ICT and device audit policies throughout Government

Request 721572087

Please provide:

1. Any current GOJ-wide ICT policy or guidance regarding (If published publicly, a link suffices):

a) device replacement that sets lifecycle limits (e.g. “devices must be replaced within X years of EoL”). 

b) software upgrade grace periods or limits (e.g. "software must be updated with X days of an upgrade being issued).

c) policy on out of suport devices/software.

2. The latest planned schedule or policy covering refresh, redundancy, or maintenance of GoJ out-of-support devices – including target replacement dates, prioritisation criteria, and any risk assessments.

3. Details of the frequency of any audit of devices, listing the date of last audit per department.

For the purposes of this request, a device is “out of support” when either

• the manufacturer/vendor has ended hardware support, warranty, or spare-parts availability (often called end-of-life or “EoL”), or

• the software or operating system in use on the device no longer receives vendor security/feature updates.

Response

1   a), b) & c)

There is no current Government-wide ICT policy or guidance in relation to device replacement that sets lifecycle limits.  Therefore, Article 3 of the Freedom of Information (Jersey) Law 2011 applies.  

2

The Government of Jersey does not publish information regarding the lifecycle management of technology assets be that hardware or software, as it is considered that providing this information may pose a security risk and therefore it has been refused under Article 42(a) (Law Enforcement) of the Freedom of Information (Jersey) Law 2011.

3

Data related to the frequency of audit of devices is not held in a format that enables the requested information to be reported.  Therefore, Article 3 of the Freedom of Information (Jersey) Law 2011 applies.

Articles applied 

Article 3 - Meaning of “information held by a public authority”

For the purposes of this Law, information is held by a public authority if –

(a)     it is held by the authority, otherwise than on behalf of another person; or

(b)     it is held by another person on behalf of the authority.

Article 42 - Law enforcement

Information is qualified exempt information if its disclosure would, or would be likely to, prejudice –

(a) the prevention, detection or investigation of crime, whether in Jersey or elsewhere;​​