Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, pursuant to the Answer of 13 May 2024 to Question 25013 on Ministry of Justice: ICT, for what reason his Department considers publishing the latest available figures on the number of red-rated systems it holds a security risk, in the context of the publication of the Central Digital & Data Office's guidance entitled, Guidance on the Legacy IT Risk Assessment Framework on 29 September 2023.
Answered by Mike Freer - Parliamentary Under-Secretary (Ministry of Justice)
In response to question 25013, the department responded with a cautionary response to withhold releasing information on the red-rated systems due to potential security risks. However, upon revising our previous response we have concluded that we are able to release the requested figures.
These figures are already in the public domain and can be found on slide 21 of the CDDO progress update below:
https://data.parliament.uk/DepositedPapers/Files/DEP2024-0230/Future.pdf.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, with reference to the guidance by the Central Digital and Data Office entitled Guidance on the Legacy IT Risk Assessment Framework, published on 29 September 2023, how many red-rated IT systems are used by his Department; and how many red-rated IT systems have been identified since 4 December 2023.
Answered by Mike Freer - Parliamentary Under-Secretary (Ministry of Justice)
The Central Digital and Data Office (CDDO), in the Cabinet Office, has established a programme to support departments managing legacy IT. CDDO has agreed a framework to identify ‘red-rated’ systems, indicating high levels of risk surrounding certain assets within the IT estate. Departments have committed to have remediation plans in place for these systems by next year (2025).
It is not appropriate to release sensitive information held about specific red-rated systems or more detailed plans for remediation within the Ministry of Justice’s IT estate, as this information could indicate which systems are at risk, and may highlight potential security vulnerabilities.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, what recent progress his Department has made on the sale of Reading Gaol; what recent estimate he has made of when the sale will be completed; and who the purchaser will be.
Answered by Edward Argar - Minister of State (Ministry of Justice)
The sale of the former Reading Gaol to the Ziran Education Foundation was completed on 10 January.
This sale will provide funds which will be reinvested in the wider prison estate and in turn will help the Ministry of Justice protect the public and reduce re-offending.
I have written to both the honourable member and his colleague, the Rt Hon Member for Reading West, to give further details of the sale.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, with reference to the Central Digital & Data Office's guidance entitled, Guidance on the Legacy IT Risk Assessment Framework, published 29 September 2023, how many red-rated IT systems are used by HM Courts and Tribunals Service as of 6 December 2023.
Answered by Mike Freer - Parliamentary Under-Secretary (Ministry of Justice)
Based on the latest assessment using Central Digital & Data Office’s guidance, as at October 2022 HMCTS had 9 red-rated IT systems.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, pursuant to the Answer of 4 December 2023 to Question 3664 on Ministry of Justice: ICT, if he will publish details of the red-rated IT systems referenced in the answer.
Answered by Mike Freer - Parliamentary Under-Secretary (Ministry of Justice)
The details on the red-rated IT systems will not be published due to security reasons. This is because the information held about Red Rated Systems is sensitive as it highlights potential security weaknesses within a department's IT estate.
As such, we will be withholding the information.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, with reference to the guidance by the Central Digital and Data Office entitled Guidance on the Legacy IT Risk Assessment Framework, published on 29 September 2023, how many red-rated IT systems are used by their Department.
Answered by Mike Freer - Parliamentary Under-Secretary (Ministry of Justice)
The spend by the Ministry of Justice on its IT infrastructure as set out in the question is provided in the table below, covering the previous three years:
| 2020/21 costs | 2021/22 costs | 2022/23 costs |
Current IT infrastructure | £191,003,356 | £186,076,175 | £190,539,822 |
It has not been possible to separate out costs in a meaningful way between current and legacy systems, or identify costs for pre-2013 systems. This is due to both the complexity of the IT estate, which includes outsourced services, and the finance systems in use across the department not being set up to operate in that way that facilitates this.
The costs in the table include the costs of networks, devices, voice and video infrastructure, print services, wifi, software licences that underpin the operation of the department (eg Oracle, Microsoft) and hosting. They do not include costs of bespoke software. The costs are the external (contract) costs to purchase infrastructure outright or as a service but do not include costs related to people or processes or documentation within MoJ.
The Ministry of Justice is actively managing its legacy estate and are either seeking to fund or are seeking to exit legacy systems via our existing change plans. The right approach varies: work under way includes upgrades, complete system replacements and migration to public cloud.
The Ministry of Justice regularly assesses the most critical services within its IT estate including those using legacy systems against its own framework. There is a significant programme of activity in place to mitigate these risks through decommissioning, migration to more modern environments and upgrades.
Earlier in 2023, an assessment was carried out on the top 10 most critical legacy IT systems. Out of these 10 systems, 5 were identified as red-rated IT systems as defined in the Central Digital and Data Office (CDDO) Legacy IT Risk Assessment Framework
The Ministry of Justice is in the process of assessing all of its critical systems against the CDDO framework which will provide data on how many of these are red-rated within this framework.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, how much their Department spent on (a) current and (b) legacy IT infrastructure (i) in total and (ii) purchased in 2013 or earlier in each of the last three years.
Answered by Mike Freer - Parliamentary Under-Secretary (Ministry of Justice)
The spend by the Ministry of Justice on its IT infrastructure as set out in the question is provided in the table below, covering the previous three years:
| 2020/21 costs | 2021/22 costs | 2022/23 costs |
Current IT infrastructure | £191,003,356 | £186,076,175 | £190,539,822 |
It has not been possible to separate out costs in a meaningful way between current and legacy systems, or identify costs for pre-2013 systems. This is due to both the complexity of the IT estate, which includes outsourced services, and the finance systems in use across the department not being set up to operate in that way that facilitates this.
The costs in the table include the costs of networks, devices, voice and video infrastructure, print services, wifi, software licences that underpin the operation of the department (eg Oracle, Microsoft) and hosting. They do not include costs of bespoke software. The costs are the external (contract) costs to purchase infrastructure outright or as a service but do not include costs related to people or processes or documentation within MoJ.
The Ministry of Justice is actively managing its legacy estate and are either seeking to fund or are seeking to exit legacy systems via our existing change plans. The right approach varies: work under way includes upgrades, complete system replacements and migration to public cloud.
The Ministry of Justice regularly assesses the most critical services within its IT estate including those using legacy systems against its own framework. There is a significant programme of activity in place to mitigate these risks through decommissioning, migration to more modern environments and upgrades.
Earlier in 2023, an assessment was carried out on the top 10 most critical legacy IT systems. Out of these 10 systems, 5 were identified as red-rated IT systems as defined in the Central Digital and Data Office (CDDO) Legacy IT Risk Assessment Framework
The Ministry of Justice is in the process of assessing all of its critical systems against the CDDO framework which will provide data on how many of these are red-rated within this framework.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, what recent progress his Department has made on the sale of Reading Gaol.
Answered by Damian Hinds - Minister of State (Education)
The sale of Reading prison is progressing and, barring any unexpected complications, completion is expected later this autumn.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, which developer his Department is in discussion with about plans to sell Reading Gaol; and if he will meet (a) Reading Borough Council and (b) the hon. Member for Reading East to discuss the status of those discussions.
Answered by Victoria Atkins - Secretary of State for Health and Social Care
The MoJ is considering potential uses for the former HMP Reading. We are in the process of setting up a meeting with the hon members for Reading and others to discuss this.
Asked by: Matt Rodda (Labour - Reading East)
Question to the Ministry of Justice:
To ask the Secretary of State for Justice, what recent progress his Department has made on the sale of Reading Gaol; and if he will meet (a) the hon. Member for Reading East and (b) other stakeholders to discuss that matter.
Answered by Victoria Atkins - Secretary of State for Health and Social Care
The MoJ is considering potential uses for the former HMP Reading. We are in the process of setting up a meeting with the hon members for Reading and others to discuss this.