Agenda and minutes

To confirm the appointment of the Chair for the meeting.

In accordance with Section 10 of the Joint Committee Terms of Reference the Chair should rotate between the appointed members from each Council at each meeting.  As this meeting is being hosted by the London Borough of Southark the practice is for the Chair of the meeting to be appointed from the membership of that authority.

RESOLVED that in accordance with Section 10 of the Joint Committee’s Terms of Reference, Councillor Stephanie Cryan (as representative of the hosting Authority – London Borough of Southwark) be appointed as Chair for the duration of the meeting.

An apology for absence was received from Councillor James Walsh (London Borough Lewisham).

No other apologies were received at the meeting.

Members are invited to declare at this stage of the meeting, the nature and existence of any relevant disclosable pecuniary, personal or prejudicial interests in the items on this agenda and to specify the item(s) to which they relate.

There were no declarations of interest declared by Members at the meeting.

To approve the minutes of the previous meeting held on Tuesday 19 March 2024 as a correct record.

RESOLVED that the minutes of the previous meeting of the Joint Committee of the London Boroughs of Brent, Lewisham and Southwark held on Tuesday 19 March 2024 be approved as a correct record.

No deputations or requests to speak were received at the meeting.

This report provides an update on the performance of the Shared ICT Service.

Fabio Negro (Managing Director Shared Technology Services) introduced the report to the Joint Committee providing an update on key performance areas in relation to the Shared Technology Service (STS).

Members noted the summary of key performance management indicators for the service across all three Council’s, which had been included within the report and in terms of detailed service performance, the Joint Committee were advised of the following:

·            Whilst progress continued to be made in the overall reduction of open STS operational calls, there had been an increase in the current reporting period (July – October 2024).

·            In the current reporting period (July – October 24) there had been eight Priority 1 incidents related to STS infrastructure, six of which had been resolved within SLA, with six application/supplier related P1 incidents.

·            P3 incidents remained the most common type of incident, as these were related to issues experienced by individual users. The target SLA was to resolve 90% of P3 incidents within two working days.  13,667 P3 incidents had been logged into STS operational queues by partner councils during this reporting period, with an overall SLA performance of 82% (compared with 87% in the previous reporting period) and the top eight categories for P3 calls detailed in section 4.8.4 of the report.  This had coincided with an overall increase in demand during the reporting period, with the STS having seen around 850 calls more per month logged than in the previous reporting period and the majority of these being classified as P3 incidents.

·            Priority 4 incidents were defined as requests for standard service or catalogue item.  The standard SLA was to resolve 80% within 5 working days.  In the current reporting period, there had been 10,137 P4 requests logged into STS operational queues, with an overall SLA performance of 90% compared with the previous reporting period figure of 93%. Whilst noting that SLA performance had dropped slightly, members recognised this has been impacted by the increased number of P3 incidents with the top call logging categories for STS operational P4 requests detailed in section 4.9.3 of the report.

·            The impact of the higher level of demand on operational services, such as the upgrading of servers (Windows 2012), the rollout of Office 365 applications across the councils, emergency planning, and resilience exercises, high-level of infrastructure change and ageing laptop fleet as further context in relation to the overall level of P3 & P4 performance.

·            The detailed provided within section 4.3 of the report on the number of open calls currently in STS operational queues. Whilst progress continued to be made in the overall reduction of open STS operational calls, it was noted there had been an increase during the current reporting period (July – October 2024) which reflected the demand in terms of tickets raised in STS operational queues arising from the high level of change across all three councils and change-related issues.

·            The ongoing focus on the customer experience including the development of on-site and telephone support with the overall number of calls  ...  view the full minutes text for item 6.

To note the remaining programme of date(s) scheduled for meeting of the Joint Committee during 2023/24, as follows:

·            Tuesday 18 March 2025 at 6pm – to be held online chaired by the London Borough of Lewisham.

Members noted the following dates scheduled for future meetings of the Joint Committee during 2024-25 Municipal Year:

·            Tuesday 18 March 2025 at 6pm – to be held online chaired by the London Borough of Brent.

None identified.

To consider the exclusion of the press and public from the remainder of the meeting as the remaining report to be considered contains the following category of exempt information as specified in Paragraph 3, Part 1 Schedule 12A of the Local Government Act 1972, namely:

“Information relating to the financial or business affairs of any particular person (including the authority holding that information)"

At this stage in proceedings the Chair advised that she intended to move into closed session for the remainder of the meeting in order to consider a separate report for the Joint Committee providing updates on the Cyber Security status, threats, and mitigations in relation to the Shared Technology Services (STS).

Given the commercially sensitive nature of the details contained within the update, the Joint Committee were advised that the report would need to be considered in closed session which would require the Joint Committee to pass a formal resolution excluding the press and public for consideration of the item.

It was therefore AGREED that that under Section 100A (4) of the Government Act 1972 the press and public be excluded from the remainder of the meeting for consideration of the following item on the grounds that it would involve the disclosure of exempt information as defined in paragraph 3 (information relating to the financial or business affairs of any particular person, including the authority holding that information) of Part 1 of Schedule 12A of the Act (as amended).

This report provides an update on the Cyber Security status, threats, and mitigations identified in relation to the Shared Technology Services.

Fabio Negro (Managing Director - Shared Technology Services) then introduced the update report in relation to Cyber Security status, threats, and mitigations for the Shared Technology Service (STS).  In considering the report members noted:

·            The outline of events impacting on STS along with an update on current threats and mitigating actions in relation to the following key areas of activity as detailed within section 3-7 of the report – Defend, Deter, Develop and React.

·            The outline of future plans being developed in relation to the STS Cyber Security Strategy, as detailed within section 8 of the report, which had included a project focussed on future laptop design (now in delivery phase) as well as work to develop the plans for implementation of Microsoft's biometric authentication method for logging into devices and replace current web-filtering solutions.

The Chair thanked Fabio Negro for his update with additional clarification provided for members in relation to the following issues raised:

·            The background and resolution of recent cyber security events impacting on the STS across each borough, including the costs and resources involved in dealing with incidents.

·            The approach being developed towards the use of biometrics as a potential security feature across individual partner authorities, on which a further update was requested at a future meeting of the Joint Committee including proposals for an appropriate communication plans.

·            The approach being developed to monitor the evolving nature of risks and threats and ensure the necessary mitigations and business continuity and resilience arrangements were place across each partner authority, as part of their incident response planning process.

As no further matters were raised, the Joint Committee completed their consideration of the update report. The Chair thanked Fabio Negro and Ciaran Weldon for the details provided and it was RESOLVED to:

(1)       note the update and actions being taken as detailed in the report.

(2)       To request (in view of the issues highlighted during the meeting) a future update was provided for the Joint Committee on the approach towards the use of biometrics as a potential security feature on devices to be included within the laptop refresh programme including a focus on the communication plans being developed for users.