For the last five financial years:
1. What is your annual spend on cloud storage and also on-prem storage (please split out the costs)?
The estimated costs specific to infrastructure cloud storage costs total £142,701.00 over the last five years.
In relation to on-premises storage, under Section 21 of the Freedom of Information Act, Devon County Council is not obliged to provide this information as it is already available on the contracts register.
2. Do you have a cloud strategy, if so when was it last assessed?
Yes. Currently being assessed.
3. How do you back up your data and with who?
Devon County Council can confirm that we hold the information requested. However, we consider this information is exempt from disclosure on the grounds that Section 31(1)(a) of the Freedom of Information Act 2000 applies. The Council considers that disclosure of the information requested would be likely to reveal information that could be used by a cyber threat actor to improve the chances of them targeting a successful cyber-attack against Devon County Council.
Whilst we recognise that there is a public interest in openness and transparency around the management of the Council’s IT infrastructure, we consider that there is a stronger public interest in the Council being able to maintain the confidentiality, integrity, and availability of its IT infrastructure. For this reason, we consider that the balance of public interest is best served by withholding this information from disclosure at this time.
4. How much do you spend on data backup annually?
Under Section 21 of the Freedom of Information Act, Devon County Council is not obliged to provide this information as it is already available on the contracts register.
5. How much do you spend on cyber security infrastructure?
6. How many attempted cyber-attacks have you suffered?
7. How many successful cyber breaches have you suffered?
8. If yes to 2c, did you pay the ransom and how long did it take for systems to come back online?
9. If yes to 2c, were any of these ransomware attacks?
In response to questions 5 to 9, Devon County Council can confirm that we hold the information requested. However, we consider this information is exempt from disclosure on the grounds that Section 31(1)(a) of the Freedom of Information Act 2000 applies.
The Council considers that disclosure of the information requested would be likely to reveal information that could be used by a cyber threat actor to improve the chances of them targeting a successful cyber-attack against Devon County Council.
Whilst we recognise that there is a public interest in openness and transparency around the management of the Council’s IT infrastructure, we consider that there is a stronger public interest in the Council being able to maintain the confidentiality, integrity, and availability of its IT infrastructure. ’a0 For this reason, we consider that the balance of public interest is best served by withholding this information from disclosure at this time.