Information requested
Under the Freedom of Information Act 2000, please provide the following recorded information concerning:
- Data Security and Protection System — OCID ocds-h6vhtk-04fe9c; and
- Password Management System — OCID ocds-h6vhtk-04fe9d.
For each procurement, please provide:
- The final contract or order form, statement of work, specification and product or licence schedule, including any subsequent variation.
- The recorded manufacturer and product name, together with any reseller, subcontractor, service provider or sub-processor involved.
- The final implementation, testing or acceptance record showing the implementation, acceptance and go-live dates and current operational status.
- The final DPIA or equivalent data-protection assessment and any final data-flow document, processing-record extract or information-asset entry specific to the system.
-
Any final system-scope or support document recording:
- the categories of NHSCFA information processed, monitored or otherwise within scope;
- the high-level systems or repositories connected to or covered by the product;
- any administrative, maintenance, support or remote-access capability available to Softcat or another external provider; and
- whether the scope includes intelligence or fraud reports, investigation or case-management information, correspondence or complaints, FOI or data-protection work, document repositories, email or Microsoft 365.
- The responsible NHSCFA department and the job titles—not personal names—of the contract owner, business owner and technical or system owner.
NHSCFA response
Under the Freedom of Information Act 2000, please provide the following recorded information concerning:
- Data Security and Protection System — OCID ocds-h6vhtk-04fe9c; and
- Password Management System — OCID ocds-h6vhtk-04fe9d.
For each procurement, please provide:
1. The final contract or order form, statement of work, specification and product or licence schedule, including any subsequent variation.
Password Management System – The contract is attached.
Data Security & Protection System – The contract is attached.
Under Section 40(2) of the Act, personal data has been redacted from the documents.
Whilst the Authority has identified specifications for the Password Management System and Data Security and Protection System, the information you requested is being withheld as it falls under the exemption in section 31 (1) (a) of the Freedom of Information Act. In applying exemption 31 (1) (a) we have had to balance the public interest in withholding the information against the public interest in disclosing the information. The attached annex to this letter sets out the exemption in full, as well as the factors the Authority considered when deciding that in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.
2. The recorded manufacturer and product name, together with any reseller, subcontractor, service provider or sub-processor involved.
Data Security & Protection System - Netwrix - Threat Manager and Access Analyzer, Softcat, N/A, N/A, N/A
Password Management System - ManageEngine - Password Manager Pro, SoftCat, N/A, N/A, N/A
3. The final implementation, testing or acceptance record showing the implementation, acceptance and go-live dates and current operational status.
Data Security & Protection System -
The information is not recorded.
Deployed for use by IT only.
Current operational status is live.
Password Management System –
The information is not recorded.
Deployed for use by IT only.
Current operational status is live.
4. The final DPIA or equivalent data-protection assessment and any final data-flow document, processing-record extract or information-asset entry specific to the system.
Data Security & Protection System – The DPIA is published on the NHS Counter Fraud Authority Website:
NHSCFA_DPIA_-_Stealthbits.pdf - (The product is renamed as Netwrix)
Password Management System - A DPIA is not required, the system is part of the data protection & security toolkit.
5. Any final system-scope or support document recording:
- the categories of NHSCFA information processed, monitored or otherwise within scope;
- the high-level systems or repositories connected to or covered by the product;
- any administrative, maintenance, support or remote-access capability available to Softcat or another external provider; and
- whether the scope includes intelligence or fraud reports, investigation or case-management information, correspondence or complaints, FOI or data-protection work, document repositories, email or Microsoft 365.
Data Security & Protection System - refer DPIA
Password Management System - N/A
6. The responsible NHSCFA department and the job titles—not personal names—of the contract owner, business owner and technical or system owner.
Data Security & Protection System - refer DPIA
Password Management System -
Contract Owner - IT,
Business Owner - N/A,
Technical/System Owner - Technology Manager, Information & Cyber Security Manager.
Request an accessible format.
If you require a version of this document in a more accessible format, please email accessibility@nhscfa.gov.uk Please tell us what format you need. It will help us if you say what assistive technology you use.
Request an accessible format.
If you require a version of this document in a more accessible format, please email accessibility@nhscfa.gov.uk Please tell us what format you need. It will help us if you say what assistive technology you use.