wiltshire by ncc 2004 _ ict strategy

7/25/2019 Wiltshire by NCC 2004 _ ICT Strategy

http://slidepdf.com/reader/full/wiltshire-by-ncc-2004-ict-strategy 1/82

CCoommmmeerrcciiaall IInn CCoonnffiiddeennccee

NNCCCC GGrroouupp

CCoonnssuullttiinngg

RReeppoorrtt TToo

IICCTT SSttrraatteeggyy



IICCTT SSttrraatteegg y y

CONTENTS

SSeeccttiioonn 11 EE x xeeccuuttiivvee SSuummmmaar r yy 44

1.1 Objectives of the review 4

1.2 Disclaimer 5

1.3 Setting the context 5

1.4 Key conclusions 6

1.5 Key recommendations 7

SSeeccttiioonn 22 BBeenncchhmmaar r k k iinngg IICCTT iinn WWiillttsshhiir r ee 88

2.1 Summary 8

2.2 Introduction to the section 8

2.3 ICT spending levels 8

2.4 Benchmarking ICT spending 9

2.5 ICT staffing levels 10

2.6 The basis for apportioning corporate costs 10

2.7 Overall conclusion 11

2.8 Recommendations 11

SSeeccttiioonn 33 IICCTT aanndd bbuussiinneessss aalliiggnnmmeenntt 1122

3.1 Summary 12

3.2 Introduction to the section 12

3.3 Local autonomy versus centralised control 12

3.4 The need for an enterprise architecture 14

3.5 ICT organisational structure 16

3.6 ICT funding and sourcing mechanisms 213.7 Recommendations 24

SSeeccttiioonn 44 IICCTT mmaannaaggeemmeenntt aanndd ggoovveer r nnaannccee 2255

4.1 Summary 25

4 2 t d ti t th ti 2




6.3 Desktop Environment 39

6.4 Common Applications 446.5 Business Applications 46

6.6 e-Government 48

6.7 Security 50

6.8 Telephony and Communications 53

6.9 Costing the Tactical, Short term and Medium term plan 55

SSeeccttiioonn 77 IInnffr r aassttr r uuccttuur r ee RReeccoommmmeennddaattiioonnss 5599

7.1 Recommendations 59

AAppppeennddii x x AA IICCTT SSeer r vviiccee aanndd OOppeer r aattiioonnaall SSuuppppoor r tt 6633

AAppppeennddii x x BB AAccttiioonn PPllaann 7722

AAppppeennddii x x CC TTaaccttiiccaall//SShhoor r tt TTeer r mm aanndd MMeeddiiuumm TTeer r mm PPr r oo j jeecctt PPllaann 7788

AAppppeennddii x x DD GGlloossssaar r yy 7799

AAppppeennddii x x EE EEnntteer r ppr r iissee AAr r cchhiitteeccttuur r ee aanndd MMiiddddlleewwaar r ee 8822




SSeeccttiioonn 11 EExxeeccuuttiivvee SSuummmmaarryy

11..11 OObb j jeeccttiivveess oof f tthhee rreevviieeww

NCC Group was commissioned by Wiltshire County Council to develop an ICTstrategy covering:-

• Technology;•

Management and;• Governance.

The following areas were deemed to be out of scope:-• IT in schools;• Corporate and departmental data;

• Financial management systems.

After detailed discussions with the Council it was agreed that it would benecessary and beneficial to comment on the Council’s current financial system(APTOS), the information management aspects of data and the impact ontechnical infrastructure.

The major deliverable from the assignment is an ICT strategy which outlines thekey issues facing the Council as it strives to deliver its performance andimprovement plan and in particular it’s ‘e’ Government programme, with

appropriate recommendations for action.

Within the ICT strategy the Council is seeking to determine its approach both inthe short/medium term to delivering its strategic ICT objectives as well as a highlevel road map identifying potential key project areas.Both these issues are covered in detail in Appendix B and Appendix C, theAction plan and Tactical/Short and Medium term Project Plan respectively.

The Council has separately commissioned a review of business processes acrossthe Council and is initially looking at support services.The ICT strategy must compliment this separate but interlinked project in order todrive out maximum benefit through the implementation of new systemsunderpinned by new and more efficient processes.The work undertaken by Serco in this regard will be complimented by the ICT




laying the foundations for a quality service for staff and citizens in the longerterm.

In this context the ICT strategy has been developed without the usual focus on‘vision’ which is already well established, or the broader implications ofinformation management strategy, some of which is already being addressedthrough the BPR project and other initiatives, and some of which will flow fromthis strategy.

The impact of this on the strategy is that issues are addressed clearly,conclusions are evidenced and recommendations tend to be directive ratherthan option based.

11..22 DDiissccllaaiimmeerr

This report has in part been developed based on documentation provided byWiltshire County Council, NCC Group does not warrant the accuracy or thecompleteness of this documentation.

References to particular products or services should not be taken as anendorsement of those products or services by NCC Group unless explicitlystated.

11..33 SSeettttiinngg tthhee ccoonnttee x xtt

Wiltshire County Council is a large and complex organization and in commonwith other local authorities in England is striving to deliver a series of strategicprojects as part of its approach to ‘e’ Government.

In 1999/2000 the Council procured a major upgrade of the Councils financialmanagement system from ‘green screen’ to a windows based system, and alsoinvested in a replacement management information system for social services(CareFirst).

The Council also reviewed its infrastructure requirements (in 2002) which led to anumber of key initiatives including the rationalization of data storage, upgradingof desktop operating systems and the acquisition of an enterprise licenceagreement for Microsoft software.

The primary focus at present is around access to and the quality of servicesexperienced by the Council’s citizens.




Plans are also in place to improve the ‘look and feel’ of the Councils currentweb site through a redesign of structure and improved content, a third party

supplier has been commissioned to carry out this work.

Finally the Council has recognized the need for infrastructure investment andseveral projects are in train to improve corporate storage capacity/capabilityand to facilitate and improve access to external partner networks, as well asupgrade key corporate applications.

The Council has a history of different approaches to the provision of ICT servicesand the development of ICT strategy with at least two iterations of the centraland devolved approach having been tried.

The Council has through both an IDeA review and the CPA process recognizedthe need to work in a more joined up fashion and is anxious that this is aconsideration in the development of the ICT strategy.

11..44 K K ee y y ccoonncclluussiioonnssWe benchmarked the Council’s ICT spending and staffing levels against othercounty councils for which we have comparative data (data provided by theAudit Commission). We found that Wiltshire spends £3 million less on ICT than wewould expect, and is understaffed by approximately 27 employees.

We do not think that the Council’s ICT provision and infrastructure is alignedoptimally with its business and service needs:

• Local autonomy combined with a ‘departmental based’ view of ICTinvestments has resulted in the Council having a disparate ICTinfrastructure, with significant areas of duplication of information. Thisprevents the Council from having a common view of its finance, staff andcustomers. To overcome this weakness the Council should adopt an‘enterprise architecture’ where information can be shared, and singleinstances of corporate applications fulfil the Council’s administrativeneeds.

• The organisational structure of ICT management and provision does notmeet the Council’s requirements. We propose that the Council creates asenior second-tier post with overall responsibility for ICT management andgovernance




• The lack of a robust corporate ICT strategy which defines how investments will beappraised, what standards are in place and must be followed, and how benefits

will be realized.

• The absence of a corporate ICT architecture, which sets-out the major buildingblocks around core applications, shared information through consolidatedservers and storage, and appropriate access to information via a robust voiceand data network.

11..55 K K ee y y rreeccoommmmeennddaattiioonnss

The recommendations in this report are detailed in the following sections.To help focus the Council’s thinking we think the most importantrecommendations are:

• Maintain this ICT strategy and adopt a five-year rolling investmentapproach to funding ICT.

• Make provision for an additional ICT investment of around £3million P.A.

• Adopt an enterprise architecture for ICT across the Council (as defined insection 3.4)

• Introduce a new senior post to manage ICT across the Council.

• Review the organizational structure of ICT management and provision to

make it more corporate and customer focused.

• Address the issues and actions highlighted in Appendices A, B and C.




SSeeccttiioonn 22 BBeenncchhmmaarrk k iinngg IICCTT iinn WWiillttsshhiirree

22..11 SSuummmmaarr y y

We benchmarked the Council’s ICT spending and staffing levels against otherCounty Councils for which we have comparative data (data provided by theAudit Commission). We found that Wiltshire spends £3 million less on ICT than wewould expect, and is understaffed by approximately 27 employees.

22..22 IInnttrroodduuccttiioonn ttoo tthhee sseeccttiioonn

This section of the report presents a high-level benchmarking analysis of theCouncil’s ICT spending and staffing levels when compared against other CountyCouncils for which we have comparative data.

22..33 IICCTT ssppeennddiinngg lleevveellss

The Council currently has three main areas of ICT expenditure, these are:-

• The ‘e’ Government programme focusing on TCE and associatedprojects, the value of this budget is approximately £9 million over a fouryear period, commencing 2/3 and completing in 5/6. However within thisfigure there is a positive on-going revenue baseline adjustment of£2million.

• Corporate expenditure consisting of Vivista costs, CICTU and other

corporate costs around corporate licences, firewall expenditure etc. Thevalue of this budget which is fully recharged on PC population basis is£4million.

• ICT expenditure by the three major service directorates is estimated at £3million.

From research carried out it is likely that there is an element of ‘hidden’ spend bydepartments both central and service based, however in the overall quantum it

is not thought to be material, and may centre on the late buying of PCs at yearend.

This is likely to occur through coding of expenditure (to where budgets are underspent)and should be discouraged since apart from budgetary managementissues it distorts the true required level of spend on ICT




22..44 BBeenncchhmmaarrk k iinngg IICCTT ssppeennddiinngg

We have conducted a high-level benchmarking assessment to compareWiltshire’s identified ICT spending and staffing levels against other countycouncils for which we have comparative data. The data we used was obtainedfrom published best value reviews of ICT available on the Audit Commission’swebsite. We appreciate that some of the data is up-to two years old, but wethink that for the purposes of outline comparisons it will still be of sufficientaccuracy.

In terms of ICT spend, Wiltshire had identified a spend of £6.4 million (excludingthe costs of the TCE project), representing 1.77% of net revenue budget. Thiscompares against the average county council spend of 2.11%. If Wiltshire’sspend was equivalent to an average county for which data was available, itwould spend an additional 0.347% of its budget on ICT, equivalent to £1,260,000

million on a £363 million budget. Wiltshire’s comparative spend is shown below.

(The SOCITM* benchmarking report for 2003 similarly has Wiltshire spending at2.2 % of its gross budget against a Shire average of 2.56% a difference of 0.36%)(*Society of information technology managers)

Wiltshire’s ICT spend as a proportion of net revenue budget

Staffordshire

Durham

Northumberland

Average

Wiltshire

Essex

Hampshire

Suffolk

Worcestershire

Derbyshire




22..55 IICCTT ssttaaf f f f iinngg lleevveellss

When we examined ICT staffing levels we found that Wiltshire has 0.150 ICT staff(central, departmental and outsourced) per 1000 population. The average forthe group of counties for which we have data is 0.2121 per 1000 population. IfWiltshire’s staffing levels were equivalent to an average County for which datawas available, it would have an additional 0.052 ICT staff per 1000 population,equivalent to 26.8 employees for a population of 433,000. Wiltshire’scomparative staffing level is shown below.

The SOCITM report for 2003 appears to confirm this trend with an average ICTstaffing establishment for Shire Counties of 99, Wiltshire has around 60-65 ICTprofessionals across CICTU, service directorates and Vivista (the latter beingsubject to fluctuation per demand).

Wiltshire’s ICT staffing levels as a proportion of population

0 0.05 0.1 0.15 0.2 0.25 0.3 0.35

Staffordshire

Northumberland

Suffolk

Surrey

Durham

Average

Derbyshire

Worcestershire

Wiltshire

Hampshire

Essex

ICT staff per 000 population




However which ever system is adopted it is likely to have similar vagaries (in ourexperience).

The Council is obliged to take account of the Best Value Accounting Code ofPractice (BVACOP)

In determining the basis for recharging, we would recommend that a review isundertaken of the methodology used with user involvement, to examine if thereis a more appropriate basis for recharging.

However an overly complex and expensive system to administer should beavoided.

In terms of the categorization of charges made these seem appropriate giventhe current devolved nature of budget holding.

22..77 OOvveerraallll ccoonncclluussiioonn

Our overall conclusion, based on the group of Counties shown above, is thatWiltshire spends less than the County average and considering the amount offuture investment required, may need to increase expenditure annually byapproximately £3 million.

22..88 R R eeccoommmmeennddaattiioonnss

The Council should review its ICT spending and staffing levels when formulatingits long-term financial strategy.

The Council should review its ICT recharging policy with user involvement toensure that it is equitable and within the BVACOP guidelines.




SSee

cc

ttiioo

nn

33

IICC

TT

aa

nn

dd

bb

uu

ssiinn

ee

ssss

aa

lliigg

nn

mm

ee

nn

tt


We do not think that the Council’s ICT provision and infrastructure is alignedoptimally with its business and service needs:

• Local autonomy combined with a ‘departmental-based’ view of ICTinvestments has resulted in the Council have a disparate ICTinfrastructure, with significant areas of duplication of information. Thisprevents the Council from having a common view of its finance, staff andcustomers. To overcome this weakness the Council should adopt an‘enterprise architecture’ where information can be shared, and singleinstances of corporate applications fulfil the Council’s administrativeneeds.

• The organisational structure of ICT management and provision does notmeet the Council’s requirements. We propose that the Council creates asenior second-tier post with overall responsibility for ICT management andgovernance.

• Improving the Council’s technical architecture will be costly and high risk,and the Council may wish to explore developing partnership-based

relationships to meet the short/medium-term investment needs andreduce risk.


This section of the report focuses on how the Council seeks to align the businessneeds of service units with its ICT strategy. We examine:

• The balance between local autonomy and centralised control in ICTstrategy development.

• The funding mechanisms and underlying prioritisation processes whichunderpin ICT investment decisions.

Th i ti l t t f ICT t d i i i




economies and control over standards) and the advantages of devolvement(such as flexibility and responsiveness).

A federal model of ICT support

Wiltshire does not comply with the Commission’s federal model, and we believethis is the underlying reason for many of the problems faced by the Council.Wiltshire has a unique organisational approach to ICT – it appears to capture thedisadvantages from the extremities of the centralised and decentralised models,whilst at the same time avoiding the benefits of the federal approach:

• Central and departmental ICT provision is not underpinned by a robustICT strategy. Given the current procurement of new corporateapplications, it is vital that an ICT strategy is developed so that maximumvalue can be derived from any forthcoming investment in core systems.

• Departments have a ‘local’ view of ICT and have made many small

unresponsive

no systemownership

not meetingbusiness needs

no controlof overheads

excessivecosts

variablestandards

reinventingthe wheel

incompatiblesystems

scaleeconomies

group-wideperspective

pooledexperience

capturesynergies

CENTRALISED IT DECENTRALISED IT

FEDERAL IT

functionalIT leadership

controlof standards

integration

critical massof skills

userscontrol

priorities

ownership

responsive tobusiness

needs




Moving towards an enterprise architecture




33..55 IICCTT oorrggaanniissaattiioonnaall ssttrruuccttuurreeThe structure of Wiltshire’s ICT organisation reflects the low-key impact of ITacross the Council.

Responsibility for ICT resides with Finance, and there is not a dedicated 2nd tierofficer responsible for ICT across the Council, this is an untenable position giventhe aims and objectives of the Council and the strategic importance of ICT.

There are two aspects to this issue. Firstly the Council will not raise the profile ofICT within the Council if ICT is seen as just a part of a range of responsibilitiesunder one officer, the role requires the dynamism and expertise of a dedicatedfull time professional.

Secondly the appointment of a second tier officer in itself will not address manyof the organisational issues facing the Council.

ICT must be viewed from a much more corporate perspective and the officercorporately responsible for ICT must work within an agreed framework whichcommands the support of all chief officers and leading elected members. Thefocus should be on communication rather than control.

As part of this framework a series of technical, professional and managerialstandards should be further developed, and enforced corporately through thisnew post.

This is an absolute pre-requisite of the federal model.

For the purpose of this strategy document we will refer to this post as the‘Corporate Head of ICT’.

This recommendation should not be viewed as a criticism of any one or group ofindividuals, rather recognition of the size of the ICT role and the difficulties of

adopting and implementing corporate standards and approaches in a muchdevolved environment.

The Annual SOCITM* survey for 2003 shows that of all 17 local authorities in theSouth West region, none has a more devolved approach to ICT than Wiltshire.(*Society of information technology managers)




Option A

It is possible that the staffing structures under (and including)the ICT coordinatorscould have a ‘thick’ reporting line to a new corporate post, effectively makingthose staff managerially responsible to the Corporate Head of ICT, whilstphysically located in directorates and taking day to day instruction fromdirectorate management.

Option BAlternatively these staff could continue to remain managerially responsible toservice directorates with a dotted line to the Corporate Head of ICT, referring tothat person for ‘professional advice and guidance’.

In developing the ICT strategy we came across a number of examples whereout posted professional staff through various consultative procedures wereeffectively operating in the Councils overall corporate interests whilst serving theneeds of service directorates

For example, the Senior Finance Forum, here the relevant Assistant Directorsmeet on a regular basis with the S151 officer to review the corporate financialposition of the council, and discuss issues of corporate and strategicimportance.

Similarly the communications service within the Council has arrangements inplace to ensure that the ‘corporate’ message is given to external agencies,

press and partners.

Our preferred approach would be to adopt option B as an interim measureleading to option A.

Our view is that there is little merit in adopting option A too quickly and that thisoption is best implemented after a second tier officer has been appointed andnew standards have been corporately adopted and credibility and trust has

been established.

The following strategy and recommendations make clear the advantages ofsuch an approach.

The secret to success is we believe one of timing the appointment of the right




programme and consideration should be given to the appointment of a projectsupport officer.

33..55..44 AAlliiggnniinngg tthhee IICCTT ssttaaffffiinngg ssttrruuccttuurree wwiitthh bbuussiinneessss nneeeeddss

We have examined the current structure of CICTU and its relationship to theCouncils business requirements and concluded that it is too technically focusedand based on ICT disciplines rather than the business needs of the Council.

Outlined below is a diagrammatic representation of the current structure.

Overleaf we have outlined at a high level the functional groupings we think theCouncil needs to consider regardless of the location of these functions e.g.outsourced or in house.

Current CICTU Structure

Head CICTU

(Les Snelgrove)

IT/Sec Manager(Chris Christensen)

IT/Sec Officer(Steve Grieshaber) IT/Sec Officer

(Mike Potter)

DP Admin Assistant

(James Costello)Senior

TechnicalConsultant(Tim Way)

ICT Contracts

TechnicalConsultant

(Brian Hockley)

ProgrammeCo-ordinator

(John Pheasant)

ProjectManager

Established Post

Vacancy

IT/Securit

Technical

TemporaryContractor

Projects




A more customer-focused organisation

33..55..55 VViivviissttaa

The Council has a managed service with Vivista for a wide range of operationalICT services.

The contract is currently under review by CICTU and this strategy documentwhilst addressing a number of issues raised by users with the current

arrangements, has not dwelt in detail on this area whilst this review is underway.Needless to say the relationship with any third party supplier is a crucialingredient in the mix for successful service delivery and the expiry of this contractin 2006 represents an opportunity for the Council to improve and build on thecurrent service levels.

Head of CustomerServices and Quality

Departmental ICT co-ordinator

Quality and ServiceDelivery Manager

User RelationsManager

Head of Infrastructure

Operations Manager

Second/third linesupport

Head of Projects

Development andIntegration Manager

Project Managers(Pool)

Head of Strategy

ICT Risk and SecurityManager

Strategic ArchitectureManager

Strategic ProcurementManager

Corporate Head of IT




33..66 IICCTT f f uunnddiinngg aanndd ssoouurrcciinngg mmeecchhaanniissmmss

Wiltshire’s ICT funding mechanisms are, in the main, departmentally focused,

and consequently the Council does not have the wide-area infrastructure itneeds to support modern business applications.

If the Council is to address the weaknesses in its ICT infrastructure then it must actcorporately and set-aside investment and renewal funding so that is candevelop and maintain a fit-for-purpose and sustainable infrastructure.These funds should be managed corporately and this may entail an element ofbudget re-centralization particularly in the areas of discretionary developmentbudgets.We understand that the Council has (to meet its e-government obligations) setaside £9 million over the next three years. We understand that this allocation is‘supply limited’ i.e. it reflects what the Council can afford rather than what isreally needed.

Whilst this is a large amount of money, we think that it will be insufficient to meet

the Council’s medium and longer term investment needs. The Council hasadopted a traditional approach to funding ICT, managing projects in-house andretaining the major risks.

We think the Council would benefit from consideration of alternative fundingmechanisms, possibly via some form of partnership, where funding can beobtained and paid for in line with longer term affordability constraints , perhapsthrough an ‘invest to save’ mechanism.

In the interests of informing the debate we have outlined a number of modelsfor consideration.These do not form part of the recommendations for the ICT strategy as there areclearlyNon- ICT related issues which impinge on a number of these models anda wider range of considerations would need to be examined in detail beforeconsidering adoption.An outline of the main sourcing options open to the Council is given below

33..66..11 LLooccaall ggoovveerrnnmmeenntt ssoouurrcciinngg ttrreennddss;; tthhee ssoouurrcciinngg ssppeeccttrruumm

Councils have a number of sourcing choices. These are described below in the‘sourcing spectrum’.




There are three main options within this spectrum, as described below.

33..66..22 TThhee iinn--hhoouussee ooppttiioonn

This relies on the partner to help with implementation and configuration. This isthe model traditionally adopted by local authorities:

• It does not transfer risk to the partner since it is largely input-based.

• It can generate affordability issues since the investment is usually fundedfully by the authority.

• The authority needs to provide many skills from in-house resources, andthis may be difficult because of resource/skill constraints.

1. In-house

Retain risk

Affordabilityissues

High skillsneeded

Integrationachieved

No exit issues

3. BPO/PPP

Transfer staff

Transfer risk

Possibleintegration

problems

Possiblechange

control issues

Access toskills

Exit issues

2. BusinessImprovement

Transfer some risk

Integration can beachieved

Risk/reward possible

Possible changecontrol issues

Access to skills




in-house delivery and full business process outsourcing (BPO) or public- privatepartnership (PPP):

• It allows some risk to be transferred to the partner. For example thepartner may be responsible for ensuring that new applications andbusiness processes are implemented which enable the authority toachieve savings through process rationalisation.

• It allows the integration of front and back-office processes to beachieved because the authority is wholly or mainly responsible for all

service delivery.

• It provides a platform for risk-reward, where benefits can be used to fundthe investments needed to modernise services. Savings resulting from theinvestments can be shared between the authority and the partner. This isadvantageous if the Council may require help with up-front funding. Ifthe Council is confident that it already has access to the financialresources it needs then it may not be necessary to use a risk-rewardframework.

• It provides access to skills when they are needed – for example, thepartner will need to provide suitably skilled resources duringimplementation and upgrade phases, and in support of business processre-engineering (BPR).

•

Business improvement partnerships can be procured in relatively shorttimescales compared with BPO/PPP partnerships.

33..66..44 BBuussiinneessss pprroocceessss oouuttssoouurrcciinngg oorr ppuubblliicc--pprriivvaattee ppaarrttnneerrsshhiipp

Authorities such as Middlesbrough, Redcar and Cleveland, Liverpool,Bedfordshire, Lincolnshire and Milton Keynes have entered PPP agreements.

• These are large scale (between £200m and £1bn), long-term (10-15 years)

that involve the transfer of substantial numbers of staff (typically between500 and 3000).

• Because the partner is wholly responsible for the delivery of the scopedservices, the risks around these services are transferred to the partner. This

b tt ti ith d i i t ti i




• Much effort is required to ensure that the exit issues (be they at expiry or

because of termination) are considered. Authorities must consider theimpact on staff, assets and data. It is common for performance bondsand/or guarantees to be secured in order to deal with exit costs.

• Because the partner becomes the employer for the in-scope services, itusually includes significant BPR within the scoped services (but BPR maybe excluded unless specifically required for non-scoped services).

• PPP/BPO partnerships generally take a minimum of two years to procure.


The Council should:• Adopt ‘enterprise architecture’ where information can be shared and

single instances of corporate applications fulfil the Council’sadministrative needs.

• Create a senior second-tier post with overall responsibility for ICTmanagement and governance.

• Consider if some form of partnership with the private sector would bebeneficial in helping to meet the Council’s investment needs.




SSeeccttiioonn 44 IICCTT mmaannaaggeemmeenntt aanndd ggoovveerrnnaannccee


We assessed the Council’s ICT management and governance processes against theinternationally recognized CObIT (control objectives for IT), standard.

Our evaluation shows that the Council has immature governance processes.One area of relative strength is the Council’s approach to ICT risk management.

The key weaknesses are:

• The lack of a robust corporate ICT strategy which defines how investments will beappraised, what standards are in place and must be followed, and how benefitswill be realized.

• The absence of a corporate ICT architecture, which sets-out the major buildingblocks around core applications, shared information through consolidated

servers and storage, and appropriate access to information via a robust voiceand data network.

The Council’s ICT governance arrangements should be strengthened to resolve theproblems identified.


Sound ICT governance processes help the Council to make decisions which are:

• Justified on economic and/or strategic grounds, adding-value to theCouncil’s service delivery and management capabilities. This requires theCouncil to develop robust business cases to underpin the investment,backed-up by an analysis of long-term costs, benefits and risks.

• Able to demonstrate that the anticipated benefits have been realised

through robust post-implementation review procedures.

Our evaluation of the Council’s ICT governance processes is based upon analysis ofhow the Council compares against the ‘planning and organisation’ standards set-out inCObIT (control objectives for IT), an internationally recognised framework for ICTgovernance The CObIT standard has been developed by the Information Systems




44..33..11 MMaattuurriittyy lleevveellss ddeeffiinneedd

The approach to maturity models for control over IT processes consists ofdeveloping a method of scoring that grades an organisation from ‘non-existent’to ‘optimised’ (from 0 to 5). The levels are defined further below.

Level Description

0 Non-Existent Complete lack of any recognisable processes. The organisation has noteven recognised that there is an issue to be addressed.

1 Initial There is evidence that the organisation has recognised that the issues existand need to be addressed. There are, however, no standardised processesbut instead there are ad hoc approaches that tend to be applied on anindividual or case-by-case basis. The overall approach to management isdisorganised.

2 Repeatable Processes have developed to the stage where similar procedures arefollowed by different people undertaking the same task. There is no formaltraining or communication of standard procedures and responsibility is leftto the individual. There is a high degree of reliance on the knowledge ofindividuals and, therefore, errors are likely.

3 Defined Procedures have been standardised and documented, andcommunicated through training. It is, however, left to the individual tofollow these processes and it is unlikely that deviations will be detected. Theprocedures themselves are not sophisticated but are the formalisation ofexisting practices.

4 Managed It is possible to monitor and measure compliance with procedures and totake action where processes appear not to be working effectively.Processes are under constant improvement and provide good practice.

Automation and tools are used in a limited or fragmented way.5 Optimised Processes have been refined to a level of best practice, based on the

results of continuous improvement and maturity modelling with otherorganisations. IT is used in an integrated way to automate the workflow andprovide tools to improve quality and effectiveness, making the enterprisequick to adapt.




44..33..22 EEvvaalluuaattiioonn aaggaaiinnsstt tthhee CCOObbIITT oorrggaanniissaattiioonn aanndd ppllaannnniinngg ssttaannddaarrdd

CObIT standard Description Wiltshire’s position Action requiredDefine a Strategic ITPlan

Define a Strategic ITPlan with thebusiness goal ofstriking an optimumbalance ofinformationtechnologyopportunities and IT

businessrequirements as wellas ensuring its furtheraccomplishment

1

The Council does not havean activated corporate ICTstrategy; however somedepartments have definedtheir ICT requirements in theform of forward plans.

The Council has adepartmental -basedapproach, resulting in – forexample – 150 servershosting applications, insteadof the expected number ofbetween 30 and 50.

This means that the Council

is unable to co-ordinate itslong-term ICT requirements,leading to insufficient valuebeing obtained andinformation becomingduplicated andfragmented.

Develop acorporate ICTstrategy with arolling five-yearfunding horizon.

Define the InformationArchitecture

Define theInformation

Architecture withthe business goal ofoptimising theorganisation of theinformation systems

0

The Council does not havean information architecture.

This means that the Councildoes not have a single viewof its information, resulting inunnecessary duplication ofinformation, and the inabilityto share commoninformation across the

Council.

Define technicalinformation

architecture aspart of thecorporate ICTstrategy.

DetermineTechnologicalDirection

DetermineTechnologicalDirection with thebusiness goal oftaking advantage

1

The Council has some ICTstandards in place but theseare too wide to be of

Define corestandards as partof the corporateICT strategy andensure these are




CObIT standard Description Wiltshire’s position Action required

Define the ITOrganisation andRelationships

Define the ITOrganisation andRelationships, withthe business goal ofdelivering the right ITservices

1

The Audit Commission’srecent report on ICTmanagement arrangementsconcluded that theCouncil’s organisationalstructure for ICT is confusingto end users. ICT is notstructured around thebusiness needs of end-users.

This means that there is agreater danger of thecorporate standardsreferred to being ignored.

Refine the ICTsupport structureso that it shapedaround userrequirementsrather thantechnical ICTdisciplines.

Manage the ITInvestment

Manage the ITInvestment with thebusiness goal ofensuring funding,controllingdisbursement offinancial resourcesand realisingbenefits

0

The Council does notmanage ICT investmentseffectively. For example,investment decisions are notalways made on the basis of“What’s best for theCouncil?”, and there is nostandard process fordetermining if benefits havebeen realised.

This means the Council may

be making sub-optimalinvestment decisions andthat it fails to achieve theanticipated benefits fromthe investments.

Enforce acorporate processfor investmentappraisal whichidentifies long-termcosts and benefits.

Introduce acorporate processfor benefitsrealisation whichmakes individualsaccountable forthe delivery of

benefits.

Centralise ICTbudgets so thatinvestments aremade for the‘corporate good’rather than for thebenefit of a singledepartment.

CommunicateManagement Aimsand Direction

CommunicateManagement Aimsand Direction withthe business goal ofensuring userawareness and

0

The departments weconsulted were unaware ofthe Council’s long-term aimsfor ICT.

Developcommunicationscapability as partof the corporateICT strategydevelopment




CObIT standard Description Wiltshire’s position Action required

Assess Risks Assess Risks with thebusiness goal ofsupportingmanagementdecisions inachieving ITobjectives andresponding tothreats by reducingcomplexity,increasing

objectivity andidentifyingimportant decisionfactors

3

The Council has developedan ICT risk register, and hasestablished disasterrecovery arrangements for33 of its 150 servers. TheCouncil’s ICT security policysets good standards, butbecause of deficiencies inthe wide-area infrastructure

these can only be enforcedeffectively within CountyHall.

Maximise thebenefit of riskmanagement byensuring that thecorporate ICTstrategy includesthe requirementfor regularconsideration ofthe risks it faces.

Manage projects Manage Projectswith the businessgoal of settingpriorities anddelivering on timeand within budget

1

The Council has projectmanagement processes inplace, but these are notenforced rigorously.

The Council does not havea dedicated ICT projectmanagement resource.

The Council’s SOCITM returnfound that 6 out of 7projects were not reviewed

following implementation.

Ensure that thecorporate ICTstrategy requiresformal projectmanagementprocesses to beenforced.


The Council should:Action required

• Develop a corporate ICT strategy with a rolling five-year funding horizon.• Define technical information architecture as part of the corporate ICT

strategy.

• Define core standards as part of the corporate ICT strategy and ensurethese are communicated and enforced.

• Refine the ICT support structure so that it shaped around userrequirements rather than technical ICT disciplines.

• Enforce a corporate process for investment appraisal which identifiesl t t d b fit




SSeeccttiioonn 55 TThhee CCoouunncciill’’ss IICCTT IInnffrraassttrruuccttuurree


A Server and Network infrastructure needs to be created which will provideequal access to ICT facilities no matter where the user is situated, and equally tomobile and home workers.

WCC must consolidate its processing into the principal Business applications

where possible, and rationalise the number of subsidiary applications, ExcelSpreadsheets and Access Databases in use.

All equipment needs sustainable funding to ensure that it is kept up to date fromboth hardware and operating system perspectives.

The Financial System (APTOS) should be enhanced or replaced to address

shortcomings in its functionality; it no longer meets business requirements.Whilst Departments should have the freedom to select Line of BusinessApplications which best meet their business needs, it is important that there areclear standards set from the centre which allow corporate goals to be met andthat all software is coherent with key corporate strategies – e.g. servers, network,security, e-Government.

The Council should develop a corporate telephone (voice) network which

provides a common infrastructure for all WCC employees at all locations. . Acommon network infrastructure supporting both voice and data could realise anumber of financial and service benefits, although would require a commonmanagement structure for both networks.


At the heart of any Local Government e-Government strategy is the ability forthe Council’s employees and customers to be able to easily communicate,

obtain information and access services through voice and data services whichembrace the entire spectrum of the Council’s geography and businesses. Therole of ICT is to facilitate such access in a seamless and joined up manner so thatcustomers can interact with the Council by any chosen access method (e.g.phone, personal visit or Internet) and deal with multiple issues (which may span

i d t t b d i ) i i l t t h C f t t t




• Allow “joined up” access to services by citizens, who should not need tounderstand service delivery structures – this not only places a requirement

on the Council’s own systems but also the need for systems to operatecoherently with systems used by other Agencies, e.g. NHS, DistrictCouncils, etc.

• Provide levels of security commensurate with the information beingaccessed and to protect data which is stored in the systems and to meetlegislative requirements.

55..33 TThhee iimmppoorrttaannccee oof f iinnf f rraassttrruuccttuurree

WCC’s current ICT Infrastructure contains examples of both excellent andunsatisfactory systems. The condition of infrastructure is variable throughout theCounty Hall campus. The contrast is very much more significant when facilitiesbetween County Hall and outlying sites are compared, with the latter oftenhaving modest data network connections, incoherent telephony services,unsatisfactory server and security management, etc. This is creating a “digitaldivide” between the various Council offices and makes it difficult for staff who

normally work outside of the County Hall complex to utilise corporate systems(e.g. e-mail, Intranet) and to access Line of Business applications. This deficiencyneeds to be urgently addressed and will involve investment in all of the areascontained in this report.




SSeeccttiioonn 66 IInnffrraassttrruuccttuurree

66..11 NNeettwwoorrk k

The current network, which uses a number of “point to point” links with some dialup (PSTN and ISDN at the extremities), is now failing to serve the Council’sbusiness needs and requirements. There are a number of reasons for thisincluding:

•

Although the principal hub sites have some resilience (e.g. alternaterouting), for many parts of the network there is little resilience withinthe network due to many single points of failure.

• Response times are unsatisfactory in many locations due toinsufficient bandwidth availability; the cost to increase bandwidth ishigh.

• Running costs are high, particularly where dial-up connections aredeployed.

• The Virtual Private Network (VPN) service which allows users to beconnected when working remotely (e.g. from home) is unreliable anddoes not support the latest versions of the Microsoft operating system(XP).

• The current network provides variable service depending on the wayeach office is connected. Many outlying sites have unsatisfactoryconnections and thus the “digital divide” is enforced.

• It is difficult and expensive to expand the network due to thetechnologies used.

• The topology makes it difficult to add additional services, e.g. homeworking, connection via mobile telephones, etc.

The Peoples Network (PN) project in the Libraries has successfully deployed BT’sMetroVPN product. This is a BT Managed Service which allows a number ofdifferent connectivity options and hence a variety of alternative methodologiesto meet the needs of all classes of user situations from home workers and smalloffices to the largest of sites. The original PN bid required WCC to providefunding from corporate council resources beyond the initial PN grant fundedyears. WCC agreed to this funding subject to the condition that on the

IICCTT SStt tt




• WCC need to ensure that connectivity to MetroVPN can berealistically achieved throughout its geography. In particular it needs

to audit availability of services in areas where low to moderate usageis required (e.g. small offices or homeworkers) and verify whether BT isable to provision ADSL connectivity in such areas. Where ADSLconnectivity is unavailable, alternative means of connectivity (e.g.SDSL using a BT EPS8/9 circuit and short-haul modems connected to aWCC hub site, or radio or satellite communications) should beinvestigated. WCC should ensure that all sites can be connectedthrough affordable and sustainable means. The use of services which

charge on the basis of connect time or data volumes (e.g. PSTN,IDSN) should be avoided due to the variable nature of revenue costs.This segment of the project is essential; WCC should not attempt toroll out a network which is not capable of achieving the objectivethat all offices are connected.

• A thorough audit of bandwidth requirements at each site isconducted. This is to include availability for future growth, e.g.

e-Government projects. This requirement should be costed and WCCmust then agree a sustainable means of funding the network for thenext 5 – 10 years, such funding may include contributions from bothcorporate and departmental budgets.

• Ability to support centralisation and rationalisation of servers across allWCC sites, and to support information sharing between all officers nomatter where they might be located.

• Ability to support IP Telephony at reasonable cost.

• Ability to support videoconferencing.

It is essential to the success of WCC’s ICT infrastructure and e-Governmentprogram, that a new network is implemented at the earliest opportunity andwithout delay. This must address issues about VPN connectivity, bandwidthrequirements to outlying offices, provision for home workers, etc. Without this,the current “Digital Divide” cannot be overcome.

WCC therefore need to ascertain that MetroVPN will meet their requirements,including the issues raised above by immediately initiating a project to verifythat successful implementation can be achieved, and to cost this. Once thisfeasibility stage is complete, WCC should move forward with implementation

i d t il d j t t th d l d ith ffi i t





66..22 SSeerrvveerrss

Throughout the Council, there are many instances of servers running old, out of

date versions of Operating Systems including Novell 3 and Microsoft WindowsNT4. This presents a number of risks to the Council:

• If there is a problem then WCC are unlikely to be able to obtainsupport from any third party including the supplier/originalmanufacturer.

• Incompatibilities may cause inefficiencies or malfunctions in otherareas of the Council’s infrastructure, e.g. old operating systems may

use the LAN and WAN inefficiently or may prevent data from beingexchanged between applications and users.

• Older operating systems compromise WCC’s security policy.

• Patches may no longer be available from manufacturers to addressissues including those of performance and security.

• Vivista’s1 resources will be severely stretched trying to support thenumber of possible permutations many of which will not be supported

by the manufacturers.

Upgrading to a new release of operating system is not a trivial task. The newsystem needs to be tested with the Council’s infrastructure (network, LAN,desktops, etc.) and enterprise, line of business and local applications. Any or allof these may require upgrading to support the new system. Therefore a projectto encompass a range of tasks will need to be established and it may benecessary to liaise with a number of third parties, e.g. application vendors.

An option to wait until the last possible moment to implement an upgrade, e.g.until a current system breaks, is not viable due to the time lag required toconduct the above activities before the new system can be rolled out in the“live” environment.Microsoft’s current policy (which is similar to most other manufacturers) is tosupport the current and previous operating systems for both servers and desktop

computers. Typically this means that from a point where an operating systembecomes stable2 it has a life span of approximately four years. WCC shouldadopt a policy of updating operating systems within this time frame.

Retaining older operating systems is also inhibiting the Council’s ability toproceed with new projects such as the implementations of Common Directory





may result in serious inconvenience to users. Systems can be down for a periodof time whilst restored back to the previous level.

If WCC can rationalise its operating environment so that fewer variants ofhardware and software are in use, then the provision of test servers will becomesimpler as fewer servers will be required and consequently there will be fewerscenarios to replicate and test.Servers which are available for testing may also form part of the Council’sDisaster Recovery policy, as they could also be made available to provideresilience for production systems, see

The “Big Box” project, as currently scoped, will provide a Storage Area Network(SAN) solution for County Hall users.

A SAN is a high-speed special-purpose network that interconnects different kindsof data storage devices with associated data servers on behalf of a largernetwork of users. Typically, a storage area network is part of the overall networkof computing resources for an enterprise. A storage area network is usually

clustered in close proximity to other computing resources, e.g. servers, but mayalso extend to remote locations for backup and archival storage, using widearea network carrier technologies. A SAN will provide a flexible solution forstorage addressing a number of issuers including resilience, managementoverheads, and flexible capacity changes (reconfiguration upwards ordownwards as application requirements change).

There are currently a number of problems with capacity in WCC’s Server roomincluding connectivity to the LAN switches and floor space. These will beresolved within the County Hall complex by the implementation of “Big Box”.

The “Big Box” project does not seek to address users located outside of CountyHall. Such users will continue to use traditional server and storage technology.Not only will these communities be excluded from the aforementioned benefits,but in many cases the existing local server infrastructure is becoming old,

unreliable and lacking capacity and without a corporate implementation of“Big Box” will be replaced by “conventional technology”, thus maintaining the“Digital Divide”.

The NCC Group recommends that WCC consider “Big Box” as a corporate, andnot just a County Hall project However it is necessary to address the network





• Improve security as storage will be contained within the secureenvironment of the County Hall computer room.

•

Improve resilience – components of a common infrastructure can beeasily replicated if a single component fails, and the possibilities for a DRsite based around common infrastructure are enhanced

There are a number of issues with servers (principally file and print servers, butalso some application servers) which are located outside County Hall, including:

• Physical security of devices: No on-site staff designated to ensureequipment is secure, etc.

• “Accidental” downtime, e.g. devices being unplugged from mains ornetwork.

• No environmental control, no air conditioning UPS etc; many of theoutlying buildings do not have accommodation suitable for amini-server room.

• Inability to easily share data with users in other locations.

•

Local users are responsible for loading and storage of backup tapes.

These issues would be resolved by following the “Big Box” approach previously outlined.Some LAN equipment is reaching the end of its life. In particular, the 3ComCoreBuilder 9000 switches will need replacement as these will be unsupported inthe immediate future.(The Council has made financial provision for thereplacement costs of these items.) Like other aspects of the infrastructure, this isan ongoing issue, as the CoreBuilder 3300 switches will reach the end of their life

within a few years and will likewise need replacement. Budgets must becommitted to the ongoing refreshment of this equipment at regular intervals;failure to do this would pose a severe risk to business continuity should these vitalelements of WCC’s network fail.There is also an issue with the capacity of switches. This will be resolved within theswitching element of the SAN (“Big Box” project). However the issue that suchequipment becomes life-expired is an important one and WCC must plan torefresh all infrastructures before it becomes unsupported. Budgets shouldinclude provision for such regular renewals.

For the most part, WCC’s current application architecture follows a traditional“client server” (thick client) approach. This traditional architecture, whilstefficient within small deployments of an application within a limited



gy

Directory can help consolidate the management of the existing networkenvironment, increase network security, and integrate many different

components into one scalable network.• Manageability: It allows efficient sharing and management of

information about network resources or users. It provides a singlepoint of management for Windows Server user accounts, clients,servers, and applications.

• Security: It acts as the central authority for network security, lettingthe operating system verify a user's identity and control access to allresources. It can be used to extend systems securely to the Internet.

In the short term, WCC will need to consider an upgrade to Microsoft Exchange,




66..33 DDeessk k ttoopp EEnnvviirroonnmmeenntt

WCC currently have PCs of various ages, some of which are five or more years

old. These run the spectrum of Microsoft Windows operating systems – 95, 98,2000 and XP. This is creating a number of issues including:

• The older operating systems do not support functionality which allowssoftware to be automatically downloaded and updated. This isparticularly crucial where patches for security issues and virus patternupdates are concerned, this weakness exposes vulnerability withinthe overall security of the Council’s infrastructure and reduces theeffectiveness of the Security Policy.

• When updating the operating environment, network andapplications it is necessary to test against all releases of the Windowsdesktop systems. This increases the time taken to prove that newfunctionality can be released and presents many difficulties whereincompatibilities are found.

• Peripheral devices, such as printers, cannot be consistently supportedas drivers are not available in certain operating system releases.

• Support is complicated since problems in one version of Windowsmay not occur in a different one.

• Systems may run slow and the systems may create inefficiencies, e.g.in network traffic, because the latest techniques for security,compression, resilience are not supported in older versions.

Whilst there has been some good progress in moving users to Windows XP, there

are still a number of PCs which need to be refreshed.

In some cases Vivista have to build modern equipment with old operatingsystems as applications will not run with the latest versions, e.g. XP.

Vivista are contracted to support 95, 98, 2000 and XP. There is no driver forDepartments to upgrade; the departments have to bear the upgrade costs(including any related charges for application upgrades to achievecompatibility with the latest operating systems), but pay the same support costno matter what the operating system.Older operating systems are causing a number of problems e.g. they may notbe capable of accepting automatic updates for security updates and patches.This not only presents a risk to the PCs concerned, but also to all PCs within the




usage in future years. A refresh policy therefore needs to be introduced toensure that:

• Equipment is current – PCs, Printers, etc.• Operating system is a supported version – This means current release

and “current minus one” for Microsoft products, and will thereforeinvolve a refresh at least once every three years.

• Applications must support current Operating System levels and mustbe upgraded as new versions of Operating Systems are released.When procuring new applications it is important to determine vendors

approach to new Microsoft releases and ensure that this iscompatible with this objective.

• By retaining older operating systems introduces a high level of risk intoWCC ICT operations, e.g. inability to load latest virus checker patches,inability to implement new projects which depend on current releaselevels, etc.

There is currently good central control on procurement. Desktops are orderedfrom Dell through a Corporate Contract; other peripherals such as printers areordered through a Hampshire County Council Corporate Agreement with XMA;WCC are an Associate Member of this Agreement. Departmental ICTCoordinators specify equipment to ICT purchasing to buy corporately.

Central procurement of corporate applications is good. There is a corporatelicense for 2,300 users for Microsoft Office. Departmental ICT Coordinators

handle licensing for local packages including Line of Business Applications.

Once a PC has been delivered, the following occurs:• it is checked by WCC corporate Purchasing;• it is then passed to Vivista with a “Build Sheet”;

• Vivista tag the device and add it to the asset register;• the P.C is configured using a standard image together with any special

applications for the user.

Until recently there were over 100 different images to meet the differingrequirements of departments and workgroups. This has been rationalized butfurther rationalization is required.



An Equipment Strategy is required for homeworkers. Within the current Vivista

contract, there is no element for support at employees’ homes. If WCC is toimplement home working, it would be unrealistic to expect homeworkers toreturn their equipment “to base” whenever a problem occurs. The followingneed to be addressed:

• Provision of council equipment to homeworkers – PCs, Printers, etc.

• Support – Helpline and on-site maintenance.

• Security of equipment – see security section.

The current arrangement is that WCC users call Vivista’s Help Desk in Sutton,Surrey to log calls using a freephone number or a PABX short code which dialsthis number. The call is logged by a member of Vivista’s staff in Sutton and isthen passed to on-site staff within WCC to contact the user and deal with thequery. This arrangement is expensive and inefficient as there is always at leasttwo members of Vivista’s staff involved (one in Sutton and one at WCC).

Industry best practice indicates that a high percentage of calls should becleared down within the initial call, particularly where remote diagnostic toolsare available. On-site staff should not be dealing with routine queries but shouldbe targeted to deal with key issues which need on-site involvement.

WCC need to consider the effect of “Mobile Computing” in its overall strategy.Mobile Computing is concerned with the provision of coherent and relevant ICT

facilities to users who work away from the office on either a temporary orpermanent basis. Mobile Computing covers a wide range of technologies,including:

• Hot Desking: The ability for a user to be located at any desk withinany WCC office and to enjoy full telephony and computer facilities,e.g. to be able to log on to their e-mail and applications and toreceive telephone calls from users dialling their usual extensionnumber.

• Docking Points: Points at various Council locations, including possiblysome public premises such as Libraries and Sports Centres, whereusers can “dock” their laptop computer to send and receive e-mail,synchronise calendars and access their line of business applications.In some Local Authorities PCs have been provided for users who do




WiFi access in this context may be used to connect to the Council’s VPN formobile users to then access their applications, e-mail, etc.

• Mobile phones: An increasing number of Local Authorities areinvestigating techniques to support mobile applications using GPRStechnology. GPRS is an efficient and cost effective means of usingmobile phones to transmit and receive data – calls are charged bythe amount of data transmitted and speed can approach those of atraditional landline modem. With the advent of 3G mobiletechnology, “broadband” speeds will be achievable. Mobile phonescan service applications running on either laptop computers or PDAs,

and also a growing number of “smart phones” which include theability to run applications including e-mail.

• Internet Cafés: A growing number of public Internet sites arebecoming available throughout the country and throughout theworld. It is important that WCC adopt a policy for the use of InternetCafes. Such public access has some inherent risks, as the security ofthe environment in which the user is working is dependent upon the

service provider. However it may be deemed reasonable to use suchservices for the non-secure e-mail and routing functions.

A classification system needs to be constructed and enforced corporatelywhich will allow the sensitivity of information to be determined, and hence apolicy of how and where it is appropriate to access various classes ofinformation.

Mobile Computing affects the Network, Server and Desktop technologies and itis important that these are all developed to support this method of working.WCC have made some good progress in some of these areas, in particular:

• There is a limited pilot of WiFi at three points within County Hall. Basedon these experiences, WCC will be able to more fully deploy thistechnology in appropriate areas, e.g. meeting rooms, CouncilChamber, etc. The experiences from this pilot will allow the Councilto more fully deploy the technology. WiFi is not considered to providesufficient throughput to fully replace traditional wired solutions butmay be considered where the building infrastructure (e.g. trunking)will not allow any more cable to be installed.

• Hot desking is being trialled in the ICT Projects Room. Again, this isidi l bl i d b d l d l h




66..44 CCoommmmoonn A Apppplliiccaattiioonnss

WCC currently uses Microsoft Office Suite – Access, Excel, Outlook, PowerPoint

and Word. The applications are all “fit for purpose”. However there are a fewissues:

• The operating system release of the PC desktop will determine theOffice release, e.g. Windows 98 machines will use Office 97.Functionality between different versions of applications is not alwayscompatible between releases, and this can cause significant userproblems, e.g. the ability to access Access databases which areshared between users who have different versions.

• Different versions of Microsoft Office products may result inincompatibilities which mean that attachments to e-mails cannot beread; this affects both internal and external e-mails.

• Many users lack knowledge of basic functionality of how to use thesystems with which they have been provided, including the MicrosoftOffice suite. Users need access to training on everyday tasks,including how to share information (use of shared folders and drives,

etc).To promote remote and mobile working, and to ensure that a “Digital Divide” isnot proliferated, it is important that unless security considerations dictateotherwise, users can access information no matter where they are located. Acommon server policy, where access is based on security and not geography isdesirable and this can only be achieved by a corporate-wide roll-out of “BigBox”. Some restrictions currently exist because of the unsatisfactory quality ofthe existing VPN. As users are migrated to the Metro VPN this should improve.

Significant amounts of information are retained in Access Databases and ExcelSpreadsheets. These are all created for local purposes and used for veryspecific requirements. In the fullness of time, these applications expand beyondthe normal capabilities of non-IT staff to maintain, which increases support.There are also issues about the security and backup status of such localapplications as these have not usually been reviewed by qualified ICT staff.

WCC needs to set a corporate policy for the use of locally developed databaseapplications5. Wherever possible users should use applications which securelystore data on corporate servers where data can be properly managed.Applications, including databases, when developed under proper projectcontrol will ensure that information is stored in a format that is compatible with




their data can be easily integrated with line of business and corporate systemsand databases.

There is currently a 50Mbytes quota set on user’s e-mails accounts; this meansthat once a user has 50Mbytes of data stored in the e-mail account, furtherincoming e-mails will be rejected. In some departments this quota is causingmajor business problems.

At one time 50Mbytes would have represented a significant volume of e-mailmessages. However with modern, function-rich e-mail clients this is no longer the

case and 50Mbytes can represent just a dozen or fewer messages. This isparticularly true in departments where e-mail attachments routinely includelarge legal documents, plans or drawings. One department having mostdifficultly with this limit is Environmental Services because of the nature of theinformation, such as planning, which is being interchanged with externalcompanies.

With the new server this limit needs to be set more realistically to match business

need, and this needs to be address across the whole of the Council, not just inCounty Hall.

The information which is contained in e-mails is live business information and nottransient data which can be wiped. However there is no necessity to store thisinformation in a live mailbox (inbox) file; what is required is a simple means forthe use to archive such information and to be able to easily retrieve it, e.g. byusing a keyword.

Information is often e-mailed to multiple recipients as there is no effectivemethodology to share information within departments and workgroups. Anyarchiving solution which is implemented should allow e-mails to be sharedsecurely across a workgroup. This may be addressed as part of the informationstrategy.

Like all Local Authorities, WCC staff are suffering from “e-mail overload”. Thiscan be true for both internal e-mail (where people may be unnecessarily cc:’edor bc:’ed into correspondence) and external e-mail (particularly where e-mail isaddressed to an individual, e.g. [email protected] rather than a servicespecification e.g. [email protected]). These service-specificaddresses are already advertised on the Council’s Internet site WCC need to




Greater use of the Intranet at both Corporate and departmental levels needs tobe encouraged.

The Intranet provides an ideal platform for sharing information both within andbetween workgroups. Working groups need to be set up at Corporate andDepartment level to pursue opportunities and resources provided to provideand manage information.

66..55 BBuussiinneessss A Apppplliiccaattiioonnss

Most Business applications, except for Finance, have been described by users

to The NCC Group as “Fit for Purpose”. However WCC must not becomecomplacent as applications need to be kept up to date, and to continue toadd additional modules where there is business justification for example:-

• to increase the numbers of tasks which can be completed within theapplication and thereby reduce information held in localapplications such as Access Databases or Excel Spreadsheets.

• to increase the user base, e.g. in Social Care to procure and

implement the CareFirst module which will allow Social Workers todirectly input case data on mobile computing facilities.As with other elements of the Council’s infrastructure, it is important that Line ofBusiness applications are appropriately funded so that they are updated as andwhen appropriate. Updates will not only be necessary to maintain functionality,but also so that applications are compatible with the latest releases of server,network and desktop operating systems, and to ensure that applicationsoftware does not become the reason for infrastructure not being kept up to

date.6

The non-availability of applications across all Council locations is anotherexample of the “Digital Divide”. Some of this is caused by a server and networkarchitecture which does not lend itself to the sharing of applications across thegeography. Many applications are not suitable to be used across the WAN, thisincludes the financial system APTOS.

In some cases, WCC have not purchased modules which allow applications tobe delivered across the WAN. In other cases, the current situation where thenetwork infrastructure is driven corporately but the application strategy is drivendepartmentally, means that departments understand that modules to allowapplications to run across the Council can be procured, but do not have the




Corporate standards need to be applied to the selection of applications toensure that these can be effectively and efficiently delivered to all points (e.g.that they use network bandwidth optimally). This corporate mandate shoulddictate minimum standards to which applications must comply, including theuse of Thin Client technologies where it is appropriate to use these.

It is important that an Information Management strategy is implemented whichallows data to be mapped between the various business applications, and forinterfaces to be created to allow sharing of data between these applications,

e.g. by the use of government and industry standards such as e-GIF and XML.Management and mapping of the data should be a corporate function withappropriate assistance from database managers for each of the applications.

So far as the financial systems are concerned, there are a number offunctionality gaps in APTOS, including:

• e-Procurement

• Purchasing

• Commitment Accounting

• Management Information

This is causing a proliferation of Access Databases and Excel Spreadsheetswhich often contain unsatisfactorily constructed and uncoordinated data.WCC should urgently investigate options to consider the following and thenimplement a project to implement enhancements/upgrades or a replacementsystem as soon as possible.

• Upgrade or enhance APTOS to a level which will provide thefunctionality.

• Invest in a new “Best of Breed” Financial application which will meetthese and other future requirements.

•

Invest in an Enterprise Resource planning application which willintegrate other parts of the Council’s administration, e.g. Payroll andHR.

Cyborg, was purchased as a fully integrated payroll and HR suite.




responsibilities to produce the payrolls in a timely fashion to the externalorganisations.

HR within WCC is a devolved function and there are no corporate standards,hence the quality of information contained in Cyborg is variable and oftenincomplete. This makes management reporting difficult and causes problemswith reporting, e.g. metrics to Central Government, KPIs, etc.

66..66 ee--GGoovveerrnnmmeenntt

There is a concern amongst the ICT Coordinators that they do no know what

strategies are being set within the e-Government program. ICT Coordinatorsneed to be able to take a view as to how these initiatives will fit in with their localbusiness requirements and may influence priorities, e.g. deploying new modules.The e-Government Team must operate as a “joined up” operation within thevarious Corporate and Departmental Teams which specify and support ICTwithin WCC.There is a need for Departments to move ahead with technologies such as EDMand DIP to fulfil business needs. If corporate standards are not set, then this

could result in a number of different and incompatible systems beingproliferated across WCC.

Programs, including high-level project plans for the deployment of keytechnologies are required in order that WCC can move forward with a greaterlevel of integrated ICT. The e-Government Team is researching technologieswhich will meet the business requirements for WCC to implement aninfrastructure which supports e-Government (e.g. CRM, DIP, GIS, EDM, andTransactional Web Site).

It is important that these technologies are not just implemented to fulfile-Government targets, but are truly implemented to improve the cost andquality of the Council’s service delivery. Such key technologies should not justbe implemented as technical solutions, but as business driven projects.

The Council’s businesses must embrace these technologies and ensure that theybecome everyday business tools within the Council’s business practices. Use ofsuch tools should also be driven by emerging working practices driven from theongoing BPR exercise. Project plans should include how the business will use thesystems, e.g. how the Departments who hold information will populate the e-Government systems such as GIS with this data




E-Government can only be successfully implemented if the various strategies forserver and network deployment specified elsewhere in this report areimplemented. In particular WCC must have a network and server strategywhich does not disadvantage any particular section of the Council’s staff, andprovides equal access to corporate, desktop and line of business applicationsno matter where an employee is located or if he is a mobile or home worker.

As part of providing a “joined up” service to customers, it will be important thatsystems can access common information. This may simply be the ability for a

call centre agent using CRM to access an officer’s electronic Outlook diary tomake an appointment. It may alternatively be links into back office systems toallow name and address details to be updated or service history to beaccessed.

Such data sharing has a number of legal issues, including Data Protection Act,Freedom of Information and Human Rights legislation. There is also an“infrastructure” element to Data Sharing and in particular:

• WCC needs to have Information Management Strategy which shouldhelp the Council understand what information it holds, to consolidateand minimise duplicate information.

• The Network and Server Strategy must underpin the user requirementsand provide an infrastructure that will physically allow the data to beshared.

• WCC needs a policy which defines the ownership of data. For

example, there are many local Excel worksheets and Accessdatabases; this means that it is often difficult for one workgroup toknow what another workgroup has. If knowledge was available theninformation could be shared.

• An Information Sharing protocol is required to define the conditions,security requirements and other necessary prerequisites for sharing.

The e-Government agenda requires Local Authorities to provide a means for thecustomer to contact the Council by any chosen method. This requires theimplementation of technologies to handle personal visits (One Stop Shops),telephone calls (Call Centre) and electronic contact (the Internet).WCC are piloting both a Call Centre and One Stop Shop, the latter beingl t d t S li b lib




• Access one stop shops (usually a physical access issue, together withresources for those with hearing or sight disabilities).

•

Access call centres (including provision of textphone for those withhearing impediments).

• Access web sites. In this respect WCC have made good progresswith the Bobby™ standards.

The Wiltshire and Swindon Partnership is providing some level of “joined up” Internetprovision to the public, joining the services of the County Council, the District Councils

and Swindon. This is essentially a Content Management System with XML supportwhich can have information loaded from any of the partners. Currently the servicessupported are Abandoned Vehicles, Change of Address and some Social Carefunctionality for the vulnerable (elderly). In order to provide a seamless means ofcustomer contact for County and District Council services, it is important that this hubservice is further developed.

66..77 SSeeccuurriitt y y

The current security practices and guidelines in place within WCC andimplemented within County Hall are, for the most part, considered robust by TheNCC Group. WCC have appointed a full-time security officer who is workingtowards BS7799 accreditation for the Council’s systems. The standard of thework completed to date is reflected in the fact that the Council has been ableto provide a bridge between its network and the NHS network allowing WCCstaff to access CareFirst from NHS premises and NHS staff to access their coreline of business applications from Council premises. Connections to other

external networks including DVLA, WICKD (Child Protection), AWARDS (StudentGrants), have also been achieved.

Amongst the security initiatives implemented by WCC are:

• good access to control to computer/server room and other key areaswithin the infrastructure;

• environmental controls in the computer room and network switch

rooms;• computer use policy which includes regular password changes;

• control of backup media;

• firewall, mail sweeper and virus checking policies are all in place;




Regular training in security practices is available to all staff, and isrecommended on an annual basis.

WCC have retained control of password/security allocations so that they couldoperate irrespective of the status of the third party contracts such as Vivista. Arisk register has been assembled and by pursuing an aggressive policy a numberof issues have now been closed.

In evaluating the implementation of security procedures, the “Digital Divide”again becomes apparent, as whilst the aforementioned security policies are

theoretically applied to all Council offices, their implementation outside CountyHall is unsatisfactory. Examples of weaknesses include:

• There is no security officer formally nominated at each site. Theappointment of such officers would ensure that responsibilities wereformally allocated and an appropriate of level of training andmonitoring could be established.

• A full risk assessment at each site is required, e.g. to consider powersupplies, physical security (where servers are located), disasterrecovery, etc.

As the sharing of information and applications improves, and as the server andnetwork infrastructure improves, weaknesses in security at outlying offices willhave an increasing impact on the overall security of WCC’s systems.Weaknesses at outlying offices could therefore impact significantly on theambition to achieve BS7799 accreditation.

With respect to Disaster Recovery and Business Continuity Planning for ICTsystems and infrastructure, WCC has made limited progress. Out of 150 serverscurrently in use, there are disaster recovery plans covering only 33 of these. It isimportant that all servers and the network both WAN and LAN infrastructureinterconnecting these is fully and regularly risk assessed, and that WCC’s changemanagement procedures ensure that the risk assessment is revised wheneversystems and services are revised. Amongst the areas WCC needs to consider

are:• Network failures: In particular the ducting between the campuses on

either side of the main road at County Hall is a major risk. Cablescarrying both voice and data traffic are run in a single duct, and ifdamaged e g because of road works could put services out of




• Whilst central resources are essential within disaster planning, it is alsoessential to consider how users would access the services in the eventof a major incident, e.g. if a major part of County Hall becomeinaccessible. WCC need to plan how they would provide desktopPCs and the network connectivity for these so that users could accesse-mail, line of business applications, etc.

The diversity of WCC’s infrastructure ( both in terms of devices deployed and therange of operating systems supported) make it difficult and expensive tothoroughly provide resilience. Rationalisation of systems through upgrading to

current operating system levels and device consolidation (the Big Box project,which should be considered for council-wide deployment) should greatlysimplify this provision. Equipment provided for resilience also has the potential ofuse as test systems, which would address the issue of testing.

WCC are planning to move their ISP (Internet Service Provider) and thisrequirement will be the subject of anew tender in the near future. The newarrangements should not only consider connectivity issues, but also whether any

security benefits can be realised through any new arrangements, including:• Sending secure emails;

• Receiving secure information from the web site e.g. job applicationforms;

• Business continuity facilities;

• Assistance with the roll out of virus updates, operating system patchesetc particularly to remote users;

• Mobile connectivity e.g. secure GPRS access.

The use of old operating systems on the desktop, such as Windows 95 and 98,poses a serious security ness. These operating systems allow users to bypasslogon and also to refuse updates to virus patterns, operating system patchesetc. It is important that such weaknesses in the Council’s security are resolvedwithout delay.

Adherence to change management procedures as defined in the security policy isunsatisfactory within WCC.The approach of application selection and procurement at departmental leveland security at corporate level may be an explanation for this. Within its




• Does the application share data, supply data to or extract data fromother WCC applications, and if so what are the implications for boththe new applications and the applications to which it interfaces?

Such issues, which fundamentally impact on the security regime, need to beconsidered at an early stage of the project. The current situation where they areconsidered shortly before or at implementation is untenable and presents asevere risk to WCC’s overall security.Policies introduced and implemented corporately should ensure that ChangeManagement has this priority by becoming a “tick box” within the early stagesof ICT related project.

66..88 TTeelleepphhoonn y y aanndd CCoommmmuunniiccaattiioonnss

The Mitel system at County Hall has been in use for several years. It is veryreliable and has been regularly updated to ensure that the system meets the upto date functionality requirements. The modular design of the Mitel equipmentmeans that is can easily be upgraded and enhanced as the Council’s businessneeds change and new technologies are developed. The SX6000 lite switch iscurrently being enhanced for the Call Centre.

Outside County Hall, a number of Departmental systems are in use, primarilyfrom BT. A new Panasonic System is being implemented by MidlandTechnologies at Salisbury Library to meet the new one-stop shop requirements.This provides 8 ISDN trunks (which will also service Video Conferencing betweenSalisbury and County Hall) and 20 extensions.

WCC has a leased line Voice Network from County Hall covering Police

(extending to Fire) and some District Council offices. These are provided using amixture of Analogue Circuits and FeatureNet. The link to North Wilshire DC hasbeen ceased because their new IP Telephony solution is incompatible withWCC’s PABX. Other links are being reviewed due to cost and usage levels.There is no “on network” voice network between County Council offices as it hasbeen considered that standard dialled voice calls are cheaper than rentingprivate circuits.

e-Government will necessarily change the way in which the Council works,placing much greater emphasis on delivering a comprehensive and seamlessaccess solution to the Council’s customers. It is anticipated that a high volumeof incoming telephone traffic will ultimately be routed through the call centre inthe first instance; the call centre will then transfer calls that they cannot handle




office circuits, and can even be extended using business-quality8 ADSLconnections to workers’ homes.

Solutions in the IP Telephony market fall into two categories:

• Telephone services provided on routers which will also allow dataconnections; the prime example of this is the Cisco IP Telephonysolution where a connection to a router can be configured as eithervoice or data, and the latest family of routers even provide therequisite in-line power for the telephone handsets.

• Enhancement of existing telephone systems (including Mitel, Ericsson,

Nortel, etc) to use IP Telephony for either direct connectivity toextensions or to provide inter-switch links between offices. This optionis often seen as lower risk, since the IP Telephony service operates inparallel with the legacy service, but offers less flexibility and increasedcosts as telephony as well as data-router equipment is usuallyrequired at each site.

WCC need to undertake an exercise to consider both options, using pilotprojects where appropriate to determine which solution best meets theirrequirements.

IP Telephony requires the implementation of “Quality of Service” (QoS) on thenetwork. This ensures that good speech quality can be maintained fortelephone calls, and is particularly important at times when the network isheavily loaded. MetroVPN can provide this QoS functionality, but at a cost, and

WCC are encouraged to include in their feasibility planning for this serviceestimates which will fulfil the IP Telephony requirements.

By implementing IP telephony, voice and data will share the same networkinfrastructure. In order to develop these and provide coherent managementand support, it is important that the voice and data networks are managed as asingle entity.

Within the aims and ambitions of the e-Government programme, WCC wish toprovide single interfaces for customers to access the services of complimentarypublic sector services in the region. In particular, it has been identified that onestop shops, such as the one now being implemented at Salisbury Library, shouldbe capable of assisting customers with both County and District Council


T l i ti M bil (GTM) F k hi h id bli t



Telecommunications Mobile (GTM) Framework which provides public sectororganisations with access to a wide range of mobile voice, paging and dataservices from Vodafone and Orange. Such contracts allow Local Authorities toreduce the capital and revenue costs of their mobile telephone network and todeploy technologies which allow seamless integration with their PABX (fixed line)voice network. As a voice telephony strategy is developed, a review of mobiletelephony should be incorporated to ensure that both media are used tomaximum business advantage.

Telephony is becoming an increasingly essential instrument within day to day

business processes. Without the telephone it is impossible to operate as“business as usual”, and even short disruptions to service will create difficulties.More and more contact from the Council’s customers is by telephone, and theimplementation of a call centre which can more efficiently answer and processcalls is likely to further increase this percentage.

It is essential that all telephone services have high availability, and resilience is ofthe essence. Telephone services needs to be considered as part of the

Council’s Disaster Recovery and Business Continuity Planning .

There are many cables, both voice and data, running in WCC’s trunking acrossthe road between the County Hall and the Library site on the opposite side ofthe road; this presents a serious risk if this trunking became damaged e.g.through road works.

WCC needs to consider its video conferencing requirements. The use of ISDN

based videoconferencing, unless required because of limitations of third partieswith whom the Council needs to communicate, should be avoided as it isexpensive. The use of IP based videoconferencing equipment, which uses anupgraded WAN infrastructure, should be pursued.

66..99 CCoossttiinngg tthhee TTaaccttiiccaall , , SShhoorrtt tteerrmm aanndd MMeeddiiuumm tteerrmm ppllaann

Attached as appendix C to this strategy document is a tactical, short term andmedium term plan.The plan outlines a number of key infrastructure and policy actions that arerequired to take place over the next three years based on achieving key targetswithin a six month time frame moving through to 12 months, 24 months etc.Each phase represents a dependency on the next phase of work in other wordsthe actions are sequential (but in some areas may overlap) and are based on:


The aim of table 1 is to give the Council an approximate view of the likely cost of



The aim of table 1 is to give the Council an approximate view of the likely cost ofthe overall programme for high level planning purposes.No account has been taken of funding sources and a number of the actionshave already been wholly or partially budgeted for, where this is the case thishas been indicated.

Table 1

Tactical 6-12 months £000s

Capital

expenditure

Additional

ongoing

1 Wide area network 200 300

2 Big Box 400 100

3 Desk top 125

4 Server 120

5 Network switches 200

6 Financial systems 50

7 Document management 250 50

8 Libraries 300

Sub Total £1.645 million £450,000

Short term 12-24 months £000s

1 Big Box 150 100

2 Wide area network 50 500

3 Corporate policies 35

4 Information sharing 40

5 Mobile computing 30

6 Help desk N/A




Costs in 3 4 and 5 relate to specialist consultancy services



Costs in 3, 4, and 5 relate to specialist consultancy services.Costs in respect of 8)(Financial systems), cover licences, hardware, training andproject management in respect of a replacement for APTOS based on a best of

breed approach.On going costs are estimated at 15% of anticipated licensing costs of £500k.It has not been possible to cost 6) (Help Desk), due to the interdependence withthe Vivista contract and any future arrangements in this regard.Costs in respect of 7)(Desktop), relate to the replacement of Windows 98 PCsahead of the leasing programme, the second and final tranche for this elementof the action plan is in the medium term phase.

Medium term

It has not been possible to cost actions 6 and 7 (Disaster recovery and Mobiletelephony) at this stage due to the high number of variables and dependencieswhich will become clearer after the various feasibility studies.




SSeeccttiioonn 77 IInnffrraassttrruuccttuurree RReeccoommmmeennddaattiioonnss


The Council should:

• Conduct a feasibility study to ensure that MetroVPN can be successfullyrolled out throughout the Council’s geography and that it has sufficientresources to complete and sustain the project.

• A detailed project plan to rollout MetroVPN to all WCC offices within a 12-18 month timeframe should be established.

• Facilities for mobile and home working should be made available throughthe use of MetroVPN at an early stage in the project’s implementation.

• WCC should establish a “Refresh Policy” which ensures that operating

systems on servers are updated every three to four years. This not onlyeliminates the risk that WCC may be unable to obtain support for systems,but also allows WCC to proceed with new initiatives which may rely oncurrent operating system levels.

• An analysis of requirements for testing should be made, and fundingshould be made available for the procurement of these servers.

• The NCC Group endorses the current strategy to roll out “The Big Box”project to rationalise server and storage capabilities. However theinstallation of this infrastructure within the County Hall campus should beseen as the initial phase of a corporate project to provide equal serverand storage facilities across the whole of the Council.

• The life of all equipment which forms part of WCC’s corporate ICTinfrastructure should be considered and a financial model should beconstructed which creates the necessary budgets to refresh equipmentbefore it becomes life-expired.

• A corporate strategy for the deployment of Thin Client architectureh ld b d t i d d f ll d i ll t


• The process of rationalising the number of images in use needs to be



p g gcontinued.

• The capacity for Vivista to build PCs needs to be increased.

• It is essential for WCC to create a central Asset Register which robustlylogs PCs in use, and reliably records devices which enter and leaveservice and also records changes to use where these affect licensing,location, support, etc.

• A Change Management process which supports the Asset Register shouldbe implemented corporately. This process should also underpin WCC’srecords of Licensed Software in use, to ensure that there is compliancewith licensing conditions.

• WCC must be able to independently verify the number of PCs in use, andhence the charging mechanism for the Vivista contract.

•

A Printer Strategy which encourages the use of cost-efficient networkprinters and refresh of outdated devices should be establishedcorporately.

• WCC needs to create a policy which is supported by appropriate third-party contracts to provide ICT equipment to homeworkers and to supportthis equipment.

• The Help Desk processes need to become more efficient by ensuring thatthe maximum number of calls can be answered by first-line staff and theon-site staff are free to deal with issues which necessitate their attention.

• WCC needs to consider the various aspects of Mobile Computing anddeploy the technologies to support these where there is a businessdemand for their provision. Amendments are needed to the securitypolicy commensurate with these requirements.

• With the rationalisation of Desktop operating systems, WCC should alsorationalise the versions of Microsoft Office in use.

• All users should be encouraged to undertake training in both basic and




• An e-mail archiving system should be introduced to allow users to saveand share business information which has been sent to them using this

medium.

• E-mail restrictions need to be reviewed in the light of business need.

• E-mail issues need to be addressed across the whole Council.

• A policy for the use of e mail should be developed.

• Workflow tools, possibly linked with CRM, should be introduced to helpstaff deal with the processing of e mail correspondence.

• It is important that information can be shared electronically betweencolleagues, including those working at various WCC locations and thosewho are mobile or are working from home. The Intranet provides an idealplatform this, and it is use for both publishing and finding informationshould be encouraged at corporate, department and workgroup levels.

• Applications must be funded to ensure that:-

-the maximum benefit can be taken from the applications and thus theCouncil is obtaining the maximum return on its investment;-applications are kept up to date and compatible with the latest server,network and desktop operating systems and strategies.

• WCC need to set a corporate standard which means that all newapplications must be capable of being run across the WAN, therebyremoving this element of the “Digital Divide”.

• There must be a mechanism to improve corporate infrastructure tostandards required by departments to run specific applications whichdemand additional capacity; this may involve a method of somedepartment funding be made available to corporate, e.g. to fund

additional WAN bandwidth for specific purposes.

• WCC need to instigate a project to update the Financial Systems, and toconsider various options including updating current software, acquiring anew “best of breed” package or procuring an Enterprise (ERP) system




AAppppeennddiixx AA IICCTT SSeerrvviiccee aanndd OOppeerraattiioonnaall SSuuppppoorrtt



A Appppeennddii x x A A IICCTT SSeerrvviiccee aanndd OOppeerraattiioonnaall SSuuppppoorrtt

SummaryWe compared the Council’s ICT management processes against 21 world-classstandards using a traffic light system where:

• A green light means that the Council has implemented much of theprocess and there is little point in further implementing this process.

•

An amber light means that the Council has implemented some of theprocess, but there is further effort needed to maximise the value-for-money that this process can deliver, whilst minimising the risks faced bythe Council.

• A red light means the Council has not implemented the process, orimplemented it inappropriately, and there is an opportunity to improvevalue-for-money and reduce risk through implementing the process.

We found that only one of the areas we examined secured a ‘green light’ andthat related to Vivista. We scored 17 areas as ‘amber’ and three areas as ‘red’.

The areas scoring ‘red’ have common characteristics: They relate to thefragmented nature of ICT investments – mostly department funded resulting ininsufficient attention being given to scalability, fault tolerance, disaster recovery,and a long-term view on the costs and benefits of the investment.

The areas scoring ‘amber’ relate to the general propensity to ‘firefight’ ratherthan make strategic investments which will reduce the long-term workload. Thisincludes such functions as asset management, fault tolerance, the enforcementof standardisation, capacity management and change management.

Introduction to the Section

The processes which are used to deliver IT have an important impact onoperating costs. For example, making use of technologies which allow IT supportstaff to solve problems using remote control tools makes those staff moreefficient since the need to personally visit end-users can be eliminated.


Wilt hi ’ P iti



Wiltshire’s PositionOur assessment of the processes and the extent to which they have been

implemented in Wiltshire are outlined in the table below.

Process Good practice Position at Wiltshire

Asset Inventory Non-automated inventories are 20%inaccurate on average, resulting in mis-statements within accounting data,increased losses due to theft, mis-allocation of assets, and incorrect taxreporting on IT assets. Using asset

inventory, these problems can bereduced or eliminated. As well, up to50% of each help desk call is spent onunderstanding the hardware andsoftware configuration. Call time can bereduced by providing access to theinventory data to the help desk supportpersonnel.

aAn automated Asset Inventory Tool –Centennial is currently being used by Vivista

which covers all networked assets. There isalso a paper-based system, which utilises aChange Control procedure. Greateradherence to this procedure would improvecontrol mechanisms.

Virus

protection andelimination

With the proliferation of data sharing via

e-mail and the WWW, the chances ofvirus infection has increaseddramatically. New viruses infect systems,documents and even cells inspreadsheets. Virus detection andelimination helps to maintain userproductivity and eliminate costlyadministration labour in repairing virusinfections.Viruses can take up to 14 person hours to

eliminate from a network and cause 4hours of downtime for each infectedmachine. An organisation with 1000computers is expected to encounter atleast seven infections over a 12 monthperiod. A proper virus protection planand tools minimises the risk of infectionsand provides a means to more quicklyrecover should an infection occur.

aEmail - There are currently 3 layers ofinterception. Mailsweeper consists of adouble layer of Sophos and Command. TheExchange Servers have Groupshield.

Internet – There are currently 2 layers ofinterception. Sophos and Command on the

Websweepers.

All networked client machines and serversare protected by regular automatedSophos updates via the network.

Standalone client machines are updatedmanually by users via a monthly CD – andthis is a key ness.

Centralisednetwork anddesktopmanagement

By implementing network managementproducts and centralising themanagement of performanceinformation and alerting, administratorscan better set policies pro-actively

aThere is centralised network management



Centralised By consolidating calls to a central



Centralisedhelp desk,supportknowledgebase, andremote control

By consolidating calls to a centrallocation economies of scale in thesupport centre can be achieved.Problems are better centrally trackedwith common problems being identifiedand pro-actively eliminated. Combinedwith an inventory system that can displayconfigurations of the system havingissues and a desktop remote controlcapability, the help desk can bedramatically improved, reducing theduration of calls by 50-70%, and

reducing call frequency.Be aware however that help desksupport needs to continually monitorservice levels to assure performance. Inmost organisations, help desks do notprovide adequate knowledge andresponse times to meet userexpectations. Users then turn to peers forsupport.

aA central service desk infrastructure is inplace, using Remedy as a call loggingsystem. The service desk provides first linesupport and also has the responsibility of callclosure. Various reports and metrics areavailable i.e. Trend Analysis. There is an SLAcurrently in place. Proxy and Damewaresoftware is used for remote control.

ScalableArchitecture Business is continually changing andcompetition continually increases. As aresult, the organisation you managetoday is not the same one you manageda year ago. It is vital, in order to reducethe cost of keeping up with change, thatyou develop an architecture thatprovides for scalability and flexibility tomeet the ever changing business needs.Re-engineering of the infrastructure on a

continuous basis is costly. Select anarchitecture that is scalable to reduceoverall change costs.

aThe Council’s approach of devolvedbudgets makes it extremely difficult todevelop a scalable architecture.

In order to achieve further centralisation ofservices, the first stage will be the creation of

a network infrastructure that can deliver therequired bandwidth to all sites. Only thencan services be centralised and rationalised.

ComponentApplicationSoftware

Similar to a scalable architecture, it isimportant to create a scalableapplication development environment,one which can quickly deliver initialproducts, build to meet growing business

needs, and flexible enough to meetchanging business requirements.

aThe fragmented nature of ICT investments

means that the Council does not seek todeploy re-usable components. Howevergiven that the majority of ICT applicationsare packages, this is not a major issue atpresent.



Fault tolerant If end-to-end network resources were



Fault tolerantsystems andnetwork

If end to end network resources wereavailable 96% of the time (better up-timethan most networks experience) a 300user network could still be faced withlosses of £500,000 each year. Thismanifests itself in lost productivity, theinability for users to accomplish theirwork, and lost revenue, the bottom linerevenue impact of not being able toperform mission critical transactions. Afault tolerant network that implementsfault tolerant storage (RAID), servers and

network components can increaseuptime and eliminate costly resources.

aThe core network is managed by a Vivistaand resources are available 100% during thecore working hours. The actual coreworking hours are 8am – 6pm Monday toFriday. Automated monitoring and alertingis in place using BMC Patrol enterprisemanagement applications.

The wide-area network is the main area ofconcern, and it requires significantinvestment if it is to become ‘fit for purpose’for a modern authority.

Policy-basedmanagement

Implementing policy-basedmanagement limits the access of usersto specific applications, data, andsystem control needed for their jobs. Bylimiting the users to just the right amount

of computing power, management andsupport costs are reduced, whileproductivity and scalability ismaintained. Policies eliminates much ofthe end user IT costs by providing asystem that does not allow users toaccess applications for which they arenot trained and minimises systemchanges.

aA policy based management system is in

place within the Peoples Networkinfrastructure, which supports the libraries it isnot in place elsewhere within system.However an Active Directory environmentwould be required within the corporateenvironment of WCC if a full policy basedsystem was to be implemented.

The presence of Windows 95 based PCs alsolimits this functionality.

There are further opportunities to reduce therisk of user errors causing widespreadproblems through greater use of policybased management and desktoplockdown.

Standardiseddesktops andnetwork

A standardised desktop platform andnetwork architecture will allow foreconomies of scale in purchasing,

support, and management. Purchasingcan be performed in volume to getbetter pricing. Components can bequickly replaced because they areswappable and spares can easily bemade available. Support and

aA standardised desktop is in place within theAD Peoples Network environment only.

A standardised desktop platform isrecommended for the WCC Corporate



Backup data Most organisations backup their server



pand plan fordisasters basedon a riskassessment

g pdata but do not backup clientinformation and rarely are prepared withcontinued operation or recovery plans inthe event a disaster strikes. Many keepthe backup tapes next to the serverbeing backed up … in a site disaster theserver and the tapes are both destroyed!A good disaster recovery plan includestested policies for data protection,emergency team formation andalternate site preparation and

procedures. Specialised consultants andservices are available to assist indeveloping and implementing theseplans.

r System data is backed up. WCC informVivista which Client/Application data onServers is backed up. Backup tapes arekept in safes between 2 buildings.

Disaster Recovery is not included within theFocus Contract.

The Council should develop a disasterrecovery plan based on an assessment ofthe risks it faces from the long-term loss of ITsystems and staff.

Better planningof projects

A better plan and up-front analysisavoids costly mistakes later. A teamoriented planning methodology providesstructure to the planning process. A planinvolves multiple members from

representative organisations withdefined roles, vision, scope and mostimportantly a method for identifying andmitigating risks. TCO management is oneplanning method that lets you plan ITfinances proactively by analysing issues,identifying trouble spots, and simulatingplans prior to improvements.

aFormal project management of IT projects is

undertaken using Prince 2 methodology.Training on the use of Prince 2 is welldeveloped with a high number ofpractitioners. Project boards are in place,development plans are communicated viathe Intranet and customer review meetingsare held.

This is let down by the lack of awareness ofdepartmental requirements who have their

own budgets to spend, and do not useproject management in the mannerintended.

The Council reported to SOCITM that only 5out of 7 recent projects were reviewed todetermine if any benefits had materialised.

Centralised

andstreamlinedpurchasingprocedures

The capital expenditures of computer

hardware and software can be greatlyimproved by centralising the purchasingof all assets, and obtaining maximumcost savings through volume license andhardware purchasing agreements.However centralised purchasing can

aThe Council does have centralisedpurchasing arrangements in place.However the use of devolved budgeting



Measured By reducing costs it is often the case that



service levels organisations do so at the expense ofservice to the business units and usersthey are supporting. As part of any costreducing projects that you implement,service levels should be monitored andminimum required service levels shouldbe established. A cost reducing programthat drops service levels beyond theminimums is one that should be re-considered establishing a written servicelevel agreement and monitoring the

quality of the delivered services isessential.

aThe performance of Vivista is monitoredregularly, and we are informed that KPIs aregenerally achieved. The were also told thatthe Council does not think the KPIs portraythe real end-user experience, and furtherwork to develop more meaningful KPIs isneeded.

Capacityplanning andloadbalancing

Adequate scaling of resources andallocation of computing power to meetuser and customer needs is essential. Toooften, resources are purchased andmanaged for capacities that may betoo low, or too high. This causes mis-appropriation of hardware and software

expenses, and worse, downtime or over-management of resources that areheavily taxed and are over-capacity. Bymonitoring the capacity andperformance requirements of thebusiness and users, resources can beallocated and maximised for needs.

r The fragmented approach to ICTprocurement at server level means that thescope of Capacity planning is limited.

Operational capacity planning is performedon disk utilisation, availability, memory andprocess utilisation. Automated monitoringand alerting is in place using BMC Patrol. Allmajor servers are continuously monitored forboth capacity and performance by Vivistawith regular analysis and recommendationsmade to the Council

Change

Managementand Control

Vendors and users are continually

putting pressure on the IT organisation forchange. This demand is only going toincrease over time. It is essential that anIT organisation realise that changedemands are continuous and put inplace a system to control and managechange in an orderly and plannedfashion, avoiding users from skirting thesystem to implement the systems and

applications they require because ITcan't keep up. It is key to embrace,manage and control change ratherthan fight it.

aA Change Management procedure wasimplemented by Vivista at the beginning ofthe contract and has been maintained to-date by Vivista. Greater adherence to thisprocedure by all parties is required.

Upfrontinvestments in

An organisation that invests more intechnology up-front can eliminate costly

a



Cycle Typical organisations attempt to hold



technology tomatch theuseful lifecycle

onto computer assets for as long aspossible. The extra expense oftroubleshooting, repairing, upgradingand maintaining older computer assetsfor many organisations far outweighs thebenefit of a four to five year lifecycle. Itis recommended that desktopcomputers should be replaced afterthree years and mobile computers bereplaced every 18-24 months. This extracapital expense will have returns in lower

administration and support expenses,and should yield gains in productivity asthe new PCs are able to run neweroperating systems and applications.Leasing is also a viable option to assurethat initial capital outlay is low, andtechnology is cycled on a continuousbasis to match the lifecycle. Manyleasing companies offer good rates,track assets, and include maintenancecontracts for minimal fees.

aWCC have a 3 year lifecycle on mostdesktops. However, there are certaindepartments within WCC where this is notdone, thus the ageing equipment causessupport issues for Vivista.

Some sections of the Council have noconcept of equipment life cycle. Hardware

purchases are treated as one off costs withno plans for replacement.

It must be accepted within the Council thatcomputer equipment has a finite life cycleand that planning for replacement is vital.

Softwareusagemonitoringand licensing

How many of the applications are reallybeing used by end users? Many ITprofessionals do not know who is usingthe installed software and how manylicenses are purchased that didn't needto be. By monitoring usage,consolidating the software, andnegotiating usage based licenses, you

can optimally purchase softwarelicenses and reduce software expenses.

aThe Vivista software inventory tool –Centennial performs software usagemonitoring on all networked units.

Licensing is not covered within the FocusContract.

TCO LifecycleManagement

By measuring TCO on a regular basis,tracking the cost issues, progress of costreductions, and verifying returns from ITinvestments you can optimise budgetsand spending.

r The fragmented nature of the Council’sserver infrastructure, a consequence of atactical approach to ICT investment

management, means that TCOmanagement is not achievable at present. End usertraining

Training is one of the most importantways to increase productivity andreduce both direct and indirect IT costs,particularly helpdesk and peer/self

a



IT training andtifi ti

Support personnel must be trained onth ti t t



certification the operating systems, computers,network and applications they aresupporting to adequately provide valueadded services. You should reviewcertifications and implement incentiveprograms to increase the number ofcertified team members.When outsourcing of applicationplatform and operating system rollouts,skills that are gained during theseexperiences are not transferred to the

help desk and administration staff. It isvital to re-tool skills as the networkchanges and to be sure that outsourcingis performed in a cooperative way toassure knowledge transfer.

gVivista encourages and supports ITAccreditation. There are currently 5 MCSEAccredited Engineers and an ITILAccredited Contract Manager on-site.An ITIL programme is being put in place toensure industry best practice guidelines arefollowed.

IT SecurityPolicy

Implementation of BS7799/BS17799policy, procedures and controls.

gPolicy and procedures implementedcorporately together with e-mail, intranetand computer usage policy. Risk Register

i i i


Recommendations



The Council should take action to address the areas above which were assessed as ‘red’

and ‘amber’.


AAppppeennddiixx BB AAccttiioonn PPllaann



A Appppeennddii x x BB AAccttiioonn PPllaann

In support of the ICT strategy an action plan framework has been developed to assistthe Council in determining its priorities and processes for future action this is detailedbelow.Priority= High/Medium /LowTimescales=Tactical 6-12 months

Short term 12-24 months

Medium term 24-36 months

Action Priority Owner Target date

The Council should review its ICTspending and staffing levels when

formulating its long-term financialstrategy.

H CPG Tactical(T)

The Council should review its ICTrecharging policy to ensure that it is

equitable and within the BVACOPguidelines.

M CountyTreasurer(CT)

Short Term(ST)

Adopt an ‘enterprise architecture’where information can be shared,and single instances of corporateapplications fulfil the Council’sadministrative needs.

M CT ST

Create a senior second-tier post with

overall responsibility for ICTmanagement and governance.

H CPG T

Consider if some form of partnershipwith the private sector would bebeneficial in helping to meet theCouncil’s investment needs.

M CPG ST

Develop a corporate ICT strategy witha rolling five-year funding horizon.

M CPG ST

Define technical informationarchitecture as part of the corporateICT strategy.

M CT ST

Define core standards as part of thecorporate ICT strategy and ensurethese are communicated and

M CT ST



Centralise ICT budgets so thatinvestments are made for the

H CPG T



investments are made for the

‘corporate good’ rather than for thebenefit of a single department.

Develop communications capabilityas part of the corporate ICT strategydevelopment process.

M CT ST

Develop a process to measure usersatisfaction systematically.

M CT ST

Maximise the benefit of riskmanagement by ensuring that the

corporate ICT strategy includes therequirement for regular considerationof the risks it faces.

H CT T

Ensure that the corporate ICT strategyrequires formal project managementprocesses to be enforced.

M CT ST

Conduct a feasibility study to ensurethat MetroVPN can be successfully

rolled out throughout the Council’sgeography and that it has sufficient

resources to complete and sustain theproject.

H CT T

A review of the basic trainingrequirements of end users should beundertaken as part of an agreed

overall corporate strategy for ICTtraining.

M CT ST

A detailed project plan to rolloutMetroVPN to all WCC offices within a12-18 month timeframe should be

established.

M CT ST

Facilities for mobile and home workingshould be made available throughthe use of MetroVPN at an early stagein the project’s implementation.

M CT ST

Establish a “Refresh Policy” whichensures that operating systems onservers are updated every three tofour years.

H CT T

An analysis of requirements for testing H CT T



WCC should establish, at the earliestavailable opportunity a project to

H CT T



available opportunity, a project to

implement Active Directory, includingthe required upgrades to otherelements of the infrastructure.

WCC must ensure that a refresh policywhich ensures that all PCs are running(and are fit to run) either the currentor “current minus one” version of theMicrosoft Windows operating system.

H CT T

The process of rationalising the

number of images in use needs to becontinued.

H CT T

The capacity for Vivista to build PCsneeds to be increased.

H CT T

It is essential for WCC to create acentral Asset Register which robustlylogs PCs in use, and reliably recordsdevices which enter and leave

service and also records changes touse where these affect licensing,location, support, etc.

H CT T

A Change Management processwhich supports the Asset Registershould be implemented corporately.This process should also underpinWCC’s records of Licensed Softwarein use, to ensure that there iscompliance with licensing conditions.

H CT T

WCC must be able to independentlyverify the number of PCs in use, andhence the charging mechanism for

the Vivista contract.

H CT T

A Printer Strategy which encouragesthe use of cost-efficient networkprinters and refresh of outdated

devices should be establishedcorporately.

M CT ST

Create a policy which is supported byappropriate third-party contracts toprovide ICT equipment to

M CT ST



WCC needs to consider the variousaspects of Mobile Computing and

M CT ST



aspects of Mobile Computing and

deploy the technologies to supportthese where there is a businessdemand for their provision.Amendments are needed to thesecurity policy commensurate withthese requirements.

With the rationalisation of Desktopoperating systems recommended at1.4.1, WCC should also rationalise the

versions of Microsoft Office in use.

H CT ST

Training in both basic and advanced

Office functionality should beavailable to all users.

M CT ST

Desktop products should beimplemented to promote informationsharing. This may not only impact onhow applications are implemented,

but also on training and otherinfrastructure issues such as server andnetwork strategies.

H CT T

Wherever possible users should beencouraged to have applicationsdesigned by ICT professionals, toensure that software is both robustand secure, and follows corporatestandards for ICT.

H CT T

An e-mail archiving system should beintroduced to allow users to save andshare business information which hasbeen sent to them using this medium.

H CT T

E-mail restrictions need to bereviewed in the light of business need.

H CT T

E-mail issues need to be addressedacross the whole Council.

H CT T

A policy for the use of e mail shouldbe developed.

H CT T

Workflow tools, possibly linked withCRM, should be introduced to help

staff deal with the processing of e

M CT T



WCC need to set a corporatestandard which means that all new

M CT ST



applications must be capable ofbeing run across the WAN, therebyremoving this element of the “DigitalDivide”.

There must be a mechanism toimprove corporate infrastructure tostandards required by departments torun specific applications whichdemand additional capacity; this

may involve a method of somedepartment funding be made

available to corporate, e.g. to fundadditional WAN bandwidth forspecific purposes.

M CT ST

WCC need to instigate a project toupdate the Financial Systems, and to

consider various options including

updating current software, acquiringa new “best of breed” package orprocuring an Enterprise (ERP) system.

H CT T

There needs to be better

communication between the e-Government team and thedepartmental ICT Coordinators. e-Government “cross cuts” all of theCouncil’s businesses and it is

important that WCC have a joined-upapproach to providing all elements ofe-Government including CRM andother such initiatives.

H CT/CPG T

There needs to be better liaisonbetween the e Government team

and the Departments to ensure thattechnologies can be used to

maximum advantage. In particularthere needs to be greaterunderstanding of how e Governmenttechnologies will integrate with

existing Line of Business applications.

H CT/CPG T



Security needs to be implemented toa common standard across the entire

H CT ST



Council.A more thorough approach toDisaster Recovery and BusinessContinuity Processing is required, usinga robust risk assessment of ICTinfrastructure and systems at all WCCsites.

H CT T

A robust Change Management

regime which considers all securityaspects needs to be driven from thecorporate centre and implementedthroughout the Council.

H CT T

WCC need to develop a strategy toallow the provision of a coherenttelephone infrastructure which willextend across all outlying offices and

should include facilities for homeworking.

H CT/CPG T

In the short/medium term, WCCshould provide integration betweentheir fixed line and mobile voicenetworks.

M CT/CPG ST

A disaster recovery plan is required for

the Voice service in advance ofdeveloping full Disaster recovery

policies within the context of businesscontinuity planning.

H CT/CPG T

A strategy to use IP technology for the

delivery of videoconferencingservices should be pursued.

M CT/CPG M

Take action to address all areasidentified as Red and Amber in reviewof 21 world class standards.

H CT ST/M


A Appppeennddii x x CC TTaaccttiiccaall//SShhoorrtt TTeerrmm aanndd MMeeddiiuumm TTeerrmm PPrroo j jeecctt PPllaann



1. Telephony: Pilot IPTelephony; CommonCouncil-WideTelephone System

2. Big Box: ServerRationalisation at allsites

3. Video-conferencing:Trial IP based services

4. E-mail: Introduce e-mail archiving,sharing, workflow andusage policy

5. Server: Update to

Current version ofExchange; ImplementDirectory Services

6. Disaster Recovery

and Business Continuity Planning:Develop policies

7. Homeworking:Determine howequipment will besupplied andsupported

8. Mobile telephony:Integration betweenfixed line and mobile

1. Big Box: County HallSAN

2. Corporate Policies:Develop Strategies

• Server/Desktoprefresh

• Line of BusinessApplication refresh

• Asset Register• Change

Management• Thin Client• Printer Strategy• Use of HR system

3. Information Sharing:

Create anenvironment (serversand applications) toallow informationsharing

4. Mobile Computing:Develop facilities formobile users

5. Help Desk : Introduce

Efficiencies6. Desktop: Provide

training in basic andadvance Officefunctionality

1. Wide Area Network:

MetroVPN FeasibilityStudy, ProjectPlanning & Initial RollOut, including VPNaccess

2. Desktop:• Rationalise images• Eliminate Windows

95/98• Rationalise versions of

Office in use• Increase capacity to

build new PCs

3. Server: Eliminate old

operating systems

4. Financial Systems:Determine how these

should be upgraded

24 - 36

months

12 – 24

months

6 – 12

months

MediumTerm

ShortTerm

Tactical

P R O G R A M M

A N A G E M E N T


A Appppeennddii x x DD GGlloossssaarryy



I.S.P. Internet service provider-A supplier of internet based servicessuch as BT or Pipex

S.A.N. Storage area network-A high speed network which connects anumber of high-speed storage devices (disks) with associateddata and application servers.

The SAN is the key component of Wiltshire’s “Big Box” project,

which will consolidate a large number of individual serversscattered across the Council’s offices into a consolidated, high-specification, resilient rack-mounted server and disk arraylocated at the County Hall campus and accessible by all usersthroughout the Council.

Broadband High speed communications lines which allows the fasttransmission of information between locations within the Counciland with external partners. Broadband allows a rich variety of

communications traffic to be processed including data, voicepictures, video conferencing, etc.

V.P.N. Virtual Private Network. The VPN provides a secure method toallow any authorized user to connect a PC to the Council’snetwork from an external connection, e.g. from home or from ahotel room. Connections are made using standardcommunications technology, e.g. an Internet link. Theinformation sent and received is protected by employing a

number of secure protocols within the VPN.

A.D.S.L. Asymmetric Digital Subscriber Line- A remote access technologythat takes advantage of the existing network telephonyinfrastructure but improves performance by a magnitude inexcess of 20 times. Based on using existing copper grade cable.

C.R.M. Customer (or citizen) relationship management-CRM is a seriesof techniques and technologies designed to allow organizations

to easily gain a holistic view of its customers/citizens. At the heartof the technology is a specialist software package which whenlinked to other back office systems will allow a complete picture

of all transactions to be developed. Customers are required tosubmit details once, which can then be used for a number of


I.P. IP –Internet Protocol, the protocol used for transmitting dataover the Internet and also in common use for the transmission ofdata across WAN and LAN and voice using VoIP, see above.



Q.o.S. Quality of Service refers to the priority given to various differentcommunications traffic on a WAN. For example, voice, data,CCTV and video conferencing may all be transmitted using thesame WAN, but require different treatment to ensure that itsquality is maintained. This is achieved by implementing QoS onthe WAN which will apply the necessary prioritisation.

WiFi Wireless technology used in mobile computing utilising toconnect PCs and other devices to the LAN

G.P.R.S. General Packet Radio Service allows data to be transmitted ata high speed over traditional (2G) mobile phone networks.

E.R.P. Enterprise Resource Planning-The name given to organizationwide integrated business applications dealing with the keyaspects of the organization such as Human Resources, Payroll,Finance, Assets ,CRM ,Procurement, Performance Managementetc.

These applications are sometimes referred to as Tier 1 solutionsand are one application (from a technical aspect) with a seriesof tightly integrated modules. Common information such asnames and property address are Shared between functions.These applications are underpinned by a range of mandatorybusiness processes and are accessible across the network toremote users. The two leading suppliers to local Government areSAP and Oracle; both these products also contain Portal

functionality.Enterprisearchitecture

The term used to describe the practice of holding one instanceof Corporate applications such as time keeping or payments.This prevents the duplication of this functionality across theorganization and allows the organization to have an accuratetimely and shared view of its key assets e.g. people and finance.ERP is one way of achieving this but it can also be achievedusing a best of breed approach underpinned by strict corporate

standards and business processes.Corporateapplications

Generally taken to mean application used by or for alldepartments within the Council e.g. Human resources, Payroll,Finance as opposed to applications used by discretedepartments such as Social services and CareFirst


protocols and internet based languages are not.

Community Portal Internet based site which acts as a gateway to Council andother locally based services.



y

Servers Central systems which provide processing resource, e.g.controlling the databases used by corporate applications

Routers, Switchesand Hubs

Network equipment within the LAN/WAN which routescommunication across the corporate network




Version 0.3- 82 -

A Appppeennddii x x EE EEnntteerrpprriissee AArrcchhiitteeccttuurree aanndd MMiiddddlleewwaarree

wiltshire by ncc 2004 _ ict strategy

Documents