Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, with reference to the Strategic Partnership Arrangement 2024 between Microsoft and the Crown Commercial Service, what guidance is available to civil servants on securing official documents held online.

Everyone who works with government has a duty of confidentiality and a responsibility to safeguard any government information or data that they access or share, and all government departments are required to meet a range of mandatory security standards. The ‘Government Security Classifications Policy’ and ‘Guidance 1.1: Working at OFFICIAL’ set a range of baseline security behaviours and controls for all civil servants to follow on how to process OFFICIAL information securely, wherever it is collected, stored, processed or shared across HMG (electronically, in hardcopy or verbally) and with the wider public sector and external partners. Government departments and other public sector organisations are responsible for ensuring civil servants understand their duties and responsibilities.

Departments have Knowledge and Information Management professionals, and Digital and Data professionals, to help configure access permissions and other protections within their cloud based systems, such as within Microsoft 365.

Microsoft has produced various pieces of guidance for the UK government, in partnership with the Central Digital and Data Office (CDDO), Government Security Group and the National Cyber Security Centre (NCSC). These have been created to support government organisations that use Microsoft 365. They outline how to configure the Microsoft 365 platform to enable a secure and interoperable experience for civil servants operating at the OFFICIAL tier.