Printer friendly (PDF, 46 kB)
Purpose
This standard enunciates the mandatory requirements for agencies when maintaining and disposing of Information Communication and Technology (ICT) resources. ICT Resource Maintenance and Disposal (IS19) fits under Mechanisms and Standards within the EA Representation section of the Government Enterprise Architecture (GEA) Framework.
For the purposes of this Standard the term ICT resources refers to the technology devices or peripherals used in storage or transmission of Government information.
Policy statement
The maintenance and disposal of ICT resources used in the storage or transmission of Government data must be effectively and efficiently managed. To ensure consistency and accountability in the management of ICT resource maintenance and disposal across Government, agencies must:
- ensure that cost effective ICT resource maintenance and disposal planning is included in the agency planning and training processes; and
- ensure that data is protected and managed in accordance with legal, administrative, cultural and business requirements during the maintenance and disposal process.
Issue and review
This Standard was issued by the Director-General of the former Department of Innovation and Information Economy, Sport and Recreation Queensland in October 2003.
Current Version: V2.00 (Reviewed October 2003)
Implementation
The authority for the implementation of the mandatory principles of the Information Standards is primarily derived from the Financial Management Standard 1997. Based on this, the implementation dates for this Standard are:
High-level risk assessment: Completion April 2004
High risk principles implementation: Completion October 2004
Implementation advice and toolboxes are provided to assist agencies in implementing the mandatory principles of each Information Standard.
IS19 implementation toolbox
Mandatory principles
Principle 1 - Management and planning
ICT resource disposal and maintenance management strategies and processes must be addressed as a part of the agency ICT planning process. At a minimum agencies must:
- ensure that all legislative, administrative and regulatory requirements are considered when planning and managing ICT resource strategies; and
- provide comprehensive training relating to the maintenance and disposal of ICT resources and ensure that staff involved in maintenance and disposal processes have completed the training.
(Principle last updated 27 October 2003)
Agencies should ensure that the requirements of this Information Standard are applied within the general context of the due diligence, accountability and probity outlined in:
The Crime and Misconduct Commission also provide a number of publications which include checklists of legislative requirements in terms of asset disposal which may be useful when determining ICT resource disposal strategies.
Regardless of ICT resource support or provision arrangements, for example, equipment may be leased, owned or provided by a Shared Service Provider (SSP) it is critical that the agency plans for and provides strategies to ensure that maintenance and disposal requirements are monitored and managed.
For example agencies should ensure that where ICT resources are leased, the sensitivity of data, maintenance and removal of data at the conclusion of leasing arrangements are considered in the establishment and planning of lease arrangements.
When planning strategies for managing ICT resources agencies should refer to the following resources for direction:
Detailed information regarding planning for ICT resources can be sourced through Queensland Purchasing Better Purchasing Guidelines.
To ensure effective implementation ICT resource management, appropriate and regular training should be provided to staff involved in the maintenance and disposal of ICT resources. With the increasing prevalence of multi-functional devices agencies should also monitor training to ensure that it continues to take into account the various types of devices used in storing and transmitting information.
Queensland Purchasing, provide a number of purchasing training programs which address these issues.
Agency staff involved in the acquisition, maintenance and disposal of ICT resources should also have a general understanding of the terms and conditions contained within GITC.
Principle 2 - ICT resource maintenance
Agencies must ensure that maintenance processes provide 'value for money' and appropriate protection of ICT resources and agency data. At a minimum, agencies must ensure that:
- warranties, maintenance contracts and/or service level arrangements are periodically reviewed to ensure they continue to meet agency requirements;
- when ICT resources are repaired or upgraded that processes to protect the resource commensurate with its value and/or the sensitivity of data it holds are in place; and
- when maintenance is carried out by an external service provider that a Deed of Confidentiality within the Government Information Technology Conditions (GITC) relating to non-disclosure of the agency's information is signed.
(Principle last updated 27 October 2003)
Maintenance processes cover a wide range of activities including preventative, repair and upgrade maintenance, which may be the result of scheduled or non-scheduled activities. Agencies need to ensure that adequate policies and processes are in place to protect agency ICT resources and the information, which is contained on them during any maintenance process. Processes should also be reviewed on an ongoing basis to ensure that when new technologies are introduced that maintenance processes are in place.
When assessing and developing maintenance processes agencies should refer to:
All contract maintenance service providers must be Government Information Technology Conditions (GITC) signatories. Government buyers who purchase from a supplier who does not have GITC accreditation, are not protected by the provisions of the GITC.
Detailed information on GITC arrangements including confidentiality, terms and conditions is available on the Government Information Technology Conditions website.
Maintenance contracts are normally considered as insurance against high repair costs and long down time should an item fail. The agency should base its decision to enter into a maintenance contract on consideration of cost justification vs. risk. Further information regarding the variations that agencies need to consider in managing maintenance contracts can be found in the Warranties and Maintenance Reference Sheet located in the ICT Resource Maintenance & Disposal Toolbox.
Warranties may be offered as an extension of warranty arrangements on ICT products at time of purchase. Although this may increase the initial purchase price of the item, there may be longer-term savings by not having to pay an annual maintenance fee. Further information regarding the variations that agencies need to consider in managing warranties can be found in the Warranties and Maintenance Reference Sheet located in the ICT Resource Maintenance & Disposal Toolbox.
Service or Operating Level Agreement (SLA/ OLA) are essential in ensuring that both agency and service providers have a clear understanding of their respective commitments associated with the terms and conditions of any ICT maintenance agreement.
Information relating to any warranty/maintenance agreements could be held as part of the Agency's resource register. Further details regarding the variations that agencies need to consider in developing and managing service agreements can be found in the Warranties and Maintenance Reference Sheet located in the Maintenance & Disposal Toolbox.
Principle 3 - ICT resource disposal
Agencies must dispose of Government owned ICT resources in an accountable, cost effective and environmentally friendly manner. The agency ICT resource disposal process must:
- be conducted with the prior approval of the accountable officer or delegate;
- be supervised and certified upon completion by personnel delegated by the accountable officer;
- ensure that the sensitivity of data stored on the resource is appraised prior to disposal (or trade-in) and an appropriate method is selected for its removal based on the sensitivity of data and/or the relative value of the resource; and
- provide for a variety of disposal strategies (within the agency, across government, trade-in, to community or non-profit organisations or by sale to the public via tender or auction) based on the relative value of the ICT resource and the efficiency and cost effectiveness of the disposal process.
(Principle last updated 27 October 2003)
Agencies should refer to the FMS and local agency delegation policy to determine agency processes for the disposal of ICT resources. Under the provisions of the FMS responsibility for the disposal of surplus resources rests with the Accountable Officer or delegate of the department/agency. Surplus resources should only be sold, traded-in or otherwise disposed of with the approval of the Accountable Officer and in the manner specified by that officer or delegated officer.
To ensure that resources and any residual information contained on ICT resources is rendered inoperable or retained as required, procedures should be developed to verify that the appropriate action is satisfactorily completed. Agencies should refer to Information Security (IS18) and the accompanying Information Security Best Practice Supplement when assessing and developing such processes.
ICT products represent a considerable investment and require special consideration when disposing of these items. Generally, the time to assess disposal options should coincide with forward procurement planning. Agencies should consider a number of options including:
- disposal within government
- trade in
- disposal outside government.
Where appropriate agencies should consider publishing information about disposals to provide access to members of the public wishing to tender for the ICT assets.
Further advice and information on a range of resource disposal options and a downloadable Guide to the Disposal of Government Plant and Equipment is available via Queensland Purchasing Disposals website or in the Disposal Reference Sheet located in the ICT Maintenance and Disposal Toolbox.
The Crime & Misconduct Commission (CMC) also provides a guideline and checklist for disposal of assets, which agencies should consult when developing strategies for disposal.