Question to the Home Office:

To ask His Majesty's Government what plans they have, if any, to publish all information risk assessments prepared by or for the National Enabling Programme in respect of the adoption of Microsoft Office 365 and Azure by police forces, together with any subsequent risk assessments about this that are currently active.

The National Enabling Programme (NEP) rolled out the Microsoft 365 (M365) suites and the Identity and Access Management capability to 40 forces. A redacted version of the NEP programme-level Data Protection Impact Assessment, dated December 2020, has been published and is publicly available online.

As data controllers, individual police forces are responsible for assessing the risks associated with their implementation of the NEP.

The Government does not routinely monitor information risk assessments undertaken by the police and does not determine whether they should be published. Decisions on publication are a matter for policing, and there is no requirement on the police to publish such assessments.