Kanton Glarus (ITV)

Subject Matter and Scope

1 This Ordinance lays down the principles for the use of IT resources. It regulates the organisation, planning, control, procurement and acquisition, operation and maintenance, and financing of IT.

2 This Ordinance applies to

a.

b.

1. Diese Verordnung ist nicht anwendbar auf

| | | | | | --- | --- | --- | --- | | a. | Funk- und Einsatzleitsysteme sowie die Notruftelefonie der Kantonspolizei; | | |

| | | | | | --- | --- | --- | --- | | b. | Anlagen der Gebäudetechnik; | | |

| | | | | | --- | --- | --- | --- | | c. | Anlagen, die ausschliesslich der Steuerung technischer Prozesse dienen. | | |

1. Sofern nicht durch Gesetz oder durch diese Verordnung ausdrücklich geregelt, ergeben sich die Zuständigkeiten aus der Organisationsmatrix gemäss Anhang 1.

Purpose of IT Use

1 IT resources support authorities in fulfilling their legal duties.

1) GS II H/1

SBE 2022 66

1

II H/2

2 The use of IT resources

a. is geared towards the needs of the population and the economy;

b. contributes to the seamless and cross-organizational digital processing of business processes.

Economy and Regularity

1 The use of IT resources must be aligned with business requirements. It will be controlled and managed according to economic principles.

2 The specifications for information security and data protection will be implemented, and their compliance will be regularly reviewed.

Standardisation

1 Information technology resources and the business processes supported by them shall be standardised as far as possible and reasonable.

2 The use of standard products generally takes precedence over the development of individual solutions.

3. Organisation

Competent Department

1 The competent department for information technology is the Department of Finance and Health.

2 It is responsible for all matters, unless the tasks have been assigned to another body by law or by this ordinance.

Chief Department of Informatics

1 The Chief Department of Informatics is the central competence and service

centre for informatics. It is the informatics service in the sense of Article 12

DVG.

2 The Chief Department of Informatics

a. implements the IT strategy;

b. plans, procures, and manages the required informatics resources in

accordance with the specifications and decisions of the competent bodies;

c. provides informatics services to service recipients within the framework of

superordinate guidelines and service agreements;

d. is responsible for the design and deployment, as well as for the establishment,

operation, and expansion of the informatics infrastructure;

e. ensures central support for users;

f. is responsible for the overarching management of information security and

the risks associated with the use of informatics resources;

g. develops technical and methodological guidelines and issues security-related

directives.

3 Furthermore, together with the Digital Administration Competence Centre, it

supports service recipients in the design of business processes and their

digitalization.

Specialist Unit for Digital Administration

1 The Specialist Unit for Digital Administration

a. implements the e-government strategy;

b. coordinates and reviews new IT projects and digitalization steps of the service recipients;

c. heads IT coordination;

d. is the point of contact for the public and businesses regarding the digitalization of government services.

2 In fulfilling its duties, the Specialist Unit for Digital Administration collaborates with the service recipients and the Main Department of IT.

Information Technology Steering Committee (IT Steering Committee)

1 The IT Steering Committee manages the strategic planning aspects of the

use of IT resources. Excluded from this are IT resources that are directly

related to the administration of justice.

2 The IT Steering Committee

a. commissions the development or adaptation of the E-Government

and IT Strategy, reviews it, and recommends it to the Government

Council for adoption;

b. manages the implementation of the E-Government and IT Strategy;

c. reports to the Government Council, for the attention of the Parliament

(Landrat), on the implementation of the E-Government and IT Strategy;

d. addresses questions of IT planning and realization, as well as financing;

e. addresses questions related to IT organization, cross-service recipient

business and central IT processes;

f. initiates, resolves, and manages central IT initiatives and IT projects;

g. prioritizes cross-service recipient business requirements and decides on

the provision of new cross-service recipient IT services;

II H/2

h. issues technical and methodological directives.

3 The IT Steering Committee is composed of

a. the Head of the competent Department (Chair);

b. the Council Secretary;

c. one representative from each of the three municipalities;

d. a representative of the courts, delegated by the Administrative Commission

of the Courts.

4 The Head of the Main Division of IT and the Digital Administration Office

participate in the meetings in an advisory capacity. The management of the

committee is handled by the Digital Administration Office.

5 The IT Steering Committee may form sub-committees or involve additional

persons in an advisory capacity.

6 The IT Steering Committee meets at least twice a year. It is quorate when

at least four members are present. Decisions are made by a simple majority,

with the Chair having the casting vote in the event of a tie.

IT Coordination

1 IT Coordination addresses operational aspects of the deployment of IT

resources from the perspective of service recipients. Excluded from this are IT

resources directly related to the administration of justice.

2 IT Coordination

a. coordinates IT concerns and activities across all service recipients and

aligns them with the needs of the service recipients;

b. accompanies IT projects at an operational level;

c. deals with strategic planning IT initiatives and IT projects and provides

recommendations thereon to the IT Steering Committee;

d. develops the e-government and IT strategy for the attention of the IT

Steering Committee;

e. processes requests and recommendations from IT experience groups;

f. fosters the exchange of information and knowledge.

3 IT Coordination consists of

a. the Head of the Digital Administration Department (Chair);

b. the Head of the IT Main Department;

c. a representative of the courts;

d. one representative from each of the three municipalities.

4 The IT Coordination may form subcommittees or involve additional persons in

an advisory capacity. The business management is performed by the Digital

Administration Department.

5 The IT Coordination meets at least four times a year. It is quorate if at least

four members are present. Decisions are made by a simple majority, with the

Chair having a casting vote if necessary.

Information Technology Experience Groups (IT Experience Groups)

1 IT Experience Groups serve to bring the concerns of users of IT resources

to the attention of IT Coordination. They can be formed according to subject areas.

2 The IT Experience Groups are composed of representatives of the service

recipients as well as the IT Department or the Digital Administration Office.

3 The members of the IT Experience Groups possess corresponding expertise

in the respective subject area.

4 The IT Experience Groups constitute themselves. They meet as needed.

4. Planning and Control

E-Government Strategy

1 The E-Government Strategy defines the principles and goals for a modern,

digital administration, so that transactions with authorities can be carried out

simply and straightforwardly in digital form.

2 It designates the essential fields of action and specifies the measures required

to achieve these goals.

Information Technology Strategy (IT Strategy)

1 The IT strategy determines the principles and objectives for the use of information technology resources.

2 It defines the essential fields of action and specifies the measures required to achieve these objectives.

Application and Service Portfolio

1 The application portfolio contains information on the applications operated

by the IT Department in the form of a service catalog, detailing the scope of

services, quality, availability, responsibilities, and costs.

5

II H/2

2 The service portfolio contains information on the services provided by the IT

Department in the form of a service catalog, detailing the scope of services,

quality, availability, responsibilities, and costs.

Information Security Risk Report (IT Risk Report)

1 The IT Risk Report presents the risks identified in the field of information

security and shows the changes compared to the previous period.

2 The IT Department prepares the report once a year. It submits a summary

of the report to the Government Council and the IT Steering Committee for

their information.

IT Project Proposal (IT Project Application)

1 The IT project proposal describes an IT project requested by one or more

service recipients. In particular, it provides information on

a.

the required resources;

b.

the planning and organization;

c.

any dependencies on other IT projects;

d.

the impacts of the project.

2 The service recipients develop the IT project proposal. The IT Department

supports them as needed.

3 The IT Department and the Digital Administration Office review the IT

project proposal and submit it to the IT Steering Committee for inclusion

in the IT project portfolio.

4 If the planned IT undertaking involves the processing of personal data, the

IT project proposal must include a data protection impact assessment.

IT Project Portfolio (IT Project Portfolio)

1 The IT project portfolio contains information on planned and ongoing IT

projects.

2 It serves for superordinate planning, prioritization, control, and monitoring

of IT initiatives.

1. Die Jahres- und Mehrjahresplanung wird einmal jährlich als Vorprozess zur Budgetierung unter Berücksichtigung des IT-Projektportfolios und der bekannten Basisinfrastruktur-Vorhaben von der Hauptabteilung Informatik zusammen mit der Fachstelle Digitale Verwaltung durchgeführt.

2. Sie dient der Umsetzungsplanung von beabsichtigten Informatikvorhaben und Informatikbedürfnissen der Leistungsbezügerinnen und Leistungsbezüger für das Budgetjahr und für die Finanzplanjahre.

Informatics Budget (IT Budget)

1 The Informatics Division prepares the IT budget based on IT project

applications, the IT project portfolio, and the annual and multi-year

planning.

2 It forwards the draft IT budget to the service recipients for decision-

making.

3 The service recipients discuss the draft IT budget and make the necessary

prioritizations as well as any specific or lump-sum corrections.

5. Procurement and Acquisition

Central Procurement

1. Beneficiaries of services shall procure their IT resources and IT services from the Main Department of Information Technology.

2. All provided IT resources shall remain the property of the Canton.

3. The IT Coordination shall decide on exceptions.

Central Procurement

1 The IT Department is the central and exclusive procurement body for IT resources and IT services to be obtained from it.

2 The IT Coordination decides on exceptions.

3 The procurement of IT resources and IT services is carried out in accordance with internal market legislation, public procurement regulations, and cantonal financial household legislation.

4 The General Terms and Conditions of the Swiss Conference for Informatics (AGB SIK) are generally to be applied for procurement.

### Use of Third-Party Software

1 The use of software for which neither the Main Department of Informatics

nor the service recipients possess ownership or usage rights is prohibited.

7

II H/2

Self-Developed Software

1 Subject to the adaptation of standard products, the IT Department generally does not develop its own software.

6. Operations and Maintenance

Operation

1 Operation comprises the provision of IT resources and their availability with the least possible disruption.

2 The IT Department is responsible for the operation of IT resources.

3 The operation of specialized applications by third parties, subject to special agreement, remains reserved.

Maintenance

1 Maintenance aims to ensure the usability and operational reliability of applications and to extend their lifespan.

2 Maintenance comprises

a. error correction;

b. adaptive maintenance;

c. preventive maintenance;

d. perfective maintenance;

e. user support.

3 The IT Department is responsible for the maintenance of IT resources.

4 The maintenance of specialized applications by third parties in accordance with specific agreements remains reserved.

7. Financing

1. Die Hauptabteilung Informatik führt eine als Vollkostenrechnung ausgestaltete Kosten- und Leistungsrechnung nach Artikel 72 des Finanzhaushaltgesetzes[[2]](#paragraphtext_content_fn_732251_2_2_c).

2. Neben den direkt zuordenbaren Kosten berücksichtigt die Kosten- und Leistungsrechnung insbesondere

| | | | | | --- | --- | --- | --- | | a. | die Kosten für die Räumlichkeiten der Hauptabteilung Informatik und deren Nutzung; | | |

| | | | | | --- | --- | --- | --- | | b. | die Kosten für interne Leistungen von anderen Verwaltungseinheiten; | | |

| | | | | | --- | --- | --- | --- | | c. | kalkulatorische Zinsen. | | |

3. Der IT-Steuerungsausschuss kann ergänzende Vorgaben zur Ausgestaltung der Kosten- und Leistungsrechnung erlassen.

4. Die Leistungsbezügerinnen und Leistungsbezüger können jederzeit Einsicht in die Kosten- und Leistungsrechnung nehmen.

Cost and Performance Charging

Cost and performance charging is carried out in accordance with the

conditions defined in the application and service portfolio (Art. 15).

8. Further Provisions

Protection against Damage and Misuse

To protect against damage and the misuse of IT resources, the IT Division may

a. proactively restrict or prevent access to certain internet services or telephone numbers;

b. deploy suitable monitoring and analysis tools.

The use of espionage software is not permitted.

1. Die Hauptabteilung Informatik kann bei der Nutzung von Informatikmitteln jederzeit Kommunikationsranddaten und Systemprotokolle aufzeichnen, insbesondere

| | | | | | --- | --- | --- | --- | | a. | beim Anmeldevorgang; | | |

| | | | | | --- | --- | --- | --- | | b. | beim Zugriff auf Informatikmittel und auf Datenbanken; | | |

| | | | | | --- | --- | --- | --- | | c. | beim E-Mail-Verkehr; | | |

| | | | | | --- | --- | --- | --- | | d. | bei Telefonverbindungen. | | |

2. Die Aufzeichnungen dienen

| | | | | | --- | --- | --- | --- | | a. | der Behebung von Störungen; | | |

| | | | | | --- | --- | --- | --- | | b. | der Bekämpfung missbräuchlicher Verwendung von Informatikmitteln. | | |

1. Die Hauptabteilung Informatik kann die Aufzeichnungen jederzeit in anonymisierter Form auswerten.

2. Vermutet die Hauptabteilung Informatik aufgrund der anonymisierten Auswertung eine missbräuchliche Verwendung von Informatikmitteln, kann sie stichprobenartig pseudonymisierte Auswertungen vornehmen.

3. Besteht aufgrund der pseudonymisierten Auswertung ein konkreter Verdacht auf eine missbräuchliche Verwendung von Informatikmitteln, so kann die Hauptabteilung Informatik auf entsprechende Anordnung der Leistungsbezügerin oder des Leistungsbezügers hin personenbezogene Auswertungen vornehmen, sofern dies durch die Fachstelle Datenschutz bewilligt worden ist. Die Leistungsbezügerin oder der Leistungsbezüger informiert die betroffene Person vorgängig über die Durchführung sowie im Nachgang über das Ergebnis der Auswertung.

4. Aufzeichnungen und Auswertungen sind spätestens nach sechs Monaten zu vernichten. Vorbehalten bleibt die Verwendung zu Beweis- und Sicherungszwecken.

Outsourcing

1 The outsourcing of individual IT services by the Main IT Department requires a written agreement.

2 The contract must specifically stipulate

a. Content and scope of services;

b. Preservation of official secrecy and special confidentiality obligations;

c. Responsibilities;

d. Technologies used, including development and maintenance;

e. Data security and data deletion concept;

f. Location of hardware and data processing;

g. Control rights and supervision;

h. Involvement of third parties;

i. Handling of service disruptions;

j. Retention and archiving;

k. Securing ownership of data and auxiliary programs;

l. Return and deletion of data.

3 The data protection provisions regarding data processing on behalf of a controller and the disclosure of personal data abroad remain reserved.

1. Bei Konflikten zwischen den Leistungsbezügerinnen und Leistungsbezügern und dem zuständigen Departement oder der Hauptabteilung Informatik entscheidet der IT-Steuerungsausschuss.

2. Sind die Leistungsbezügerinnen und Leistungsbezüger oder das zuständige Departement bzw. die Hauptabteilung Informatik mit dem Entscheid des IT-Steuerungsausschusses nicht einverstanden, so können sie die Angelegenheit dem Regierungsrat zur abschliessenden Entscheidung vorlegen.

3. Die Bestimmungen des Verwaltungsrechtspflegegesetzes[[3]](#paragraphtext_content_fn_732268_2_3_c) bleiben vorbehalten.