and processes has been made available to all local authorities:"The ContactPoint Guidance, which was made available to local authorities in July 2008, sets out the policy on shielding.""Best Practice Processes: Manage Data, which was made available to local authorities in August 2008, sets out the recommended business processes for shielding.""Additional guidance, produced in response to specific questions asked by local authorities, was made available in December 2008."The policy and processes for shielding have been informed by the experience of a range of bodies including the Children's Society, Women's Aid, the Greater London Domestic Violence Project, the National Police Improvement Agency and the Association of Chief Police Officers.We are not in a position at this early point to provide a definitive figure for numbers of records that may be shielded. However, early indications are that between one and two hundred records on average may be shielded in each local authority.
Subjects
Children; Databases
Date
29 January 2009
Reference
487 c832-3W; 252900
House
House of Commons
(3) what steps his Department is taking to ensure consistency across local authorities in their implementation of data shielding under ContactPoint;
(3) what steps his Department is taking to ensure consistency across local authorities in their implementation of data shielding under ContactPoint;
Asked by
Maria Miller
(Conservative)
Answered by
Baroness Hughes of Stretford
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 January 2009
For answer on
29 January 2009
Answered on
29 January 2009
ContactPoint is an online tool to enable support for children and young people to be effectively coordinated and ensure that they do not slip through the net. It will contain basic identifying information about all children and young people in England, up to their 18th birthday, and contact details for their parents/carers and for services working with a child or young person and nothing more. ContactPoint will be the quick way for practitioners to find out who else is working with the same child.Shielding of a small proportion of records on ContactPoint is an additional precautionary measure appropriate in the case of children who are at risk of significant harm if their whereabouts were to become known. Parents who believe this to be the case can contact their local authority and make a request for the record to be shielded on ContactPoint. Local authorities will apply the criteria set out in statutory guidance to determine whether it is appropriate to shield the record on ContactPoint. Such decisions will be made on a case-by-case basis and may take into account the level of threat posed, and the views of the child or young person in question, their parents or carers and any practitioners involved with the child.Where the child, young person, parent/carer or practitioner disagrees with a shielding decision, they should follow existing procedures in the local authority for complaints and appeals.Comprehensive national guidance on shielding policy and processes has been made available to all local authorities:"The ContactPoint Guidance, which was made available to local authorities in July 2008, sets out the policy on shielding.""Best Practice Processes: Manage Data, which was made available to local authorities in August 2008, sets out the recommended business processes for shielding.""Additional guidance, produced in response to specific questions asked by local authorities, was made available in December 2008."The policy and processes for shielding have been informed by the experience of a range of bodies including the Children's Society, Women's Aid, the Greater London Domestic Violence Project, the National Police Improvement Agency and the Association of Chief Police Officers.We are not in a position at this early point to provide a definitive figure for numbers of records that may be shielded. However, early indications are that between one and two hundred records on average may be shielded in each local authority.
Subjects
Children; Databases
Date
29 January 2009
Reference
487 c832-3W; 252895
House
House of Commons
To ask the Secretary of State for Children, Schools and Families what the reasons are for the delay in the implementation of ContactPoint; and what the cost to the public purse of (a) that delay and (b) implementation in full will be.
To ask the Secretary of State for Children, Schools and Families what the reasons are for the delay in the implementation of ContactPoint; and what the cost to the public purse of (a) that delay and (b) implementation in full will be.
Asked by
Maria Miller
(Conservative)
Answered by
Baroness Hughes of Stretford
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
3 October 2008
For answer on
6 October 2008
Answered on
6 October 2008
The Government have always been clear that they would take a steady, staged approach to developing ContactPoint including subjecting the system to rigorous testing.Recent testing of the system has highlighted some usability issues that we want to resolve before we embark on testing the ContactPoint system with users. In order to address these issues thoroughly, I decided not to start Early Adopter deployment in October 2008 as planned. It is both prudent and sensible to take a little more time to ensure the system is ready before we deploy it to local authorities and national partners.We expect to meet the cost of full implementation from the existing budget, which remains unchanged at £224 million, since it was announced by my right hon. Friend the Member for Stretford and Urmston (Beverley Hughes) in December 2005.
Subjects
Children; Databases
Date
6 October 2008
Reference
223744; 480 c474W
House
House of Commons
There is, however, a real and growing concern about IT database overload in the Department. It has three major databases of its own—ContactPoint, Connexions and the national children's database—and nine other children's databases feed into ContactPoint. May I take it from the Minister's response that there is a disagreement between the Secretary of State and the Secretary of State for Communities and Local Government as a result of the recent ““Lifting the Burdens”” report, which stated that the obsession with multiple databases has diverted attention from the most important task that the Department should have, which is delivering real support for families, or has the Secretary of State for Communities and Local Government got it wrong?
There is, however, a real and growing concern about IT database overload in the Department. It has three major databases of its own—ContactPoint, Connexions and the national children's database—and nine other children's databases feed into ContactPoint. May I take it from the Minister's response that there is a disagreement between the Secretary of State and the Secretary of State for Communities and Local Government as a result of the recent ““Lifting the Burdens”” report, which stated that the obsession with multiple databases has diverted attention from the most important task that the Department should have, which is delivering real support for families, or has the Secretary of State for Communities and Local Government got it wrong?
Asked by
Maria Miller
(Conservative)
Answering body
Department for Children, Schools and Families
Oral questions - Supplementary
Status
Answered
Answered on
17 March 2008
As usual, that is a rhetorical rather than a substantive question from the hon. Lady. The point about ContactPoint and the other databases is that they exist to promote the welfare of children and young people in this country. I remind the House that ContactPoint was developed as a result of the Lord Laming inquiry into the Victoria Climbié case. I make no apologies whatever to the House for our continuing to develop that important project, which will enable professionals working with children to identify the other professionals working with them. That is a basic requirement of safeguarding children, and I hope that all parties in the House will support it.
Subjects
Databases; ICT; Finance; Department for Children, Schools and Families
Date
17 March 2008
Reference
473 c604-5
Chamber / Committee
House of Commons chamber
House
House of Commons
(3) on what date the decision was made not to publish a summary of Deloitte’s review of the security of ContactPoint;
(3) on what date the decision was made not to publish a summary of Deloitte’s review of the security of ContactPoint;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190734, the risk assessment, recommended by Deloitte, which will look in detail at the contractor’s design, will be completed by May 2008. The report will not be made public, as it will contain details of specific security arrangements. However, the ContactPoint security statement, which is publicly available, will be updated to reflect any changes made to security arrangements.In response to question 190735, our plans for future risk assessment are based on key project milestones. These are:"at the end of detailed technical design;""before the system goes live;""at the end of the ‘Early Adopter’phase; and""when there is any significant change in the external threat level or any significant project change."These plans will be kept under review. Decisions about making the reports public will be taken on a case-by-case basis.In response to question 190736, the decision to publish only the executive summary of the Deloitte report was taken on 13 February 2008.In response to question 190737, the executive summary includes all the recommendations. The Government have accepted them all.In response to question 190738, ContactPoint is expected to be deployed to ‘Early Adopter’ local authorities and two of our seven national partners by the end of October 2008 and to all other local authorities and national partners in 2009.In response to question 190739, an interim assessment has been conducted which indicates that the recommendations can be implemented within the current planned budget and timescale. The full assessment can only be made once the updated risk assessment is completed.In response to question 190740, ContactPoint will continue to be reviewed by independent security experts during system build and before it is implemented. Security will, of course, be audited during operation. It has not yet been decided who will conduct further independent reviews.In response to question 190750, the Deloitte review did not identify any significant security issues, but made a number of minister recommendations for controls to be in place when the system goes live in addition to those already planned. The report observed that the importance of security appears to be ingrained within key areas of the ContactPoint Project. The first task, which is already under way, is to undertake an impact assessment of the detailed recommendations contained in the report.
Subjects
Children; Databases
Date
5 March 2008
Reference
472 c2635-6W; 190736
House
House of Commons
(2) how frequently ongoing security risk assessments of ContactPoint, as recommended by Deloitte, will be conducted; and whether each report will be made public in full;
(2) how frequently ongoing security risk assessments of ContactPoint, as recommended by Deloitte, will be conducted; and whether each report will be made public in full;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190734, the risk assessment, recommended by Deloitte, which will look in detail at the contractor’s design, will be completed by May 2008. The report will not be made public, as it will contain details of specific security arrangements. However, the ContactPoint security statement, which is publicly available, will be updated to reflect any changes made to security arrangements.In response to question 190735, our plans for future risk assessment are based on key project milestones. These are:"at the end of detailed technical design;""before the system goes live;""at the end of the ‘Early Adopter’phase; and""when there is any significant change in the external threat level or any significant project change."These plans will be kept under review. Decisions about making the reports public will be taken on a case-by-case basis.In response to question 190736, the decision to publish only the executive summary of the Deloitte report was taken on 13 February 2008.In response to question 190737, the executive summary includes all the recommendations. The Government have accepted them all.In response to question 190738, ContactPoint is expected to be deployed to ‘Early Adopter’ local authorities and two of our seven national partners by the end of October 2008 and to all other local authorities and national partners in 2009.In response to question 190739, an interim assessment has been conducted which indicates that the recommendations can be implemented within the current planned budget and timescale. The full assessment can only be made once the updated risk assessment is completed.In response to question 190740, ContactPoint will continue to be reviewed by independent security experts during system build and before it is implemented. Security will, of course, be audited during operation. It has not yet been decided who will conduct further independent reviews.In response to question 190750, the Deloitte review did not identify any significant security issues, but made a number of minister recommendations for controls to be in place when the system goes live in addition to those already planned. The report observed that the importance of security appears to be ingrained within key areas of the ContactPoint Project. The first task, which is already under way, is to undertake an impact assessment of the detailed recommendations contained in the report.
Subjects
Children; Databases
Date
5 March 2008
Reference
472 c2635-6W; 190735
House
House of Commons
To ask the Secretary of State for Children, Schools and Families (1) when the first additional risk assessment recommended by Deloitte in its security review of ContactPoint will be completed; and whether the full report will be made public;
To ask the Secretary of State for Children, Schools and Families (1) when the first additional risk assessment recommended by Deloitte in its security review of ContactPoint will be completed; and whether the full report will be made public;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190734, the risk assessment, recommended by Deloitte, which will look in detail at the contractor’s design, will be completed by May 2008. The report will not be made public, as it will contain details of specific security arrangements. However, the ContactPoint security statement, which is publicly available, will be updated to reflect any changes made to security arrangements.In response to question 190735, our plans for future risk assessment are based on key project milestones. These are:"at the end of detailed technical design;""before the system goes live;""at the end of the ‘Early Adopter’phase; and""when there is any significant change in the external threat level or any significant project change."These plans will be kept under review. Decisions about making the reports public will be taken on a case-by-case basis.In response to question 190736, the decision to publish only the executive summary of the Deloitte report was taken on 13 February 2008.In response to question 190737, the executive summary includes all the recommendations. The Government have accepted them all.In response to question 190738, ContactPoint is expected to be deployed to ‘Early Adopter’ local authorities and two of our seven national partners by the end of October 2008 and to all other local authorities and national partners in 2009.In response to question 190739, an interim assessment has been conducted which indicates that the recommendations can be implemented within the current planned budget and timescale. The full assessment can only be made once the updated risk assessment is completed.In response to question 190740, ContactPoint will continue to be reviewed by independent security experts during system build and before it is implemented. Security will, of course, be audited during operation. It has not yet been decided who will conduct further independent reviews.In response to question 190750, the Deloitte review did not identify any significant security issues, but made a number of minister recommendations for controls to be in place when the system goes live in addition to those already planned. The report observed that the importance of security appears to be ingrained within key areas of the ContactPoint Project. The first task, which is already under way, is to undertake an impact assessment of the detailed recommendations contained in the report.
Subjects
Children; Databases
Date
5 March 2008
Reference
190734; 472 c2635-6W
House
House of Commons
(8) what plans he has to monitor compliance with self-certification procedures among organisations connecting to ContactPoint; and how this will be funded;
(8) what plans he has to monitor compliance with self-certification procedures among organisations connecting to ContactPoint; and how this will be funded;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190741, ContactPoint User Acceptance Testing is scheduled to take place between July and September 2008.We plan to engage a representative set of future ContactPoint users to:"Verify that CP meets the stated business requirements, and its practical readiness,""Ensure the end to end system and processes meet the defined acceptance criteria."User Acceptance Testing will form an important part of assessing ContactPoint is in readiness for deployment.In response to question 190742, all data inputs to ContactPoint will be delivered over secure electronic channels. The frequency of updates of this data will vary depending on what is practicable and desirable for each source.In response to question 190743, (a) All partner organisations will be supported through their accreditation process by the local authority acting as an independent sponsor. Those performing the sponsor roles will be trained and appropriately qualified, (b) Ongoing monitoring will be performed at multiple levels across the ContactPoint delivery structure.The following will be in place:"monitoring of user access by line management;""compliance checks—that line management is monitoring user access by each organisation's internal audit or compliance team;""monitoring—that line management are monitoring their users by the local ContactPoint management team;""compliance checks— that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""monitoring - that line management are monitoring their users by the local ContactPoint management team;""compliance checks - that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""local authorities will log and monitor complaints and data subject access requests, identifying where follow up checking needs to take place;""discussions will be held between local authority internal audit and the internal audit of those organisations using ContactPoint to ensure congruence of risk assessments and sharing of lessons learned;""regular reviews of local authority ContactPoint team activities;""spot checks by organisation, local authority and nationally;""national reviews of management information based on a range of security""parameters;"Any areas of concern flagged by monitoring will be linked to mandatory follow-up procedures, including internal disciplinary action which could lead to dismissal and/or criminal prosecution.All monitoring is linked to a process of continual improvement, with the objective of strengthening the effectiveness of monitoring, detection and follow-up activity.In response to question 190745, accreditation will ensure a range of organisational policies and procedures are in place in each accredited organisation. These include a requirement to appoint responsible and accountable officers, to train staff, to set out accountabilities, to plan and implement a programme of inspections and audits, and to report issues to the sponsoring local authority.Auditing is a multi-level series of cross checks, executing monitoring activities, and checking that monitoring is taking place.Responsibilities will be set out clearly and will be covered in training and supporting materials (such as guidance and user manuals). Regular meetings will be used (between local authorities and partner organisations, and between the national team and local authorities) to ensure messages on responsibilities continue to be understood, to promote best practice, to raise and resolve issues around compliance, and to discuss other operational issues or difficulties.In response to questions 190746 and 190747, in determining the security policy for ContactPoint, the Government guidance on risk assessment and security controls set out in the Cabinet Office's Manual of Protective Security was followed. A risk assessment was carried out, in 2005, at the start of the ContactPoint project before any solution design or requirements were specified. It was updated in June 2006. Deloitte concluded that the approach followed was valid.ContactPoint has been designed to be highly secure and has controls at different levels to protect against security breaches. This will be kept under continuous review.Security is, and always has been, of paramount importance to the ContactPoint project and this was recognised in the Deloitte report.ContactPoint will not be deployed until it has been subject to rigorous penetration testing by people who are experts in the IT security field and approved by the Communications and Electronics Security Group.The Department's aim is to ensure that any potential risks from ContactPoint will be less than the risks from not having it.In response to questions 190748 and 190749, the accreditation plans were under development at time of the Deloitte review and indicated that self-certification would be used where appropriate in order to minimise burdens.Self-certification will be reviewed as part of the risk assessment scheduled to be completed by May 2008. Unacceptable risks to security will not be introduced by the use of self-certification.Self-certification of local partner organisations will be subject to verification by a local authority sponsor who will assure compliance with procedures. Funds have been allocated to local authorities to support these roles.In response to question 190751, there will be no access to the CAP itself, nor any of the details within it, from ContactPoint. If the ContactPoint user believes that they should contribute to, or see, the CAP assessment they would contact the practitioner whose details have been provided to ContactPoint as the person ‘holding’ the CAF.Practitioners will only become involved in CAP assessment with the informed, explicit consent of the child or young person (or their parent/carer where appropriate).
Subjects
Children; Databases
Date
5 March 2008
Reference
190749; 472 c2636-8W
House
House of Commons
(8) what plans there are to upgrade the security of ContactPoint following Deloitte’s security review.
(8) what plans there are to upgrade the security of ContactPoint following Deloitte’s security review.
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190734, the risk assessment, recommended by Deloitte, which will look in detail at the contractor’s design, will be completed by May 2008. The report will not be made public, as it will contain details of specific security arrangements. However, the ContactPoint security statement, which is publicly available, will be updated to reflect any changes made to security arrangements.In response to question 190735, our plans for future risk assessment are based on key project milestones. These are:"at the end of detailed technical design;""before the system goes live;""at the end of the ‘Early Adopter’phase; and""when there is any significant change in the external threat level or any significant project change."These plans will be kept under review. Decisions about making the reports public will be taken on a case-by-case basis.In response to question 190736, the decision to publish only the executive summary of the Deloitte report was taken on 13 February 2008.In response to question 190737, the executive summary includes all the recommendations. The Government have accepted them all.In response to question 190738, ContactPoint is expected to be deployed to ‘Early Adopter’ local authorities and two of our seven national partners by the end of October 2008 and to all other local authorities and national partners in 2009.In response to question 190739, an interim assessment has been conducted which indicates that the recommendations can be implemented within the current planned budget and timescale. The full assessment can only be made once the updated risk assessment is completed.In response to question 190740, ContactPoint will continue to be reviewed by independent security experts during system build and before it is implemented. Security will, of course, be audited during operation. It has not yet been decided who will conduct further independent reviews.In response to question 190750, the Deloitte review did not identify any significant security issues, but made a number of minister recommendations for controls to be in place when the system goes live in addition to those already planned. The report observed that the importance of security appears to be ingrained within key areas of the ContactPoint Project. The first task, which is already under way, is to undertake an impact assessment of the detailed recommendations contained in the report.
Subjects
Children; Databases
Date
5 March 2008
Reference
190750; 472 c2635-6W
House
House of Commons
(9) what (a) security, (b) auditing and (c) other procedures will be followed when a ContactPoint user wants to gain access to a common assessment framework assessment for a particular child.
(9) what (a) security, (b) auditing and (c) other procedures will be followed when a ContactPoint user wants to gain access to a common assessment framework assessment for a particular child.
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190741, ContactPoint User Acceptance Testing is scheduled to take place between July and September 2008.We plan to engage a representative set of future ContactPoint users to:"Verify that CP meets the stated business requirements, and its practical readiness,""Ensure the end to end system and processes meet the defined acceptance criteria."User Acceptance Testing will form an important part of assessing ContactPoint is in readiness for deployment.In response to question 190742, all data inputs to ContactPoint will be delivered over secure electronic channels. The frequency of updates of this data will vary depending on what is practicable and desirable for each source.In response to question 190743, (a) All partner organisations will be supported through their accreditation process by the local authority acting as an independent sponsor. Those performing the sponsor roles will be trained and appropriately qualified, (b) Ongoing monitoring will be performed at multiple levels across the ContactPoint delivery structure.The following will be in place:"monitoring of user access by line management;""compliance checks—that line management is monitoring user access by each organisation's internal audit or compliance team;""monitoring—that line management are monitoring their users by the local ContactPoint management team;""compliance checks— that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""monitoring - that line management are monitoring their users by the local ContactPoint management team;""compliance checks - that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""local authorities will log and monitor complaints and data subject access requests, identifying where follow up checking needs to take place;""discussions will be held between local authority internal audit and the internal audit of those organisations using ContactPoint to ensure congruence of risk assessments and sharing of lessons learned;""regular reviews of local authority ContactPoint team activities;""spot checks by organisation, local authority and nationally;""national reviews of management information based on a range of security""parameters;"Any areas of concern flagged by monitoring will be linked to mandatory follow-up procedures, including internal disciplinary action which could lead to dismissal and/or criminal prosecution.All monitoring is linked to a process of continual improvement, with the objective of strengthening the effectiveness of monitoring, detection and follow-up activity.In response to question 190745, accreditation will ensure a range of organisational policies and procedures are in place in each accredited organisation. These include a requirement to appoint responsible and accountable officers, to train staff, to set out accountabilities, to plan and implement a programme of inspections and audits, and to report issues to the sponsoring local authority.Auditing is a multi-level series of cross checks, executing monitoring activities, and checking that monitoring is taking place.Responsibilities will be set out clearly and will be covered in training and supporting materials (such as guidance and user manuals). Regular meetings will be used (between local authorities and partner organisations, and between the national team and local authorities) to ensure messages on responsibilities continue to be understood, to promote best practice, to raise and resolve issues around compliance, and to discuss other operational issues or difficulties.In response to questions 190746 and 190747, in determining the security policy for ContactPoint, the Government guidance on risk assessment and security controls set out in the Cabinet Office's Manual of Protective Security was followed. A risk assessment was carried out, in 2005, at the start of the ContactPoint project before any solution design or requirements were specified. It was updated in June 2006. Deloitte concluded that the approach followed was valid.ContactPoint has been designed to be highly secure and has controls at different levels to protect against security breaches. This will be kept under continuous review.Security is, and always has been, of paramount importance to the ContactPoint project and this was recognised in the Deloitte report.ContactPoint will not be deployed until it has been subject to rigorous penetration testing by people who are experts in the IT security field and approved by the Communications and Electronics Security Group.The Department's aim is to ensure that any potential risks from ContactPoint will be less than the risks from not having it.In response to questions 190748 and 190749, the accreditation plans were under development at time of the Deloitte review and indicated that self-certification would be used where appropriate in order to minimise burdens.Self-certification will be reviewed as part of the risk assessment scheduled to be completed by May 2008. Unacceptable risks to security will not be introduced by the use of self-certification.Self-certification of local partner organisations will be subject to verification by a local authority sponsor who will assure compliance with procedures. Funds have been allocated to local authorities to support these roles.In response to question 190751, there will be no access to the CAP itself, nor any of the details within it, from ContactPoint. If the ContactPoint user believes that they should contribute to, or see, the CAP assessment they would contact the practitioner whose details have been provided to ContactPoint as the person ‘holding’ the CAF.Practitioners will only become involved in CAP assessment with the informed, explicit consent of the child or young person (or their parent/carer where appropriate).
Subjects
Children; Databases
Date
5 March 2008
Reference
190751; 472 c2636-8W
House
House of Commons
(6) what level of security risk his Department has determined as acceptable for ContactPoint;
(6) what level of security risk his Department has determined as acceptable for ContactPoint;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190741, ContactPoint User Acceptance Testing is scheduled to take place between July and September 2008.We plan to engage a representative set of future ContactPoint users to:"Verify that CP meets the stated business requirements, and its practical readiness,""Ensure the end to end system and processes meet the defined acceptance criteria."User Acceptance Testing will form an important part of assessing ContactPoint is in readiness for deployment.In response to question 190742, all data inputs to ContactPoint will be delivered over secure electronic channels. The frequency of updates of this data will vary depending on what is practicable and desirable for each source.In response to question 190743, (a) All partner organisations will be supported through their accreditation process by the local authority acting as an independent sponsor. Those performing the sponsor roles will be trained and appropriately qualified, (b) Ongoing monitoring will be performed at multiple levels across the ContactPoint delivery structure.The following will be in place:"monitoring of user access by line management;""compliance checks—that line management is monitoring user access by each organisation's internal audit or compliance team;""monitoring—that line management are monitoring their users by the local ContactPoint management team;""compliance checks— that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""monitoring - that line management are monitoring their users by the local ContactPoint management team;""compliance checks - that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""local authorities will log and monitor complaints and data subject access requests, identifying where follow up checking needs to take place;""discussions will be held between local authority internal audit and the internal audit of those organisations using ContactPoint to ensure congruence of risk assessments and sharing of lessons learned;""regular reviews of local authority ContactPoint team activities;""spot checks by organisation, local authority and nationally;""national reviews of management information based on a range of security""parameters;"Any areas of concern flagged by monitoring will be linked to mandatory follow-up procedures, including internal disciplinary action which could lead to dismissal and/or criminal prosecution.All monitoring is linked to a process of continual improvement, with the objective of strengthening the effectiveness of monitoring, detection and follow-up activity.In response to question 190745, accreditation will ensure a range of organisational policies and procedures are in place in each accredited organisation. These include a requirement to appoint responsible and accountable officers, to train staff, to set out accountabilities, to plan and implement a programme of inspections and audits, and to report issues to the sponsoring local authority.Auditing is a multi-level series of cross checks, executing monitoring activities, and checking that monitoring is taking place.Responsibilities will be set out clearly and will be covered in training and supporting materials (such as guidance and user manuals). Regular meetings will be used (between local authorities and partner organisations, and between the national team and local authorities) to ensure messages on responsibilities continue to be understood, to promote best practice, to raise and resolve issues around compliance, and to discuss other operational issues or difficulties.In response to questions 190746 and 190747, in determining the security policy for ContactPoint, the Government guidance on risk assessment and security controls set out in the Cabinet Office's Manual of Protective Security was followed. A risk assessment was carried out, in 2005, at the start of the ContactPoint project before any solution design or requirements were specified. It was updated in June 2006. Deloitte concluded that the approach followed was valid.ContactPoint has been designed to be highly secure and has controls at different levels to protect against security breaches. This will be kept under continuous review.Security is, and always has been, of paramount importance to the ContactPoint project and this was recognised in the Deloitte report.ContactPoint will not be deployed until it has been subject to rigorous penetration testing by people who are experts in the IT security field and approved by the Communications and Electronics Security Group.The Department's aim is to ensure that any potential risks from ContactPoint will be less than the risks from not having it.In response to questions 190748 and 190749, the accreditation plans were under development at time of the Deloitte review and indicated that self-certification would be used where appropriate in order to minimise burdens.Self-certification will be reviewed as part of the risk assessment scheduled to be completed by May 2008. Unacceptable risks to security will not be introduced by the use of self-certification.Self-certification of local partner organisations will be subject to verification by a local authority sponsor who will assure compliance with procedures. Funds have been allocated to local authorities to support these roles.In response to question 190751, there will be no access to the CAP itself, nor any of the details within it, from ContactPoint. If the ContactPoint user believes that they should contribute to, or see, the CAP assessment they would contact the practitioner whose details have been provided to ContactPoint as the person ‘holding’ the CAF.Practitioners will only become involved in CAP assessment with the informed, explicit consent of the child or young person (or their parent/carer where appropriate).
Subjects
Children; Databases
Date
5 March 2008
Reference
190747; 472 c2636-8W
House
House of Commons
(7) what plans there are to review the role of self-certification as referred to in the written statement of 21 February 2008, Official Report, columns 55-58WS, on ContactPoint; and if he will make a statement;
(7) what plans there are to review the role of self-certification as referred to in the written statement of 21 February 2008, Official Report, columns 55-58WS, on ContactPoint; and if he will make a statement;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190741, ContactPoint User Acceptance Testing is scheduled to take place between July and September 2008.We plan to engage a representative set of future ContactPoint users to:"Verify that CP meets the stated business requirements, and its practical readiness,""Ensure the end to end system and processes meet the defined acceptance criteria."User Acceptance Testing will form an important part of assessing ContactPoint is in readiness for deployment.In response to question 190742, all data inputs to ContactPoint will be delivered over secure electronic channels. The frequency of updates of this data will vary depending on what is practicable and desirable for each source.In response to question 190743, (a) All partner organisations will be supported through their accreditation process by the local authority acting as an independent sponsor. Those performing the sponsor roles will be trained and appropriately qualified, (b) Ongoing monitoring will be performed at multiple levels across the ContactPoint delivery structure.The following will be in place:"monitoring of user access by line management;""compliance checks—that line management is monitoring user access by each organisation's internal audit or compliance team;""monitoring—that line management are monitoring their users by the local ContactPoint management team;""compliance checks— that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""monitoring - that line management are monitoring their users by the local ContactPoint management team;""compliance checks - that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""local authorities will log and monitor complaints and data subject access requests, identifying where follow up checking needs to take place;""discussions will be held between local authority internal audit and the internal audit of those organisations using ContactPoint to ensure congruence of risk assessments and sharing of lessons learned;""regular reviews of local authority ContactPoint team activities;""spot checks by organisation, local authority and nationally;""national reviews of management information based on a range of security""parameters;"Any areas of concern flagged by monitoring will be linked to mandatory follow-up procedures, including internal disciplinary action which could lead to dismissal and/or criminal prosecution.All monitoring is linked to a process of continual improvement, with the objective of strengthening the effectiveness of monitoring, detection and follow-up activity.In response to question 190745, accreditation will ensure a range of organisational policies and procedures are in place in each accredited organisation. These include a requirement to appoint responsible and accountable officers, to train staff, to set out accountabilities, to plan and implement a programme of inspections and audits, and to report issues to the sponsoring local authority.Auditing is a multi-level series of cross checks, executing monitoring activities, and checking that monitoring is taking place.Responsibilities will be set out clearly and will be covered in training and supporting materials (such as guidance and user manuals). Regular meetings will be used (between local authorities and partner organisations, and between the national team and local authorities) to ensure messages on responsibilities continue to be understood, to promote best practice, to raise and resolve issues around compliance, and to discuss other operational issues or difficulties.In response to questions 190746 and 190747, in determining the security policy for ContactPoint, the Government guidance on risk assessment and security controls set out in the Cabinet Office's Manual of Protective Security was followed. A risk assessment was carried out, in 2005, at the start of the ContactPoint project before any solution design or requirements were specified. It was updated in June 2006. Deloitte concluded that the approach followed was valid.ContactPoint has been designed to be highly secure and has controls at different levels to protect against security breaches. This will be kept under continuous review.Security is, and always has been, of paramount importance to the ContactPoint project and this was recognised in the Deloitte report.ContactPoint will not be deployed until it has been subject to rigorous penetration testing by people who are experts in the IT security field and approved by the Communications and Electronics Security Group.The Department's aim is to ensure that any potential risks from ContactPoint will be less than the risks from not having it.In response to questions 190748 and 190749, the accreditation plans were under development at time of the Deloitte review and indicated that self-certification would be used where appropriate in order to minimise burdens.Self-certification will be reviewed as part of the risk assessment scheduled to be completed by May 2008. Unacceptable risks to security will not be introduced by the use of self-certification.Self-certification of local partner organisations will be subject to verification by a local authority sponsor who will assure compliance with procedures. Funds have been allocated to local authorities to support these roles.In response to question 190751, there will be no access to the CAP itself, nor any of the details within it, from ContactPoint. If the ContactPoint user believes that they should contribute to, or see, the CAP assessment they would contact the practitioner whose details have been provided to ContactPoint as the person ‘holding’ the CAF.Practitioners will only become involved in CAP assessment with the informed, explicit consent of the child or young person (or their parent/carer where appropriate).
Subjects
Children; Databases
Date
5 March 2008
Reference
190748; 472 c2636-8W
House
House of Commons
(5) what work has been undertaken to establish the level of risk of security breaches occurring in the ContactPoint database; and if he will make a statement;
(5) what work has been undertaken to establish the level of risk of security breaches occurring in the ContactPoint database; and if he will make a statement;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190741, ContactPoint User Acceptance Testing is scheduled to take place between July and September 2008.We plan to engage a representative set of future ContactPoint users to:"Verify that CP meets the stated business requirements, and its practical readiness,""Ensure the end to end system and processes meet the defined acceptance criteria."User Acceptance Testing will form an important part of assessing ContactPoint is in readiness for deployment.In response to question 190742, all data inputs to ContactPoint will be delivered over secure electronic channels. The frequency of updates of this data will vary depending on what is practicable and desirable for each source.In response to question 190743, (a) All partner organisations will be supported through their accreditation process by the local authority acting as an independent sponsor. Those performing the sponsor roles will be trained and appropriately qualified, (b) Ongoing monitoring will be performed at multiple levels across the ContactPoint delivery structure.The following will be in place:"monitoring of user access by line management;""compliance checks—that line management is monitoring user access by each organisation's internal audit or compliance team;""monitoring—that line management are monitoring their users by the local ContactPoint management team;""compliance checks— that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""monitoring - that line management are monitoring their users by the local ContactPoint management team;""compliance checks - that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""local authorities will log and monitor complaints and data subject access requests, identifying where follow up checking needs to take place;""discussions will be held between local authority internal audit and the internal audit of those organisations using ContactPoint to ensure congruence of risk assessments and sharing of lessons learned;""regular reviews of local authority ContactPoint team activities;""spot checks by organisation, local authority and nationally;""national reviews of management information based on a range of security""parameters;"Any areas of concern flagged by monitoring will be linked to mandatory follow-up procedures, including internal disciplinary action which could lead to dismissal and/or criminal prosecution.All monitoring is linked to a process of continual improvement, with the objective of strengthening the effectiveness of monitoring, detection and follow-up activity.In response to question 190745, accreditation will ensure a range of organisational policies and procedures are in place in each accredited organisation. These include a requirement to appoint responsible and accountable officers, to train staff, to set out accountabilities, to plan and implement a programme of inspections and audits, and to report issues to the sponsoring local authority.Auditing is a multi-level series of cross checks, executing monitoring activities, and checking that monitoring is taking place.Responsibilities will be set out clearly and will be covered in training and supporting materials (such as guidance and user manuals). Regular meetings will be used (between local authorities and partner organisations, and between the national team and local authorities) to ensure messages on responsibilities continue to be understood, to promote best practice, to raise and resolve issues around compliance, and to discuss other operational issues or difficulties.In response to questions 190746 and 190747, in determining the security policy for ContactPoint, the Government guidance on risk assessment and security controls set out in the Cabinet Office's Manual of Protective Security was followed. A risk assessment was carried out, in 2005, at the start of the ContactPoint project before any solution design or requirements were specified. It was updated in June 2006. Deloitte concluded that the approach followed was valid.ContactPoint has been designed to be highly secure and has controls at different levels to protect against security breaches. This will be kept under continuous review.Security is, and always has been, of paramount importance to the ContactPoint project and this was recognised in the Deloitte report.ContactPoint will not be deployed until it has been subject to rigorous penetration testing by people who are experts in the IT security field and approved by the Communications and Electronics Security Group.The Department's aim is to ensure that any potential risks from ContactPoint will be less than the risks from not having it.In response to questions 190748 and 190749, the accreditation plans were under development at time of the Deloitte review and indicated that self-certification would be used where appropriate in order to minimise burdens.Self-certification will be reviewed as part of the risk assessment scheduled to be completed by May 2008. Unacceptable risks to security will not be introduced by the use of self-certification.Self-certification of local partner organisations will be subject to verification by a local authority sponsor who will assure compliance with procedures. Funds have been allocated to local authorities to support these roles.In response to question 190751, there will be no access to the CAP itself, nor any of the details within it, from ContactPoint. If the ContactPoint user believes that they should contribute to, or see, the CAP assessment they would contact the practitioner whose details have been provided to ContactPoint as the person ‘holding’ the CAF.Practitioners will only become involved in CAP assessment with the informed, explicit consent of the child or young person (or their parent/carer where appropriate).
Subjects
Children; Databases
Date
5 March 2008
Reference
190746; 472 c2636-8W
House
House of Commons
(7) whether (a) Deloitte and (b) another organisation will be commissioned to undertake a further security review of ContactPoint;
(7) whether (a) Deloitte and (b) another organisation will be commissioned to undertake a further security review of ContactPoint;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190734, the risk assessment, recommended by Deloitte, which will look in detail at the contractor’s design, will be completed by May 2008. The report will not be made public, as it will contain details of specific security arrangements. However, the ContactPoint security statement, which is publicly available, will be updated to reflect any changes made to security arrangements.In response to question 190735, our plans for future risk assessment are based on key project milestones. These are:"at the end of detailed technical design;""before the system goes live;""at the end of the ‘Early Adopter’phase; and""when there is any significant change in the external threat level or any significant project change."These plans will be kept under review. Decisions about making the reports public will be taken on a case-by-case basis.In response to question 190736, the decision to publish only the executive summary of the Deloitte report was taken on 13 February 2008.In response to question 190737, the executive summary includes all the recommendations. The Government have accepted them all.In response to question 190738, ContactPoint is expected to be deployed to ‘Early Adopter’ local authorities and two of our seven national partners by the end of October 2008 and to all other local authorities and national partners in 2009.In response to question 190739, an interim assessment has been conducted which indicates that the recommendations can be implemented within the current planned budget and timescale. The full assessment can only be made once the updated risk assessment is completed.In response to question 190740, ContactPoint will continue to be reviewed by independent security experts during system build and before it is implemented. Security will, of course, be audited during operation. It has not yet been decided who will conduct further independent reviews.In response to question 190750, the Deloitte review did not identify any significant security issues, but made a number of minister recommendations for controls to be in place when the system goes live in addition to those already planned. The report observed that the importance of security appears to be ingrained within key areas of the ContactPoint Project. The first task, which is already under way, is to undertake an impact assessment of the detailed recommendations contained in the report.
Subjects
Children; Databases
Date
5 March 2008
Reference
190740; 472 c2635-6W
House
House of Commons
To ask the Secretary of State for Children, Schools and Families (1) when the ContactPoint user acceptance test referred to in the written statement of 21 February 2008, Official Report, columns 55-8WS, on ContactPoint, will be undertaken; and what use will be made of the results;
To ask the Secretary of State for Children, Schools and Families (1) when the ContactPoint user acceptance test referred to in the written statement of 21 February 2008, Official Report, columns 55-8WS, on ContactPoint, will be undertaken; and what use will be made of the results;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190741, ContactPoint User Acceptance Testing is scheduled to take place between July and September 2008.We plan to engage a representative set of future ContactPoint users to:"Verify that CP meets the stated business requirements, and its practical readiness,""Ensure the end to end system and processes meet the defined acceptance criteria."User Acceptance Testing will form an important part of assessing ContactPoint is in readiness for deployment.In response to question 190742, all data inputs to ContactPoint will be delivered over secure electronic channels. The frequency of updates of this data will vary depending on what is practicable and desirable for each source.In response to question 190743, (a) All partner organisations will be supported through their accreditation process by the local authority acting as an independent sponsor. Those performing the sponsor roles will be trained and appropriately qualified, (b) Ongoing monitoring will be performed at multiple levels across the ContactPoint delivery structure.The following will be in place:"monitoring of user access by line management;""compliance checks—that line management is monitoring user access by each organisation's internal audit or compliance team;""monitoring—that line management are monitoring their users by the local ContactPoint management team;""compliance checks— that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""monitoring - that line management are monitoring their users by the local ContactPoint management team;""compliance checks - that the local authority ContactPoint team is performing its monitoring role by each local authority's internal audit or compliance team;""local authorities will log and monitor complaints and data subject access requests, identifying where follow up checking needs to take place;""discussions will be held between local authority internal audit and the internal audit of those organisations using ContactPoint to ensure congruence of risk assessments and sharing of lessons learned;""regular reviews of local authority ContactPoint team activities;""spot checks by organisation, local authority and nationally;""national reviews of management information based on a range of security""parameters;"Any areas of concern flagged by monitoring will be linked to mandatory follow-up procedures, including internal disciplinary action which could lead to dismissal and/or criminal prosecution.All monitoring is linked to a process of continual improvement, with the objective of strengthening the effectiveness of monitoring, detection and follow-up activity.In response to question 190745, accreditation will ensure a range of organisational policies and procedures are in place in each accredited organisation. These include a requirement to appoint responsible and accountable officers, to train staff, to set out accountabilities, to plan and implement a programme of inspections and audits, and to report issues to the sponsoring local authority.Auditing is a multi-level series of cross checks, executing monitoring activities, and checking that monitoring is taking place.Responsibilities will be set out clearly and will be covered in training and supporting materials (such as guidance and user manuals). Regular meetings will be used (between local authorities and partner organisations, and between the national team and local authorities) to ensure messages on responsibilities continue to be understood, to promote best practice, to raise and resolve issues around compliance, and to discuss other operational issues or difficulties.In response to questions 190746 and 190747, in determining the security policy for ContactPoint, the Government guidance on risk assessment and security controls set out in the Cabinet Office's Manual of Protective Security was followed. A risk assessment was carried out, in 2005, at the start of the ContactPoint project before any solution design or requirements were specified. It was updated in June 2006. Deloitte concluded that the approach followed was valid.ContactPoint has been designed to be highly secure and has controls at different levels to protect against security breaches. This will be kept under continuous review.Security is, and always has been, of paramount importance to the ContactPoint project and this was recognised in the Deloitte report.ContactPoint will not be deployed until it has been subject to rigorous penetration testing by people who are experts in the IT security field and approved by the Communications and Electronics Security Group.The Department's aim is to ensure that any potential risks from ContactPoint will be less than the risks from not having it.In response to questions 190748 and 190749, the accreditation plans were under development at time of the Deloitte review and indicated that self-certification would be used where appropriate in order to minimise burdens.Self-certification will be reviewed as part of the risk assessment scheduled to be completed by May 2008. Unacceptable risks to security will not be introduced by the use of self-certification.Self-certification of local partner organisations will be subject to verification by a local authority sponsor who will assure compliance with procedures. Funds have been allocated to local authorities to support these roles.In response to question 190751, there will be no access to the CAP itself, nor any of the details within it, from ContactPoint. If the ContactPoint user believes that they should contribute to, or see, the CAP assessment they would contact the practitioner whose details have been provided to ContactPoint as the person ‘holding’ the CAF.Practitioners will only become involved in CAP assessment with the informed, explicit consent of the child or young person (or their parent/carer where appropriate).
Subjects
Children; Databases
Date
5 March 2008
Reference
190741; 472 c2636-8W
House
House of Commons
(5) when he expects the ContactPoint database to become fully operational;
(5) when he expects the ContactPoint database to become fully operational;
Asked by
Maria Miller
(Conservative)
Answered by
Lord Brennan of Canton
(Labour)
Answering body
Department for Children, Schools and Families
Type
Written questions
Status
Answered
Tabled on
26 February 2008
For answer on
28 February 2008
Answered on
5 March 2008
In response to question 190734, the risk assessment, recommended by Deloitte, which will look in detail at the contractor’s design, will be completed by May 2008. The report will not be made public, as it will contain details of specific security arrangements. However, the ContactPoint security statement, which is publicly available, will be updated to reflect any changes made to security arrangements.In response to question 190735, our plans for future risk assessment are based on key project milestones. These are:"at the end of detailed technical design;""before the system goes live;""at the end of the ‘Early Adopter’phase; and""when there is any significant change in the external threat level or any significant project change."These plans will be kept under review. Decisions about making the reports public will be taken on a case-by-case basis.In response to question 190736, the decision to publish only the executive summary of the Deloitte report was taken on 13 February 2008.In response to question 190737, the executive summary includes all the recommendations. The Government have accepted them all.In response to question 190738, ContactPoint is expected to be deployed to ‘Early Adopter’ local authorities and two of our seven national partners by the end of October 2008 and to all other local authorities and national partners in 2009.In response to question 190739, an interim assessment has been conducted which indicates that the recommendations can be implemented within the current planned budget and timescale. The full assessment can only be made once the updated risk assessment is completed.In response to question 190740, ContactPoint will continue to be reviewed by independent security experts during system build and before it is implemented. Security will, of course, be audited during operation. It has not yet been decided who will conduct further independent reviews.In response to question 190750, the Deloitte review did not identify any significant security issues, but made a number of minister recommendations for controls to be in place when the system goes live in addition to those already planned. The report observed that the importance of security appears to be ingrained within key areas of the ContactPoint Project. The first task, which is already under way, is to undertake an impact assessment of the detailed recommendations contained in the report.
Subjects
Children; Databases
Date
5 March 2008
Reference
190738; 472 c2635-6W
House
House of Commons