REGULATION on cantonal information technology (RIC) - Objectives (RIC)

1. This regulation establishes the principles governing cantonal computing to ensure the rational use and proper functioning of information and communication tools and technologies within the Cantonal Administration (hereinafter: the Administration).

1. This regulation applies to the Administration, with the exception of higher education IT, educational IT, and Hospice IT.

2. Relations between the Vaud Cantonal Judiciary and the Directorate-General for Digital and Information Systems (hereinafter DGNSI) are governed by a special agreement.

1. By "information system," one should understand all the means (organization, actors, processes, procedures, data, computer systems) necessary for the acquisition, processing, retransmission, and conservation of information to ensure the missions and services of the Administration.

2. By "computer system," one should understand all the means (hardware, software, networks, telephony, applications) within which the processing, retransmission, and conservation of information is carried out electronically.

3. By "information systems foundation," one understands all elements common to business information systems or supporting them. This notably includes all of the following

- technical infrastructures.

- common software platforms.

- the digital work environment.

- shared reference data and master data.

- standards in information and communication technologies.

- transversal applications.

4. By "service levels related to operational services," one should understand the quality and performance objectives guaranteed to the beneficiaries.

1. The Council of State defines the strategic framework within which information systems, and particularly their foundation, must evolve.

2. In this capacity, the Council of State

- defines, at the beginning of each legislative period, the strategic orientations for the evolution of information systems;

- approves the cantonal master plan for information systems, which derives from these orientations;

- defines the service levels for operational services to be delivered by the DGNSI to users, within the framework of allocated resources;

- adopts the information systems security policy;

- adopts the IT directives;

- sets the expediency criteria used during the prioritization of IT projects;

- sets the overall envelope and approves the portfolio of IT projects comprising it, within the framework of the budgetary procedure.

1. The DGNSI brings together all human resources in the field of information and communication technologies, as defined in the Administration's job repository.

1. The DGNSI ensures the availability of the IT and telecommunications resources necessary daily for the proper functioning of the Administration and implements, with the beneficiary services, solutions contributing to making the Administration's processes simpler and more efficient, both for itself and for users.

1. The DGNSI is responsible for

- proposing strategic orientations regarding information systems to the Council of State;

- proposing to the Council of State and implementing a cantonal master plan for information systems, as well as a general information system security policy;

- for the scope defined in the general provisions of these regulations, issuing directives in the IT domain, which it submits to the Council of State for adoption;

- the standardization and selection of information and communication technologies, for which it ensures technology watch, with the aim of effectiveness and efficiency;

- supporting departments in optimizing their business processes and identifying the evolution needs of their business information systems;

- documenting and analyzing IT systems and their functionalities to enable the development of business master plans in partnership with beneficiary departments;

- developing solutions specific to each business and integrating them into the core information systems, systematically seeking rationalization and mutualization both within and outside the ACV;

- the evolution and rationalization of the core information systems, in accordance with the cantonal master plan;

- the operation and maintenance of IT systems in compliance with service levels;

- the updated management of the IT asset portfolio;

- user support according to the service levels in force;

- implementing information system security within the framework of the general information system security policy and according to the instructions of the entity responsible for data processing, under the direction of an information system security officer.

- managing relationships with suppliers of goods and services in the field of information and communication technologies.

1. The DGNSI may provide services to external beneficiaries in the public and parapublic sectors, as well as to departments that are part of the Administration but are excluded from the scope of this regulation. These services shall be subject to agreements specifying, in particular, the billing arrangements.

2. Conversely, it may outsource certain services in the field of information and communication technologies, while retaining responsibility for them towards the beneficiary departments.

1. The DGNSI contributes to efforts aimed at harmonizing the information systems of the State and municipalities, with a view to improving their collaboration and mutual information exchange, and, ultimately, the services provided to the population.

1. The Administration's departments are responsible for the quality, harmonization, and optimization of their processes, particularly with a view to their computerization. As data owners, the departments define security requirements (availability, integrity, confidentiality).

2. To this end, the departments are in charge of

- the efficient use of the IT tools and environment made available to them, notably through the support of one or more designated office support contacts within the departments or divisions;

- the functional mastery of applications specific to their business domain, notably through the support of designated application support contacts within the departments;

- documenting and analyzing their strategy, processes, organization, and functional needs to enable the development of their sectoral master plan for the information system in partnership with the DGNSI.

- the prioritization of IT needs and projects included in the business master plan;

- within the framework of IT projects, the expression and justification of their needs, user or acceptance testing of the proposed solutions, anticipation and implementation of agreed organizational changes;

- within the framework of their projects entailing additional IT costs, the search for any possible compensation linked to business gains obtained through computerization.

1. An IT committee is established to ensure the governance of the business information system, i.e., the planning and monitoring of services and projects. Depending on the case, the committee may concern a particular department or a set of departments sharing a common information system. The committee, chaired by a benefiting department head, is notably composed of business process owners and a representative of the DGNSI.

1. Security audits of information systems are conducted annually by the audit body, in accordance with the relevant regulations.

1. In order to ensure a rational and coherent development of information systems, the Council of State defines strategic guidelines regarding information systems.

2. Through its guidelines, the Council of State articulates, in connection with its legislative program and financial planning, the issues and general objectives related to the required developments of information systems, particularly the foundation of information systems, and the resulting strategy for the evolution of the IT function.

1. The cantonal master plan for information systems translates the strategic directions of the State Council into specific objectives and projects.

2. The cantonal master plan for information systems defines the principles, the stages of construction, as well as the main projects for consolidating the foundation of information systems, in response to the evolving needs of job-specific information systems. It specifies the scope of the foundation as well as the responsibilities associated with the evolution of transversal job information systems. It takes into account the opportunities offered by new information and communication technologies. It anticipates the human, financial, and technical resources required for the implementation of the projects.

1. The business master plan defines, for a set of services or a particular service, the principles, steps, and development projects of the business information system.

1. Through its general information system security policy, the Council of State defines the general objectives and implementation principles for the protection of information, particularly personal data, in order to guarantee their availability, integrity, and confidentiality at all times.

2. To this end, the DGNSI periodically conducts comprehensive or sector-specific risk analyses and proposes corrective or preventive measures to the Council of State, taking into account, in particular, the results of security audits.

1. The DGNSI is responsible for the portfolio of IT projects. In this capacity, it manages the IT portion of investment credits, the operating budget, and the workload plan for all projects within the domain of information and communication technologies.

1. Investment decrees involving IT components are, in principle, presented by the head of the department benefiting from the project during their review by the decision-making bodies (executive and legislative). In this capacity, they assume responsibility for it, with the support of the head of the department responsible for the National General Directorate for Information Systems (DGNSI), until the credit is closed.

1. Requests for new IT projects or existing IT projects and services requiring new financial and human resources are generally processed within the framework of the budgetary procedure (operating budget, investment budget and plan).

2. To this end, the departments qualify their requests according to the expediency criteria set by the Council of State. The DGNSI controls the technical qualification of project requests, examines the appropriateness of resizing, evaluates their technical feasibility, their degree of maturity, and their degree of integration into the cantonal master plan.

3. Taking into account ongoing projects and available resources, the DGNSI establishes a proposed ranking of department requests, which it submits to the College of Secretary-Generals, expanded to include the Judicial Order and the General Secretariat of the Grand Council.

4. The College performs the necessary arbitrations and issues a preliminary opinion on the ranking for a decision by the Council of State.

1. The DGNSI defines the process for conducting and executing IT projects and ensures its continuous improvement.

1. In order to ensure control over the IT assets, the DGNSI notably maintains up-to-date

- the mapping of IT applications (functionalities and associated data);

- whenever possible and in collaboration with the services, the mapping of processes supported by IT applications;

- the inventory of hardware and software infrastructures within the domain of information and communication technologies, the implementation of which falls under the responsibility of the DGNSI;

- the status of access rights to applications;

- the status of the Vaud cantonal network.

2. The DGNSI periodically draws up an inventory of these assets, identifies obsolescence risks, and proposes preventive and corrective measures adapted to the resources allocated to it.

3. The DGNSI ensures the maintenance of the proper functioning of IT systems, including minor evolutions, within the framework of available resources.

1. The DGNSI manages all relations with suppliers of goods and services in the field of information and communication technologies. It manages all corresponding contracts.

2. The DGNSI develops and maintains the catalogue of products (hardware and software) authorized for purchase in the field of information and communication technologies.

3. The DGNSI takes into account social and environmental requirements related to sustainable development when establishing product selection criteria.

4. The DGNSI plans the standard renewals of IT equipment within the limits of the allocated operating budgets.

5. The DGNSI processes, within the limits of the available budget envelope, requests for the acquisition of IT equipment and defines their specifications.

1. This regulation shall gradually enter into force from January 1, 2009, but no later than December 31, 2009, particularly concerning the administrative computing of the DFJC and computer security.

2. Pending the adoption and implementation of provisions supplementing this regulation in the area of computer security, particularly governing the transfer to the DSI of the responsibilities of the Cantonal Office of Computer Security (OSIC) not allocated to the audit function, this office is provisionally maintained and Article 5 does not apply to its personnel.