Ordinance on Information Technology (IT Ordinance) (Informatikverordnung) - Subject Matter and Scope (GSMS)

1. This regulation defines the framework for the use of information and communication technologies in the cantonal administration, by special authorities, and in the courts.

2. It also applies to cantonal schools, insofar as they receive IT services from the cantonal administration, unless the regulation specifies otherwise.

1. In this regulation, the following terms are used as defined

a. "Information Technology": encompasses the planning, provision, operation, use, and control of information and communication technologies to support the tasks and business activities of the organizations listed within the scope;

b. "IT Resources": all devices, programs, facilities, and services that enable the processing, storage, interpretation, reproduction, and transportation of data;

c. "IT Workplace": includes all IT resources related to office automation and office communication, such as PCs, notebooks, printers, smartphones, office software, or email. They are general in nature and do not directly support task-specific or process-specific functions;

d. "IT Infrastructure": comprises all IT resources that create the prerequisites for the operation of specialized applications and the IT workplace (e.g., networks, storage, or servers);

e. "Specialized Application": consists of one or more programs, including data, that are used to support a particular professional or operational task or a specialized business process. Centralized specialized applications support cross-directorate tasks and processes, whereas decentralized specialized applications support those of single or fewer departments;

f. "IT Service": is a standardized service from the area of information and communication technologies used by users;

g. "IT Project": a project whose main goal is to digitize business processes, build or utilize data collections, introduce or adapt a specialized application, or build or improve IT infrastructures.

1. The cantonal administration and the courts use information technology to economically, efficiently, and effectively fulfill their tasks through digitalization and automation.

2. Information technology contributes in particular to

a. the comprehensive and organization-wide electronic handling of business processes;

b. optimized services for the population, the economy, and the business partners of the organizations mentioned in paragraph 1.

1. Information technology is aligned with business requirements and managed and directed according to economic principles.

2. The guidelines for information security and data protection are consistently implemented and regularly monitored for compliance.

3. The risks associated with the use of information technology are actively managed.

4. Employees are enabled to use information technology resources appropriately and in compliance with regulations.

1. Information technology and the business processes it supports are standardized wherever practical.

2. The use of standard products takes precedence over the development of individual solutions.

3. Recommendations from the federal government, the Swiss Informatics Conference, the eCH association, and other industry-specific or task-specific associations are considered where appropriate.

4. The specialized applications used must be compatible with the IT standards and the IT architecture.

1. The procurement, provision, and management of IT resources and IT services in the areas of IT workplace, IT infrastructure, and central specialized applications (excluding Geographic Information Systems) are carried out by Central Information Technology.

2. There is a mandatory usage of central IT services for the cantonal administration and the courts.

3. The internal provision of services focuses on IT resources and IT services that make a direct and significant contribution to the digitalization of administration-specific business processes.

4. IT services that are independent of industry and organization are sourced externally, provided that considerations regarding cost-effectiveness, security, data protection, and risk do not argue against it.

1. Oversight of the overarching aspects of information technology is carried out by information technology committees, in which the directorates, the state chancellery, and the courts are representatively represented.

2. The management of specialized applications lies with the department that has the leading responsibility for the tasks and processes supported by the application.

3. Central information technology services are internally charged on a financial basis, provided they can be allocated equitably with a justifiable effort and the charging results in a measurable regulatory effect.

1. The IT strategy establishes the strategic goals and priorities for at least four years. It is determined at the cantonal level and coordinated with the overarching business strategy of the canton and the courts.

2. The review and any necessary updates of the IT strategy occur once per legislative period.

3. The directorates, the state chancellery, or the courts may define organization-specific additions to the IT strategy.

1. The IT Master Plan contains a list of measures for implementing the strategic IT objectives at the cantonal level with a time horizon of 4 years.

2. The Master Plan is reviewed annually as a rolling plan and adjusted to meet requirements.

1. The IT architecture defines the areas of application to be standardized and makes binding specifications regarding the technologies, platforms, applications, components, and services to be used. It ensures interoperability.

2. The directorates, the state chancellery, and the courts can define subject-specific additions to the IT architecture.

1. The IT Project Portfolio contains information on the planned and ongoing IT projects of the Directorates, the State Chancellery, and the Courts.

2. It serves for the overarching planning, prioritization, management, and monitoring of IT projects using standardized processes and tools.

1. The specialized application portfolio includes relevant operational, technical, security, and architecture-related information regarding the specialized applications used in the directorates, the state chancellery, and the courts.

2. It forms the basis for the life cycle and release management of specialized applications through standardized processes and tools.

1. The IT Service Catalog contains information about the available IT services, including details on the scope of services, service levels, responsible parties, costs, and the like.

2. The IT Service Catalog is the foundation for organization-wide service management.

1. The IT project planning is conducted annually as a preliminary process to task and financial planning.

2. The project planning serves to record, review, and prioritize the planned IT projects and to coordinate them with each other.

1. The IT Financial Plan supports the comprehensive budgeting of both recurring and one-time financial resources needed for information technology, and presents the allocation of these resources transparently.

2. The IT Financial Plan serves as the central instrument for overarching financial IT control.

1. IT Control Metrics represent measures related to strategic IT objectives, which are provided with target values and evaluated annually.

2. They form the basis for strategic IT controlling and the setting of annual objectives.

1. The Information Security Risk Report outlines the identified risks as of the reporting date and highlights changes compared to the previous period.

2. The Risk Report is prepared annually.

1. In the GSMS, processes, roles with responsibilities and competencies, as well as tools for planning, provisioning, operation, usage, and control of information technology in administration are defined.

2. The GSMS is based on the widely adopted best practice standard ITIL (Information Technology Infrastructure Library).

1. The responsibilities for the instruments pursuant to Chapter 3 are set out in Annex 1.

1. The Government Council establishes the overarching framework conditions for IT in the cantonal administration. The Government Council

a. decides on the IT strategy together with the management board of the courts;

b. decides on the IT organization of the administration and the State Chancellery;

c. approves, within the scope of its financial competencies, the funds for cross-departmental IT programs and projects;

d. determines the nature and extent of the internal transfer of IT service costs.

1. The management of the courts establishes the overarching framework conditions for information technology for the courts. The management

a. decides on the IT strategy together with the government council;

b. determines the IT organization of the courts;

c. decides on the participation of the courts in central information technology programs and projects of the administration.

1. The directorates and the state chancellery are responsible for the use of information technology within their areas of jurisdiction and coordinate the IT activities of their departments. They

a. establish the necessary structures for controlling and managing the use of IT;

b. appoint an individual responsible for IT;

c. appoint an information security officer;

d. implement the decisions of the IT steering committees within their area of jurisdiction;

e. monitor IT usage within the framework of controlling and risk management;

f. budget the financial resources required for IT;

g. are responsible for IT projects within their area of jurisdiction;

h. procure decentralized specialized applications for their departments or delegate this task to the departments.

2. The management of the courts and the court administration fulfill the tasks and responsibilities listed in paragraph 1 for the courts in accordance with the competencies defined in the regulation on court administration dated May 26, 2014.

4. The IT officers of the directorates, the state chancellery, and the courts have professional authority in IT matters over the departments or organizational units within their jurisdiction.

1. The departments bear the responsibility for the use of information technology resources and specialized applications within their jurisdiction. They

a. ensure the necessary measures to guarantee the confidentiality, availability, integrity, and traceability of the data and information technology resources within their area of responsibility;

b. plan, procure, and utilize decentralized specialized applications in accordance with the directives of the Directorate or the State Chancellery;

c. designate a contact person for information technology coordination.

1. The ZI is the Competence and Service Center for Information Technology and is responsible for providing central IT services as well as overarching IT planning and coordination. It

a. plans, procures, and manages the necessary central IT services and IT resources in accordance with the directives and decisions of the IT governance bodies;

b. provides IT services for the cantonal administration and the courts within the framework of its service mandate and according to the service agreements made;

c. ensures central user support;

d. takes the lead in the design and implementation of the governance and management processes approved by the decision-making bodies and provides the necessary tools for them;

e. is responsible for the overarching management of the IT architecture, information security, and IT risks;

f. develops professional, methodological, and security-related IT specifications and issues administrative-wide professional directives;

g. conducts cross-departmental IT projects;

h. provides the necessary management information for the IT managers of the directorates, the State Chancellery, and the courts;

i. maintains regular information exchange with the Central Procurement Office, the Data Protection Oversight Office, the Financial Control as well as other IT bodies and committees at the federal or cantonal level.

2. The head of the ZI has professional directive authority on IT matters over the IT managers of the directorates, the State Chancellery, and the courts.

3. The ZI appoints the cantonal Information Security Officer.

1. The ITO Council manages the cross-directorate, strategic-planning aspects of information technology from a business perspective. The ITO Council

a. issues the mandate for the development of the IT strategy, reviews it, and recommends its adoption to the Council of Government and the management of the courts;

b. manages the implementation of the cantonal IT strategy and IT-related guidelines;

c. addresses issues related to the IT organization, cross-directorate business processes, IT processes, and the financing of IT services;

d. initiates, decides on, and manages central projects and programs;

e. prioritizes cross-directorate business requirements and decides on the provisioning of new overarching IT services;

f. reviews reports related to strategic IT controlling, as well as information security and risk management, and approves them;

g. approves exceptions to cantonal IT standards and guidelines;

h. acts as the escalation body for the IT Specialist Group.

2. The ITO Council is composed of

a. the Head of the Department of Finance and Church Affairs (Chair);

b. one representative from each directorate, appointed by the Council of Government;

c. one representative from the State Chancellery, appointed by the State Secretary;

d. one representative from the courts, appointed by the management of the courts;

e. the Head of ZI (in an advisory capacity).

3. Management is undertaken by the ZI.

4. Resolutions are passed by a simple majority, with the chairperson casting a deciding vote if necessary.

1. The FGI addresses tactical and operational aspects of informatics from both the user and informatics perspectives. It

a. coordinates cross-directorate informatics concerns and activities and aligns them with the needs of the directorates;

b. addresses aspects related to the provision and use of IT services and contributes to cross-directorate service management;

c. prioritizes, evaluates, and approves tactical changes to IT services;

d. initiates, decides on, and controls informatics projects at a tactical or operational level;

e. discusses and approves service descriptions for central IT services;

f. addresses strategic-planning informatics matters and provides recommendations to the ITO Council;

g. considers proposals and recommendations from expert groups;

h. reviews reports related to service quality and acts as an escalation point in quality issues;

i. maintains the exchange of information and knowledge.

2. The FGI is composed of

a. the Head of the ZI (Chairperson);

b. the informatics representatives of the directorates;

c. the informatics officer of the courts;

d. the informatics representative of the state chancellery;

e. the informatics representative of the police (with an advisory vote);

f. the Head of the ZI function "Informatics Planning and Coordination" (with an advisory vote).

3. Decisions are made by a simple majority vote, with the chairperson casting the deciding vote if necessary.

1. The FIS addresses cross-directorate aspects related to information security. It

a. coordinates the implementation of directives;

b. plans cross-directorate measures and initiatives;

c. addresses operational issues;

d. ensures the exchange of knowledge and information among the information security officers;

e. reviews and assesses selected matters and projects from a technical perspective;

f. makes recommendations to the head of the ZI, the FGI, or the ITO Council.

2. The FIS is composed of

a. the cantonal information security officer (chair);

b. the information security officers of the directorates, the state chancellery, and the courts;

c. 1 representative of the supervisory data protection office (with advisory voice).

3. Decisions are made by simple majority and, if necessary, the casting vote of the chair.