Chamber and committees

I refer the member to the answer to question S5W-17985 on 17 August 2018. All answers to written parliamentary questions are available on the Parliament's website, the search facility for which can be found at http://www.parliament.scot/parliamentarybusiness/28877.aspx

Social Security Scotland is embedding security and cyber protection into the fabric of our architecture and design to gain the confidence of citizens and their trust in the Agency to deliver the devolved benefits with payments made on time, every time.

Working in partnership with the UK National Cyber Security Centre (NCSC), the national technical authority for cyber security, and other key partners such as the DWP, the Agency will ensure that the risk managed approach to solution development aligns with current thinking and the modern approach to the government security policy and practice. This includes being cyber aware, making sound risk-based decisions about cyber security; defence from the majority of cyber-attacks, and being resilient to be able to recover quickly from a successful attack.

The Agency will assess the risks related to cyber-attacks on a continuous basis and the controls that will be established to mitigate cyber-related risk monitored by a dedicated in-house cyber security team.

Cyber security is not solely the job of any one person or role in an organisation – the key strength in defending against such attacks is ensuring that everyone plays their part, and that is why the Agency has already put in place a comprehensive security induction for all Social Security Scotland staff.

The Scottish Government provides a shared IT service (SCOTS Connect) to both the Social Security Directorate and Agency. SCOTS Connect has a strong track record in providing secure, robust, scalable and fit for purpose ICT solutions for the Scottish public sector.

The Scottish Government has in place a range of cyber-security defences to protect SCOTS Connect customers from the threats posed by many modern day threat actors.

Cyber security and defence have been an integral part of successive Scottish Government IT Strategies since the implementation of the first corporate firewalls and anti-virus software in 1999.

The Scottish Government works closely with the NCSC and leading industry experts to ensure our cyber security defences are resilient, proportionate and fit for purpose.

All staff employed by the Social Security Scotland will receive ongoing counter fraud training, tailored to their role and refreshed regularly to reflect emerging trends. This will enable staff to identify fraudulent activity, seek specialist advice where required and take appropriate action.

Staff employed directly in a counter-fraud role will be trained to industry standard, with investigators either having achieved or working towards professional accreditation. Officials have been engaging with the Cabinet Office to ensure Social Security Scotland will be at the forefront of developments in cross-government recognition of Counter Fraud profession as a specialist skillset.

Links have been made with organisations, representing both national and local domestic abuse services, to help in the development of the new social security system in Scotland. In a training context, Social Security Scotland will use these links, alongside insights provided from work with the Experience Panels, to develop specific learning packages, to support staff in identifying vulnerable people and developing the necessary skills.

Social Security Scotland will offer various options so that people can access its services in a way that is convenient to them and tailored to their needs. This will include being able to speak with Social Security Scotland staff in private rooms and home visits being made.

In delivering a service that treats people with dignity, fairness and respect Social Security Scotland staff, especially those based in the local community, will be trained to recognise and assist people that may be vulnerable or at risk. This includes people who may have experienced domestic abuse.

Prevention measures are being carefully considered throughout the design and implementation of our new benefits and are based on detailed risk assessment, established best practice and research from across the wider counter fraud community. This has been further supported by the recruitment of experienced counter fraud practitioners to provide advice throughout design development and implementation.

Details of operational procedures are highly sensitive and cannot be shared in the public domain. However the agency will publish a Counter Fraud Strategy in due course which outlines at high level the methods employed to adequately mitigate the risk of fraud perpetrated by both internal and external threat actors.

Scotland’s new social security agency will participate in lawful sharing of intelligence and collaborative investigative operations alongside Police Scotland and other partners across the counter fraud landscape. Details of operational procedures are highly sensitive and cannot be shared in the public domain. However the agency will publish a Counter Fraud Strategy in due course which outlines at high level the methods employed to adequately mitigate the risk of fraud perpetrated by both internal and external threat actors.

As Universal Credit (UC) is a reserved benefit, the Department for Work and Pensions (DWP) will deliver split payments in Scotland on behalf of the Scottish Government. We will discuss and agree our requirements for the collection of management information and statistics with the DWP as part of the work to deliver split payments of UC for customers in Scotland.

I refer the member to the answer to question S5O-02169 on 31 May 2018. The answer to the oral parliamentary question is available on the parliaments website, the Official Report can be viewed at: http://www.parliament.scot/parliamentarybusiness/report.aspx?r=11571&i=104888