Ordinance (ITV) - Subject Matter (ITV)

1. This regulation governs the organization, management, operation, and control of information technology.

a) Information Technology (IT) is the overarching term for information and communication technology.

b) IT initiatives are IT projects applied for at the initialization stage. With the approval of the project initialization orders by the client, they become IT projects.

c) IT programs encompass multiple IT projects that pursue a common goal. The IT program ensures the cross-project management and leadership of the IT projects.

d) IT resources include the IT infrastructure and both specialist and cross-sectional applications. The basic applications are part of the IT infrastructure.

e) IT infrastructure comprises all IT resources, except for specialist and cross-sectional applications.

f) Basic applications are essential for the operation of the IT infrastructure.

g) Specialist applications support or enable business processes. They are typically used by only one authority.

h) Cross-sectional applications support business processes as well as office automation. They are used by all or several authorities and are divided as follows

1. Standard applications are commercially available IT applications that require no or only minor configurations or additional components.

2. Cantonal applications are all other cross-sectional applications.

i) IT security includes measures to protect the integrity and availability of IT resources and to protect the confidentiality, integrity, availability, and traceability of the data processed with these resources.

j) Judiciary is used as a collective term for the Supreme Court (including Cantonal Court, Criminal Court, Public Prosecutor's Office) and the Administrative Court (including the Assessment Commission).

k) The authorities within the meaning of this regulation are

1. the directorates and the offices, departments, and positions subordinate to them;

2. the State Chancellery and the offices and departments subordinate to it;

3. the Supreme Court and the Administrative Court and the positions subordinate to them;

4. the data protection office, and

5. the ombudsman's office.

l) The cantonal schools include the following institutions: Zug Vocational and Industrial Education Center (GIBZ), Zug Commercial Education Center (KBZ), Agricultural Education and Advisory Center (LBBZ) and their advanced schools, furthermore School Bridge Offer (S-B-A), Combined Bridge Offer (K-B-A), Integration Bridge Offer (I-B-A), Zug Cantonal School (KSZ), Menzingen Cantonal School (KSM), Management Middle School (WMS), and Specialized Middle School (FMS).

1. This regulation applies to the cantonal administration, including the administrative sector of the cantonal schools, the judiciary, as well as the data protection office and the ombuds office. The independence of the judiciary, the data protection office, and the ombuds office shall be duly considered.

2. It applies to autonomous public-law institutions insofar as they use the IT resources of the canton. In this case, the public-law institutions shall have the same rights and obligations as a directorate.

3. It does not apply to IT resources used by the teaching staff and students of the cantonal schools, nor to building technology systems and installations used exclusively for controlling technical processes.

1. IT supports the authorities in fulfilling their statutory duties. It is tailored to their needs and designed and utilized in such a way that it supports the business processes in the best possible manner.

2. The costs are optimized taking into account security, effectiveness, quality, performance, and sustainability.

1. IT applications must comply with the requirements regarding IT architecture, standards (§ 12), and security (§ 18). Apart from adapting or extending standard solutions, individual solutions are generally not developed.

2. Before developing individual solutions, a market analysis must be conducted. If no standard solutions are available, the development must be limited to specific technical requirements. The development requires an appropriate exemption approval.

1. Service provision is carried out as centrally as possible. Decentralized service provision only occurs where it is necessary.

2. Authorities that rely on specialized IT infrastructure due to superior law, inter-cantonal agreements, or their service mandate may, in exceptional cases, determine and operate the IT infrastructure required for their specialized applications themselves, provided they comply with the specifications regarding IT architecture, standards, and security, and that planning, procurement, as well as the regulation of operations are agreed upon with the central IT.

1. The Office for Information Technology and Organization (AIO; § 25) is the central provider of IT services for the cantonal administration, the judiciary, the data protection office, and the ombudsman's office.

1. The directorates, the State Chancellery, the Supreme Court, the Administrative Court, as well as the Data Protection Office and the Ombuds Office (§ 26) are responsible for supporting their business processes through IT applications, as well as the design and deployment of their specialized applications.

1. The Government Council, the Supreme Court, the Administrative Court, the Finance Directorate, and the IT Board (§§ 23ff.) are responsible for the planning, management, and control of the overarching aspects of IT.

1. The IT strategy establishes the strategic IT objectives and the measures required to achieve these objectives for a period of at least four years.

2. It is aligned with the strategy and legislative goals of the government council and the objectives of the judiciary, while taking into account changes in statutory tasks, technological developments, and the requirements of the authorities.

1. IT Master Planning involves regularly reviewing the current use of IT in light of business requirements, planning future use, and determining the necessary financial and human resources.

2. IT Master Planning is derived from the action plan according to the IT strategy, the IT project portfolio (§ 14), the budget and financial plan, and other planning instruments.

1. The IT architecture determines the components of IT and their interaction to support business processes. An architecture model exists for the visualization of the IT architecture.

2. The IT standards are based on recognized national and international standards. They specify which IT functions, interfaces, and products should be designed or used in a consistent manner.

1. IT Initiatives and Projects are to be managed in accordance with the project management methodology specified by the central IT and the directives of the Competence Center for Project Management.

2. The central IT must be involved during the project initialization phase. For IT initiatives in which personal data is processed, the data protection office must also be informed simultaneously.

3. The project management for all IT initiatives and projects listed in the IT project portfolio (§ 14) must be conducted by a certified project manager. Exceptions require a special permit.

1. The IT project portfolio includes all IT initiatives and projects with total costs of at least 50,000 Swiss Francs and serves as a basis for budgeting.

2. Before being included in the IT project portfolio, individual IT initiatives are assessed according to a predetermined framework. Upon deciding on inclusion in the IT project portfolio, the assessment is reviewed and adjusted if necessary. In the budgeting process, the IT initiatives and projects listed in the IT project portfolio are prioritized according to their assessment and according to the available resources.

3. For IT initiatives and projects of the Supreme Court, the Administrative Court, the Data Protection Office, and the Ombudsman's Office, any changes to the assessment and prioritization are made in consultation with the relevant authority.

1. The project reporting is ensured monthly by the project management through the project status report for the attention of the principal or client and the central IT department.

2. The project controlling is conducted based on the project reports. In case of significant deviations in areas such as deadlines, costs, resources, risks, or outcomes, the project controlling report may be accompanied by recommendations for the attention of the principal or client.

3. No later than two years after the project's completion, the project management prepares a final project assessment, including project accounting, for the attention of the central and the decentralized IT responsible for the IT project. For projects of the cantonal administration with an investment volume exceeding 500,000 Swiss Francs, the final project assessment is also to be submitted, along with the audit report of the cantonal financial control, to the government council for their information.

1. IT Project Portfolio Controlling is conducted throughout the year based on project reporting.

2. The controlling report on the IT project portfolio provides information on the status of the projects listed in the IT project portfolio. It includes a cost forecast for the current budget period and a cost forecast upon project completion.

1. An application portfolio shall be maintained for all IT applications. It includes the relevant technical and operational information regarding the IT applications, including responsibilities, and lists the costs for maintenance and support.

2. It serves the purposes of life cycle and release management, cost control, identifying synergies, and reducing the number of IT applications in the application portfolio.

3. The application portfolio shall periodically undergo a controlling process. The controlling report may include recommendations directed to the central or decentralized IT responsible for the IT application.

1. The protection of IT resources is governed by recognized standards, and the protection of personal data processed by them is governed by the Data Protection Act and the Ordinance on the Information Security of Personal Data.

2. The IT resources are to be subjected to regular reviews.

3. Audit and controlling reports on IT security can be associated with binding requirements for the responsible central or decentralized IT.

1. The foundation of IT risk management is comprised of the risk lists of both central and decentralized IT. These lists detail the identified IT risks, their assessments, and the corresponding measures for risk mitigation.

2. The risk control report evaluates the relevant risks of central and decentralized IT, proposes measures for their mitigation, and highlights the changes compared to the previous period.

1. Business Continuity Management includes policies, Business Continuity Planning, and Crisis Management. Business Continuity Management is conducted according to recognized standards.

1. IT service management, including customer support, operation of IT infrastructure, operation of IT applications, and service desk, is conducted according to recognized standards.

2. The IT service catalog is aligned with the requirements of decentralized IT and contains information on the available IT services.

3. IT services are internally reallocated in cost and performance accounting, provided they can be appropriately assigned to the responsible party with a reasonable effort.

1. Contracts are to be drafted in accordance with the templates and taking into account the general terms and conditions of the Swiss Informatics Conference.

2. IT contracts, IT resources, and licenses are to be inventoried and managed.

1. The Government Council has the following tasks and competencies

a) Issuance of the IT strategy;

b) Approval of the IT governance;

c) Resolution on the IT project portfolio.

1. The Financial Directorate is responsible for all aspects of the cantonal IT, provided that the tasks have not been transferred to another entity by law or regulation.

2. It has the following tasks and competences

a) Management of IT and approval of the comprehensive IT plan;

b) Adoption of the IT strategy, the IT project portfolio, as well as the budget and financial plan of the cantonal administration for submission to the Government Council;

c) Issuance of IT directives. Insofar as IT directives concern the judiciary, the data protection office, or the ombudsman, their development and issuance shall occur in consultation with the Supreme Court, the Administrative Court, the Data Protection Office, and the Ombudsman.

d) Approval of IT program mandates and management of overarching IT programs;

e) Approval of the IT architecture, the IT architecture model, and IT standards;

f) Communication authority in the entire IT sector of the cantonal administration;

1. The AIO is responsible for central IT. This responsibility includes

a) the design and implementation of the IT infrastructure, taking into account modern working forms;

b) process and application responsibility for basic, standard, and AIO-specific applications as well as assigned cantonal applications;

c) technical responsibility for all IT applications;

d) planning and implementation of data logistics;

e) the design of the competence center for project management and the competence center for IT procurement.

2. The AIO has the following tasks and competencies

a) Development, implementation, and review of the IT strategy;

b) Creation of the overall IT plan;

c) Preparation of the budget and financial plan for IT initiatives and IT projects;

d) Preparation of the budget and financial plan for the operation and maintenance of the IT infrastructure, as well as the operation and maintenance of basic, cross-sectional, and proprietary applications;

e) Development of a list of business-critical IT applications for the Information Board;

f) Ensuring business continuity management for the IT infrastructure, basic, standard, and proprietary applications, as well as data logistics;

g) Design of roles in the areas of IT controlling, architecture, and security;

h) Regular review and assurance of IT security for the IT infrastructure, basic and cross-sectional applications, proprietary applications, and assigned cantonal applications;

i) Review of IT security, including the application for audits;

j) Implementation of IT architecture, IT standards, and IT security, as well as checking their compliance in IT projects and IT applications;

k) Recording and assessment of IT risks, as well as the definition and implementation of measures for risk management;

l) Management and administration of the IT project portfolio and the application portfolio;

m) Review of assessments of IT initiatives that are to be included in the IT project portfolio;

n) Prioritization of IT initiatives and IT projects within the IT project portfolio;

o) Planning and execution of IT initiatives and IT projects in the area of IT infrastructure, basic applications, proprietary applications, standard applications, and assigned cantonal applications including submission and contract management;

p) Provision of at least one IT sub-project management role in all IT projects listed in the IT project portfolio;

q) Development of controlling reports for the application portfolio in collaboration with IT representatives and controlling reports for the IT project portfolio;

r) Development of the controlling report on IT risks;

s) Support of decentralized IT in the procurement of specialized applications and assigned cantonal applications;

t) Maintenance of a control over completed project evaluations and project accounts;

u) Issuance of project reporting guidelines and development of project controlling reports;

v) Development of the IT service catalog and billing for provided IT services;

w) Operation of IT service management with customer support, IT infrastructure, IT applications, and central service desk;

x) Inventory of IT contracts, IT resources, and licenses;

y) Creation and maintenance of a central database for contract and supplier management, and support of decentralized IT in contract management;

z) Decision on exemptions according to §§ 5 Para. 2 and 13 Para. 3.

1. The directorates, the state chancellery, the supreme court, the administrative court, the data protection office, and the ombudsman are responsible for decentralized IT. This responsibility includes

a) the preparation of budget and financial plan for the maintenance of their own IT infrastructure as well as the operation and maintenance of their own specialized applications;

b) the planning and execution of IT initiatives and projects for their own specialized applications, assigned cantonal applications, including procurement and contract management;

c) the process and application responsibility for their own specialized applications and assigned cantonal applications;

d) IT risk management within their area of responsibility;

e) the regular review and assurance of IT security for their own specialized applications and assigned cantonal applications.

1. The Informatics Board consists of

a) the head of the AIO (Chair) and

b) the IT representatives of the Directorates, the State Chancellery, as well as the Superior Court and the Administrative Court.

2. It has the following tasks and competencies

a) Adoption of the IT strategy, budget, and financial plan, as well as the IT project portfolio for the Finance Directorate;

b) Establishment of the framework for the evaluation of IT initiatives;

c) Decision on the inclusion of IT initiatives in the IT project portfolio and their evaluation;

d) Decision on the prioritization of the IT initiatives and projects listed in the IT project portfolio;

e) Initiation of cross-functional IT projects;

f) Delegation of a representative to the project committee of cross-functional IT projects;

g) Adoption of the list of business-critical IT applications;

h) Adoption of the IT architecture, IT architecture model, and IT standards for the Finance Directorate;

i) Approval of controlling reports on the IT project and application portfolio, IT security, and IT risks;

j) Approval of IT security standards;

k) Inclusion of an IT application in the catalog of cantonal applications and assignment of process and application responsibility.

3. It makes its decisions by a simple majority of the members present. In the event of a tie, the Chair shall decide.

1. The Architecture Board is composed of

a) the IT Architect of the AIO (Chair),

b) the department heads of Projects, Operations, and Services of the AIO,

c) a representative of the GIS Commission,

d) the appointed person for E-Government,

e) a representative of the State Archives,

f) a representative of the Service for Informatics, Communication, and Technology of the Zug Police,

g) an IT representative of the cantonal schools,

h) an IT representative of the municipalities, and

i) an external specialist (advisory role).

2. It has the following tasks and competencies

a) Development of the IT architecture, the IT architecture model, and IT standards;

b) Initiation of architecture projects.

3. It makes its decisions by a simple majority of the members present. In the event of a tie, the Chair has the deciding vote.

1. The Security Board is composed of

a) the Security Officer of the AIO (Chair),

b) the Head of Operations of the AIO,

c) a representative from the Zug Police's IT, Communication, and Technology Services,

d) the Data Protection Officer,

e) a representative of the cantonal schools, and

f) a representative of the municipalities.

2. It has the following duties and competences

a) Developing directives to ensure information security and standards for IT security;

b) Initiating audits, preparing monitoring reports, and imposing binding requirements for IT security;

c) Initiating security projects;

d) Establishing measures to counter cyber attacks;

e) Conducting IT security training.

3. It makes its decisions by a simple majority of the members present. In the event of a tie, the chair has the casting vote.

1. The Project Board is composed of

a) the Head of Project Management of the AIO (Chair),

b) the Head of Operations of the AIO,

c) Project Managers of IT projects listed in the IT project portfolio, and

d) the IT Project Controller of the AIO (advisory voice).

2. It has the following tasks and competences

a) Collection and evaluation of ideas for IT initiatives and projects in the IT project portfolio;

b) Requesting documents for the identification and monitoring of dependencies and/or synergies between projects;

c) Conducting an overall risk assessment of ongoing projects and providing recommendations to the project managers;

d) Further development of methods and tools in project management and adoption of corresponding standards for the Project Management Competence Center.

3. It makes its decisions by a simple majority of the members present. In the event of a tie, the Chair has the casting vote.

1. The Change Advisory Board consists of

a) the Change Manager of the AIO (Chairperson),

b) at least one department head of the AIO,

c) the Security Officer of the AIO, and

d) the respective Change Owners.

2. It has the following tasks and competencies

a) Planning and coordination of adjustments to IT resources;

b) Approval, rejection, and postponement of changes.

3. It passes its resolutions by a simple majority of the members present. In case of a tie, the Chairperson decides.

1. The IT Officers of the Departments, the State Chancellery, the Supreme Court, and the Administrative Court have the following tasks and competencies

a) Implementation of the IT strategy, IT architecture, and IT standards;

b) Coordination of budget and financial plan for IT initiatives and projects on behalf of central IT;

c) Coordination of budget and financial plan for the maintenance of decentralized IT infrastructure as well as the operation and upkeep of decentralized specialized applications on behalf of decentralized IT;

d) Coordination and support for the planning and execution of IT initiatives and projects for specialized applications and assigned cantonal applications;

e) Reporting of IT initiatives to be included in the IT project portfolio, including evaluation proposal;

f) Preparation of control reports on the application portfolio in conjunction with central IT;

g) Recording and assessment of IT risks as well as definition and implementation of measures for risk management;

h) Participation in the IT Board.

1. The Process Owners have the following tasks and competences

a) Ensuring the optimal support of business processes through specialized and cantonal applications;

b) Ensuring business continuity planning for specialized and cantonal applications;

c) Initiation of and participation in adaptations to specialized and cantonal applications;

d) Establishing availability requirements and necessary technical and organizational measures to ensure IT security.

1. The Application Managers have the following responsibilities and competences

a) Ensuring the support and maintenance for specialized and cantonal applications;

b) Monitoring the operation and maintenance of specialized and cantonal applications;

c) Ensuring optimal support of business processes through IT applications;

d) Ensuring the further development of IT applications;

e) Participating in the planning and execution of IT initiatives and projects in a leadership role;

f) Participating in Business Continuity Planning and the drafting of operating manuals;

g) Conducting training sessions for IT applications;

h) Implementing IT security measures;

i) Dispatching a copy of all completed IT contracts to the central IT department.

1. The Technical Managers have the following Tasks and Responsibilities

a) Ensuring the reliable and secure operation of the IT infrastructure required for IT applications;

b) Monitoring operations including backup;

c) Taking measures according to IT service management guidelines;

d) Integrating IT applications into the IT infrastructure, including ensuring interfaces.

1. The IT services provided by the decentralized IT, which will be centralized in the future, must be transferred to the central IT by December 31, 2022. The government council regulates the details.

1. The police-specific IT resources acquired by the Zug police prior to the entry into force of this regulation may continue to be operated without a special permit from the Finance Directorate.