FOI - IT policy, guidance and procedures for staff [Nov 2021]

Your request

Please provide me with an electronic copy of policy, procedures or guidance issued to your IT department/staff or others concerning:

• Management of IT assets (PC’s, Desktop, Laptops, Tablets, SmartPhone)
• IT Asset disposal process
• Process or Procedure for monitoring and tracking of physical IT asset inventory/stock
• Process for assigning asset numbers (equipment tracking numbers) to IT assets
• Storage of IT assets
• Storage area
• Inspection of equipment
• Procedure for the intake and recording of new equipment
• Policy on the use of personal computers by Council staff
• Procedures for requests for new IT assets
• Procedures for the installation and disposal of IT equipment.
• Procedures for the redistribution/reallocation of IT Equipment to new staff
• Procedures for returning equipment from staff who have left the Council
• Management of IT assets (PC’s, Desktop, Laptops, Tablets, SmartPhone)
• IT Asset disposal process
• Recycling Equipment

Our response

The GLA works with a third party to recycle equipment. The service will collect surplus ICT equipment within 5 working days so that we have no need for large storage areas with unused equipment in them.

Types of IT Equipment for Disposal

Types of IT equipment for disposal including, but not limited to the following:
• PCs
• Laptops
• Servers
• Printers and other output devices with on board hard drives
• Miscellaneous Hard Drive Modules
• Backup tapes, CDs, DVDs, videos and assorted media
• Printer l multifunctional device hard drives
• USB flash drives
• Print consumables deemed secure in nature
• Desktop monitors (fiat panel, LCD and CRT screens)
• Printers and multifunctional devices (laser and ink jet, mono and colour), Photocopiers, fax
machines, digital senders and scanners
• Peripheral equipment including; mice, keyboards, laptop docking stations, carry cases, KVM switches etc.
• Network infrastructure hardware, UPS, video conferencing equipment, mixed cabling, IP phones
and telecoms hardware,
• Print consumables; toner cartridges, loose hard drives
• CD, DVD, Floppy Drive modules and media

Process or Procedure for monitoring and tracking of physical IT asset inventory/stock

Using Track-IT to Monitor and Track IT Equipment

To ensure we identify each piece of equipment uniquely we attach a secure asset sticker indicating an asset number. This procedure illustrates how we monitor and track physical IT assets.

Method
1. When IT equipment arrives to the Technology Group office, they must be allocated an asset sticker by the Business Support Officers (BS0).
2. Asset stickers must be assigned according to the type of device, e.g., Laptops are assigned asset stickers beginning with the number 1.
3. The device is then added to the GLA’s IT Asset Management System, TrackIT under “inventory”.
4. On TrackIT, the BSO’s are expected to input the following data:
a. Type of Device e.g., Laptop, Monitor, Mobile Phones
b. Asset Number
c. Serial Number
d. Location
e. User
f. User’s Number

If there is a need to locate a specific device, Technology Group members can search for any devices in the TrackIT inventory using any of the information above.

IT Assets are stored in the Technology Group storerooms. The storerooms are made up of cabinets and storage racks where each section is allocated to specific devices. This includes:
• Laptops – GLA Standard Surface Pros and Specialist Laptops
• Mobile Phones
• Docking Stations
• Desktop Monitors
• Accessories – Keyboards, Mice, Headphones
• CD’s, Tapes, M-Discs
• Hard-Drives
The GLA also has a separate section for MOPAC devices which include MS Surface Pro’s and Mobile Phones.

Process for Removing devices from storerooms

The Storage Rooms are used mainly for devices which are not yet allocated to a user or a “spare” device.
1. When a new device arrives, the Business Support Officers (BSO) will assign the device with an asset sticker and input the data into the IT Asset Management system, TrackIT under the inventory section.
2. If the device is not yet assigned to a user, this will fall under “spare” devices and then stored in the Technology Group storerooms.
3. Storeroom doors must be kept closed/locked at all times.
4. Sign stock control sheets for all equipment removed from Store Rooms. Stock sheet are located outside all cabinets or pinned to storage racks.
5. A further list of all other free-standing equipment will be located on walls near entrance of each room, i.e. Monitors in Secure Room
6. Inform the IT Asset Manager of any inconsistencies with the forms by email.
7. Inform the IT Asset Manager of the low level of stocks by email.
8. If equipment is returned to the storeroom, update the stock control sheets.

Process on the use of personal computers by staff

The GLA Technology Group is committed to delivering a professional service and demonstrating enthusiasm and commitment in order to provide quality customer service.
We use many different technologies in order to provide the best service for our customers. At times, we also have to support customers who are connecting to the GLA network via remote access service. In this case, several remote access assistance technologies are available to help our customers. These technologies allow administrators to take control of the user’s desktop (with the customers permission) to help resolve a problem, gain a better understanding of the situation and gather information.

When connecting remotely to customers home personal computers, it is important to remember that this is different to connecting to computers directly connected to the GLA network.

It is vital to respect our customer’s privacy and personal equipment and remain courteous and professional at all times. Below are the procedures and behaviours that we should follow in order to achieve this.

Method:
Assisting a customer via remote access is an important journey and we should talk them through each step that we take, ensuring the customer remains confident in the work that we do by clearing communicating information.

As a guide, we let the customer know what we are going to do, seek permission from them that this is okay, let them know what we are doing as we do it and what we did when we finish.

Before we connect to their PC:
• In order to connect, it is usually necessary for the customer to open certain browsers or
webpages and allow access via certain prompts. We use this as an opportunity to explain to the customer what they are accepting and how and why it will assist us in helping them.
• We explain and re-assure the customer that the remote access assistance will help us in
diagnosing and fixing the problem and we are sensitive to the fact that it is their personal
equipment. It can be disconcerting for customers to see their Personal Computer being taken control of by someone who isn’t present. Therefore, it is essential to explain in detail what is happening in order to re-assure the customer that the remote access assistance will help us in diagnosing and fixing the problem.
• Ensuring that we actively listen to any questions that the customer may have and address any concerns.

Whilst we’re connected:
• Whilst we are connected to their PC, we ensure that we explain in detail the diagnostic
procedures we’re going through and fully communicate all relevant information. If it is necessary to download, update or make any changes to software or settings, we ensure that we explain in detail, what changes we are making, why we are making them and what the benefits and/ or disadvantages will be, if any.

When we disconnect:
• When we begin to disconnect, we make sure that we re-iterate what changes may have been made along with anything the customer may need to remember for the future or do differently.
• We let the customer know that we’re disconnecting and remind them of anything that they may want to close down.
Once we’re finished:
• We remain with the customer throughout the journey; from before connecting until after closing down and disconnecting. We ensure that we disconnect fully from the remote session and close the conversation once finished.
• Procedures for requests for new IT assets

Delivery & Deployment of New Equipment

1.Aim
When new equipment comes in from the Loading Day the Business Support Officers (BSO) need to be informed. This helps us track the new equipment and monitor its whereabouts at all times. With regards to the deployment of the new equipment certain procedures need to be followed.

2. Method

Delivery of New Equipment

1. All new equipment is delivered to the GLA Loading Bay.
2. Goods are signed for by the Loading Bay Staff.
3. The BSO’s are informed by telephone or email of the delivery.
4. The BSO’s checks the deliveries.
5. The equipment is assigned to the Lower Ground Floor (LGF) storeroom or Secure Room based on their size and quantity. Small valuable goods must be assigned to LGF stores.
6. The Porters are informed via email to the FM Helpdesk to move the goods from the Loading Bay to the assigned storeroom.
7. Equipment is Asset tagged, i.e. PCs, Monitors, PDAs, Printers, Servers, and Peripherals.
8. An Equipment Issue Form is completed by BSO’s giving details of the serial number, asset number, Project details and the name of the Requestor. This is attached to all boxes and packages.
9. A work order is created for the TG Service Desk to inform the team of the deliveries awaiting deployment.
10. If all items have been delivered, update the Purchase Order record in TrackIT to “receive all items”. The items will be posted to “unassigned equipment” and from there transferred to the correct Workstation.
11. The paper copy of the Purchase Order is marked “received” or “R”. This can then be filed in the “awaiting invoices” section in the Current Order’s file.
a. The paper copy of PO’s is saved to the SharePoint folder
b. The paper copy of the delivery note is saved in the SharePoint folder

Deployment of New Equipment

1. Keys are required to enter storerooms or cabinets. The Secure Room key is located from the key cabinet in LGF stores. Keys for the cabinets located in the LGF stores are acquired from the BSO’s.
2. BSO’s remove new Asset equipment from LGF Stores or Secure Room in response to outstanding logged calls only.
3. TG Service Desk Support Officers prepare equipment for deployment, i.e. GLA builds on PCs and Laptops.
4. BSO’s to complete ‘Equipment Issue Form’ when TG Service Desk Support Officers are
dispatching new equipment to Users.
5. The recipient or persons receiving the equipment on their behalf must sign these forms.
6. Signature of the BSO’s completes the deployment of the equipment.
7. Completed forms must be passed to the BSO’s.
8. The Asset Register is updated.

Procedures for the installation and disposal of IT equipment

Hardware Asset Management - Recycling & Retiring Configuration Items Aim
The aim of this procedure is to document one of the lifecycle processes - recycling and retiring physical Configuration Items (CIs), accessories and peripherals.

This can occur for several reasons:
• No longer required (Not faulty)
• End of Life (Not faulty but needs upgrading)
• Faulty (Needs to be replaced)

No longer required
1. Service Desk disconnects the equipment from the live environment.
2. An operations note is placed on the disconnected Configuration Item (CI). It should state where the asset came from and the reasons why it is no longer required and the date, etc.
3. The CI should be passed to the Business Team for storage and possible redeployment at a later date.
4. The Inventory should be updated by the Business Team and the CI "Retired" from the live asset register.
5. If kept for redeployment, the asset should be placed in the Secure Storeroom.
6. If held for 6 months without reassigning, the item can be considered for recycling. (Discuss with
Service Owner or at TDB as applicable).

End of Life - Not faulty but needs upgrading

Out of warranty

1. Service Desk passes the make/model/serial number/asset number to the Business team. This information is used to get a quote for the replacement CI.
2. If the CI is decommissioned before replacement arrives, the old asset should be kept until the replacement is received.
3. On receipt of the replacement CI, the end of life asset can be decommissioned.
4. The Inventory should be updated by the Business Team with the new CI information creating a new record.
5. If recycled, the CI should be placed in the secure recycling area awaiting collection.
6. Hardware Asset Management process should be completed to add the new CI to the Inventory.

Under warranty

1. Support request for a replacement part to be logged by the named contact(s) detailed on the support contract.
2. Named contact to follow through until delivered/completed.
3. Hardware Asset Management process should be completed for the new IT asset and the details added to the asset register by the Business Team.
Faulty - no longer required
1. Service Desk disconnects the equipment from the live environment.
2. An operations note is placed on the disconnected IT asset. It should state the nature of the fault.
3. The IT asset should be passed to the Business Team for recycling.
4. The asset register should be updated by the Business Team and the asset "Retired"
5. The equipment should be placed in the secure recycling area awaiting collection.
At all stages the asset register should be updated if the IT asset is recycled or reassigned.

Method
1. Put 'Recycle' labels on the items and place in racks in Lower Ground Floor Secure Storeroom
2. Asset audit has to be undertaken by the TG Business Team
3. TrackIT record of the equipment must be updated from user to recycled.
4. Items are to be placed into the secure room unless otherwise stated.
5. Log call with recycling partner for equipment collection.
6. Once equipment collected and wiped please store collection and data wipe documentation in the relevant folder in the SharePoint folder
• Procedures for the redistribution/reallocation of IT Equipment to new staff
If devices are being reallocated to new staff, the users are expected to follow the procedure for new IT assets again. These steps include:
1. The Business Support Officers (BSO) completing an Equipment Issue Form again including
details of the serial number, asset number, Project details and the name of the Requestor.
2. A work order is created for the TG Service for the deployment.
3. TrackIT inventory is updated with the new information (new user and location).

Procedures for returning equipment from staff who have left the Council

Leavers Procedures

The following steps are the procedures for the retrieval and storage IT equipment from staff who are leaving the Greater London Authority (GLA). This includes:
• Mobile phones (iPhones) and 3G cards
• Laptops, Netbooks and Tablet PCs
• USBs and External Hard Drives etc

Method
1. A “Leavers overnight report to TG and FM” in PDF or Excel format, is sent every night to
the [email protected] generic email address. This is automatically generated by the HR system.
2. The TG Business Team search for equipment held by the leavers listed in the report by using the Track-IT Inventory Search function.
Inventory search results by name:
1. The Business Support Officer (BSO) will email the report to the leaver, copy to the line manager; ask for the leaver to return any equipment. (Though outside of the scope of this procedure, the TG Service Desk Support Officers will take the opportunity to audit the PC for non-standard software licenses).
2. The BSO will agree storage and reallocation procedures with the line manager.
3. The BSO will confirm with the line manager, details of storage and reallocation of equipment (and non-standard software) via email, copy to [email protected]
4. The BSO will raise a Work Order for the Service Desk to action any reallocation of hardware or software.
5. The Technology Group store the spare device(s) and if the team wish to reallocate the device, they will need to follow the procedure again to assign the device to the new starter.

Note: Leavers may depart early from the GLA because of unused annual leave. In these instances, the BSO will liaise with the leavers’ line manager.

Please also see the attached information regarding arrangements for departing staff.

If you have any further questions relating to this matter, please contact me, quoting reference MGLA111021-4994.