The US approach to increasing innovation in government

By David Bicknell

I liked a recent blog written in the US by a ‘federal coach’ – I guess they could only get away with that title in the US!- about US government efforts to increase innovation in departments.

The piece makes the point that the White House recently launched an innovation scheme grandly titled the Presidential Innovation Fellows program that will bring in 15 ‘innovators’ from outside government to provide expertise on five technology projects.  

According to the article, within 24 hours of the announcement, more than 600 people had applied to go to Washington for at least six months to work with federal employees on projects aimed at making government more effective and more accountable.

The projects, which will be led by Chief Technology Officer Todd Park and Government Chief Information Officer Steven VanRoekel, include creating an electronic payment system for government transactions involving foreign aid and U.S. operations overseas; and streamlining an online system for citizens in need of federal services.

It sounds impressive. The “Presidential Innovation Fellows program is based in part on the Entrepreneurs-in-Residence  programme that allows agencies to recruit world-class, private-sector innovators for limited periods of time and pair them with public-sector innovators to solve big problems.”

For the US, its scheme of government and the strength of its technology sector, it will probably work. Could such a programme work here? What would be the equivalent of a Presidential Innovation Fellows programme? And how many offers of help would it achieve within 24 hours of its launch?

Whitehall to relent on secrecy over mega projects – after 10-year campaign?

By Tony Collins

The Cabinet Office may be about to change its decade-old policy of not publishing reports on  the progress or otherwise of its large, costly and risky IT-based projects.

A change of policy from secrecy to openness would give MPs and the public warning of when a major project is in trouble and needs rescuing or cancelling.

Parliament last to know

For more than a decade campaigners have sought to persuade successive governments to publish “Gateway” reviews, which are short independent audits on the state of big projects.  The secrecy has meant that Parliament is usually the last to know when new national schemes go wrong. IT-related failures have hit many public services including those related to tax, benefits, immigration, passports, the fire service, prisons, schools examinations, student loans, the police and health services.

Now Sir Bob Kerslake, head of the civil service, has hinted to campaigning Conservative MP Richard Bacon that the Cabinet Office may change its policy and publish the “red, amber, green” status of large projects as they are routinely assessed.

Kerslake was replying to Bacon at a hearing of the Public Accounts Committee meeting on transparency. Bacon pointed out at the hearing that the Public Accounts Committee had, years ago, called for Gateway reviews to be published.

Not learning from mistakes

“Something I have always been puzzled by is why government does not learn from its mistakes particularly but not only in the area of IT where things go wrong again and again, again and again,” said Bacon. “I have come to the conclusion government does not learn from its mistakes because it does not have a learning curve. If you don’t have a learning curve you are not going to learn.”

He cited the example of how Ian Watmore, Permanent Secretary at the Cabinet Office, had, at Bacon’s request, arranged for an “Opening Gate” report on Universal Credit to be published in the House of Commons library.

But, said Bacon, when an IT journalist applied to the Department for Work and Pensions, under the FOI Act, for the release of all Gateway reports on Universal Credit, the DWP would not publish any of them  – and even refused an FOI request to release the report Watmore had arranged to be placed in the House of Commons library, which Bacon obtained.  “So there is still a culture of intuitive, instinctive secrecy,”  Bacon said. Kerslake replied:

“Yes, actually we are looking at this specific issue as part of the Civil Service Reform Plan….I cannot say exactly what will be in the plan because we have not finalised it yet, but it is due in June and my expectation is that I am very sympathetic to publication of the RAG [red, amber, green] ratings.”

Bacon pointed out that the Cabinet Office Structural Reform Plan Monthly Implementation Updates had said Gateway reviews would be published.  But the commitment was removed for no apparent reason. When the Cabinet Office was asked why,  it said the Structural Reform Plans were only ever “drafts”.

Bacon asked Kerslake if the Government now plans to publish the Gateway reports.  “The Cabinet Office Structural Reform Plan Monthly Implementation Updates originally said Gateway reviews would be published  and then it somehow got downgraded into a draft; and from what’s publicly available at the moment the position of the government is not to publish Gateway reviews.  You sound as if you’re saying that’s going to change. Is that right?” asked Bacon.

“Watch this space,” replied Kerslake. “I am sympathetic. I generally broadly welcome, in principle, the idea of publishing information but there are lots of risks …”

Peter Gershon introduced Gateway reviews when he was Chief Executive of the Office of Government Commerce, which is now part of the Cabinet Office’s Efficiency and Reform Group. The reviews are carried out at key decision times in a project and are sometimes repeated:

  • Gateway Review 0 – Strategic assessment
  • Gateway Review 1 – Business justification
  • Gateway Review 2 – Procurement strategy
  • Gateway Review 3 – Investment decision
  • Gateway Review 4 – Readiness for service
  • Gateway Review 5 – Benefits realisation

Are Gateway reviews a success?

Gateway reviews are now supplemented by regular assurance audits carried out for the Cabinet Office’s Major Projects Authority. None of the reports is published.

Gateway reviews have not stopped costly failures such as Firecontrol or the NPfIT.  One permanent secretary told an MP that the reviews in his department were considered unimportant by senior responsible owners, for whom the reports are written. This may be because SROs often have charge of many projects; and even their SRO responsibilities are often in addition to their main jobs.

But Gershon had high hopes of Gateway reviews when they were introduced in February 2001. This is evident from the number of times he referred to Gateway reviews at one hearing of the Public Accounts Committee in December 2001.

 “… as the Gateway review process cuts in, which I have referred to on a number of occasions when I have appeared at this Committee …”

“… Through things like the Gateway process we are helping to sharpen the focus on the whole life aspects of these and other forms of complex projects in public sector procurement…”

“ …First, we have the introduction of the Gateway review process…”

“ … The Gateway process is a demonstrable example of how we have introduced a technique to support that whole life approach…”

“… If you look at the guidelines around the Gateway review process that is one of the things that is tested by these independent reviews …”

“… we recognised that that was a problem some time ago, which is why in the Gateway review one of the things that is explicitly tested is things like the skills and capabilities of the team at the design and build stage and that the skills and capabilities of the team at the procurement stage …”

“… in this area with the Gateway review process, from when we first launched it last February, we have been helping the department take a whole life approach to these forms of complex projects …”

“… Part of the Gateway Review process is to get a much sharper insight on to where we see good things happening where we can encourage other clients to replicate them…”

“… Now, with the Gateway Review process, my experience has been because of where we have deliberately focused the attention on the early life of projects where there is the greater scope for management to take corrective action, the accounting officers are paying a lot of attention to the recommendations that are emerging because, much to my surprise, most of them do not seem to like coming here defending what has gone wrong in the past. They seem to welcome the recommendations that we are providing to them to help try to get projects on to much stronger foundations in the future…”

“… With the Gateway Review, my experience has been that the Accounting Officers respond to the recommendations very positively…”

“…Gateway Reviews explicitly test how the department is planning in the pre-contract phase to secure ongoing value for money in the post-contract phase…”

“… Take, firstly, the Gateway Review process. That is testing various points in the life cycle of the project, from the very earliest stage…”

“… I would certainly expect in Gateway Reviews that the review team would be testing what methods were in place to facilitate the ongoing management of the contract…”

“… I think it is encouraging that Sir Ian Byatt thought the Gateway Review process had sufficient value to recommend it in his own review…”

And so forth.

Comment:

We applaud Richard Bacon MP for his persistent call for Gateway reports to be published.

Gateway reviews have defeated expectations that they would stop failures; and the National Audit Office tells us that central departments don’t even request Gateway reviews on some big and risky projects although they are supposed to be mandatory.

But Gateway and other project assurance reports could prove invaluable if they are published. In the public domain the reports would enable Parliament and Francis Maude’s “armchair auditors” to hold officials and SROs to account for projects that are in danger of failing. That would be an incentive for officialdom to fail early and fail cheaply; and Gateway reviewers may take greater care to be neutral in their findings – not too lenient, or too harsh – on the basis that the reports would be open to public scrutiny. SROs would also have to take the review reports seriously – not just put them in a draw because nobody knows about them anyway.

We welcome Kerslake’s comments but hope that he and his colleagues plan to publish more than the RAG (Red/Amber/Green) status of projects. Otherwise they will be missing an opportunity.  Gateway reports and other assurance reviews are expensive. Reviewers can earn up to £1,000 a day. This money  could be well spent if the reviews are to be published; but it will add to public waste if the reports are kept secret and continue to be deemed pointless or unimportant by departments.

It is ironic, incidentally, that the Ministry of Justice, which introduced the FOI Act, gives advice to departments to keep the RAG status of Gateway reviews confidential. In its advice on Gateway reviews and the FOI, the MoJ tells departments that the “working assumption” is that the substance of the Gateway reports should be kept confidential until at least two years have elapsed.

It’s time for a culture change. Maybe the Civil Service Reform Plan next month will be worth reading.

Queensland audit brings in new broom to sweep away problem IT projects

There is nothing like an IT project disaster to spur the arrival of a new broom designed to ensure that it will never happen again.
 
Until next time.
 
According to the Queensland Courier-Mail in Australia, every computer system used across Queensland’s public service will be probed for flaws and inefficiencies under a A$5.2m audit set up to head off another costly IT project.
 
It follows the emergence of problems with a Queensland Health health payroll project which is now being audited after it was revealed that the costs required to put the project right would increase to over $400 million.
 
Newly appointed Queensland IT Minister Ros Bates ordered the audit to uncover how IT is being used across the government’s 19 departments and find where savings can be made.
 
The audit team, which comprises a seconded army of 32 public servants, will present its findings by the end of October.
 
In addition to the audit, as part of a push to achieve government IT efficiencies, departmental chief information officers have been stripped of their autonomy and will now report to the Queensland Government CIO.
 
Meanwhile, despite its payroll project problems, Queensland Health has won an excellence in eGovernment award for a project dubbed ‘The Viewer’ that has streamlined how clinicians access patient information about their patients.
 
The Viewer is a read-only web-based application that sources key patient information from existing Queensland Health systems, providing consolidated information in one place.
 
Before the project’s  implementation, patient data was stored in a range of paper and electronic record systems in over 260 different facilities.
 

Healthspace was failing in 2010 – why is it being kept alive?

By Tony Collins

“Too many failing projects are continued for too long” – Ian Watmore, House of Commons, 2009.

HealthSpace, a centrally-run system that has, for years, provided unneeded work for consultants based at Connecting for Health, software developers, civil servants, and IT suppliers,  at a cost of tens of millions of pounds, is to close “from” March 2013.

A report commissioned by the Department of Health and NHS Connecting for Health in 2010 found that the system had never worked satisfactorily. But the Department and CfH has kept the project going, paying consultants and IT suppliers, although it was clear from an early stage that the scheme was doomed.

Will the Department of Health continue paying consultants and IT suppliers for a system that is to be cancelled?

HealthSpace was designed to be a personal health organiser. It was based on a good idea – that some patients could benefit from access to their health records – but the technology was too complicated and never fit for the public to use. It is said that those involved in the project spoke in a technological, managerial and procurement language – and rarely mentioned patients.

The Guardian this week reports Charles Gutteridge, national clinical director for informatics at the Department of Health, as saying that Healthspace is “too difficult to make an account; it is too difficult to log on; it is just too difficult.”

The Department of Health later told The Guardian that Healthspace would be closed down “from” March 2013.

In 2010 a report by Trisha Greenhalgh and her team, The devil’s in the detail, which was commissioned by CfH, found that HealthSpace had involved professional advisers, software developers, security testing contractors, business managers who wrote the benefits realisation cases, lawyers who advised on privacy and regulatory matters and many others.

Yet the system was doomed from the start. Greenhalgh’s report in May 2010 revealed that:

“Project leads from participating NHS organisations repeatedly raised concerns with Connecting for Health in monthly management meetings about the low uptake of advanced HealthSpace accounts, since the benefits predicted, such as lower NHS costs and patient driven improvements to data quality, could not possibly be achieved unless the technology was used.”

Comment:

It’s not known how many millions has been wasted – and continues to be wasted – on Healthspace; and it is difficult to avoid the conclusion that the continuance of the scheme benefits nobody except those who are paid to work on it, which includes contractors and IT suppliers.

Why is the scheme to be cancelled “from” 2013, when it should have been cancelled when Trisha Greenhalgh and her team produced their report in May 2010?

Shouldn’t ministers have some control – especially given that we are supposed to be in an age of public sector austerity? Ian Watmore, Permanent Secretary at the Cabinet Office and former Government CIO, has said that failing projects are continued for too long. He said that in 2009. So isn’t it time ministers and particularly civil servants applied the principle of ‘fail early, fail cheaply‘?

Link:

In 2010 ComputerworldUK had an account of how Healthspace was being kept alive unnecessarily.

Fire ‘superstations’ without software cost £1m a month – The Times

By Tony Collins

The Times reports today that taxpayers are paying more than £1m a month on the rent and upkeep of fire control rooms across England that have never been used. The purpose-built control centres look ready for immediate use, with open-plan desks fitted with desktop monitors and keyboards, and huge screens on a wall at the front of the control rooms which are supposed to help fire and rescue crews mobilise appliances and manage incidents.

Only there’s no working software.  The Department for Communities and Local Government negotiated the end of a contract with the main contractor EADS for software to run the regional control centres in December 2010. Officials concluded that the software could not be delivered within an acceptable timeframe. The regional control centres were completed before the IT project was cancelled.

The cost of the centres has been uncovered after a request under the FOI Act. The Times devotes much of its page three to a story under the headline:

Revealed: scandal of the £1m-a-month fire service ‘superstations’ lying empty.

Only one of nine regional centres is in use. The other eight incur rent, electricity, water and repair costs at £1,134,566 a month. Costs will be incurred for years because there are no break clauses in the agreements to lease the buildings. Two leases come to an end in 2027, one in 2028, two in 2032, three in 2033 and one in 2035.

A spokesman for the Department said that agreement has been reached for a further two of the buildings to be used by local fire authorities. Officials are searching for public or private sector tenants to occupy the other regional centres.

Lord Prescott, the former Deputy Prime Minister, who authorised the start of the technology project in 2004,  said he had been kept in the dark by civil servants on the rising costs of the scheme. He said it had been on budget when he left the department in 2007.

Eric Pickles, the Communities Secretary, said the failure of Firecontrol was an “expensive reminder of why you can’t trust Labour to run anything”. But the Coalition’s coming to power has not stopped central government IT-related failures.

Why Firecontrol failed

Firecontrol  followed the same tracks to a cliff edge that have caught out civil servants, ministers and suppliers on other government  computer-related projects.

The National Audit Office and the Public Accounts Committee found that  the Firecontrol project was rushed, had little support from those who would use it, costs and complexity were underestimated, there was an over-reliance on consultants and a lack of accountability for decisions made  – or not made.

The idea was to replace 46 local control rooms with nine, linked regional centres, which would be equipped with new standardised computer systems to handle calls, mobilise equipment and manage incidents.

But the project was cancelled in December 2010 with ministers unsure the technology would ever work. The NAO estimates that £469m will be wasted on the project.

The NAO found that the scheme was “flawed from the outset”, largely because local fire and rescue officers did not want regional centres or major changes in the way they worked.  Introducing any large new system is difficult but with enthusiastic support serious problems can sometimes be overcome; but introducing a complex new system without support from those who would use it means staff will have little incentive to find ways around problems.

The NPfIT [National Programme for IT in the NHS] failed in part because it lacked support among GPs and NHS staff; and the complexity of introducing standardised technology in semi-autonomous hospitals – each one with different ways of working – was underestimated. It was the same with Firecontrol.

The complexity of introducing standardised systems in regional centres with no goodwill among staff – was underestimated.  From the start many local fire and rescue officers criticised the lack of clarity on how a regional approach would increase efficiency. “Early on, the Department’s inconsistent messages about the regionalisation of the Fire and Rescue Service led to mistrust and some antagonism,” said the NAO.

The technology project was rushed while local fire crews were excluded from project discussions. “The project progressed too fast without essential checks being completed. For example Departmental and Treasury approval was given without proper scrutiny of the project’s feasibility or validation of the estimated costs and savings,” said the Public Accounts Committee. The project went ahead before the full business case was written.

A review of the project as early as April 2004 found that the scheme was already in poor condition overall and at significant risk of failing to deliver. But the “Gateway” review report was kept secret for seven years.

Is the stage set for IT disasters in government to continue? So far the Coalition has decided, like Labour, to keep secret all internal reports on the progress or otherwise of its mega projects, including Universal Credit, though the policy on secrecy may be about to change, which Campaign4Change will report on separately.

Firecontrol – same mistakes repeated on other projects.

Watmore’s successor – the biggest challenge?

By Tony Collins

Ian Watmore, Permanent Secretary at the Cabinet Office, leaves at the end of June. What will be the biggest challenge for his successor?  I am told it will be to join up all the efficiency and reform measures:  ICT, digital, procurement, supplier management, project management, new business models, property and rationalisation  so that they are coherent from the point of view of departments, and don’t just look like a random set of instructions from the centre.

Farewell to Ian Watmore – the antithesis of Sir Humphrey

Australian state of Victoria scraps A$500m e-health IT project

By David Bicknell

The Australian state of Victoria has scrapped a A$500m e-health IT project intended to create electronic patient records and prescriptions and will replace it with a ‘patchwork approach.’

According to a report in Victoria’s Herald Sun, Health Minister David Davis confirmed that the government had made a decision to scrap any further rollout of HealthSMART, a project to modernise the health system’s IT which began in 2003.

Davis said the Government would now work on a hospital-by-hospital basis, setting up individual  systems.

The HealthSMART rollout began under the previous state Labour government and is now fully operational at just four health services across Victoria.

In a telling quote, Mr Davis said the Government was determined not to “throw more good money after bad” and would now set up an expert panel to advise it on the best way to upgrade the hospital ICT system.

HealthSMART website

Where to next for Victorian HealthSMART

Farewell to Ian Watmore – the antithesis of Sir Humphrey

By Tony Collins

A good insight into the departure of Ian Watmore comes from Peter Smith of Spend Matters who says:

 “He (Watmore) lives in Cheshire still (and does a weekly commute to London) and this seems to be driven by personal factors – he wants to do more non-executive stuff,  work with charities, education bodies, and support his wife who is being ordained as a vicar shortly.

“There will be a competition to replace him but Melanie Dawes (?) will be the interim Perm Sec.”

Watmore leaves in June at the height of his civil service career. It would be too easy to cite his background as UK Managing Director of Accenture to say that he came to the civil service with a sympathy for big suppliers and not upsetting the smooth-running of the government IT machine.

Indeed he will not go down in civil service history as a heavy-handed enforcer of central government reforms: he respects too much the work of senior civil servants and particularly CIO colleagues to be seen as an opponent whose will cannot be overcome.

Rather he has been an authoritative go-between, a pragmatist who has sought to implement the radical cost-saving measures demanded by the Cabinet Office minister Francis Maude without giving departments any excuse to cite central diktats as the reason for disruption to frontline services.

Watmore gave an insight into his relationship with Maude at a Parliamentary committee hearing earlier this year. His comments also exploded the myth that the private and public sectors can be run on comparable lines.

“I have been on both sides of the divide on private and public,” said Watmore. “The thing that is different about  the public sector is the combination of leadership from the ministerial class and the civil service class. There is no corporate analogue for it. People talk about the way it analogises to the business world—I don’t think it does; it is different…

“I work on a daily basis with Francis Maude. I am not going to make any political comments about Francis, but as a man I feel that he cares about what he is doing;  he knows his stuff and he drives us very hard. In response, I give, shall we say, robust advice in return. Mostly, he listens and sometimes I defer to him and we come back to the same place we started, but more often than not we flesh out the differences behind closed doors and then we come out on a united front. I think that is the best way to get civil service and ministerial leadership. If you have a weakness in one part or the other, the whole thing breaks down.”

At Campaign4Change we will remember Watmore’s career in the civil service for his openness, honesty and lack of ego.

When answering questions before Parliamentary committees, some permanent secretaries seem to see MPs as adversaries. These civil servants’ replies are characterised by clever, evasive or adversarial comments.  They apologise if the mistakes were before their time but usually they’re protective of their departments, as if defending their children against criticism by outsiders.

Watmore is the antithesis of the archetypal civil servant.  Whereas, for example, most civil servants want to keep confidential internal “Gateway” reports on the progress or otherwise of high-risk IT and construction projects, Watmore is on record as saying he would like them published (though they haven’t been).

And he has earned respect among MPs for his straightforwardness. He’ll speak lucidly on his department’s achievements, but not his own.

How much effect he has had on other departments is hard to gauge. It’s difficult to see how the most ruthless enforcer in the Cabinet Office could ever have much influence in other departments.

For though the Cabinet Office has powers from David Cameron to enforce cost-savings,  departmental heads remain accountable for their own decisions. Watmore has spoken of the tensions between the Cabinet Office and departments.  He told MPs earlier this year:

“There are lots of examples where we and Departments have common cause. There will be times when we challenge what they want to do and it can be a tense relationship. Sometimes we agree with what they were going to do anyway, and other times they agree with us, but it means that we are engaging with them.”

Chair: How well is it working on a scale of one to 10 … on the cross-departmental working?

Watmore: “On the whole cross-departmental working, I would say it is somewhere around the six or seven mark. There is more to do.”

Watmore shuns the trappings of high office.  He doesn’t even have an office. “I refuse to have one,” he told MPs this year. “I don’t believe in physical offices for managers. I hot-desk wherever I happen to feel it is appropriate to work that week…

“What I tend to do is I move around and I sit with a different group in the Cabinet Office for a week. Initially people think it is a bit odd having the Permanent Secretary sitting next to them but once you carry on as normal they realise you are just another person working there.

“You actually get to find out quite a lot about how the operation works by being there with the staff for a week as well as hearing from them in a more formal setting…

“It is how I operated when I was in business so it is a long-term way of working. But when I came into Government I discovered it by accident; when I wanted to move the staff from two different bits of Government into a new building and introduce flexible working, hot-desking and all the rest of it, I said, ‘If it is good enough for the rest of the staff, it should be good enough for me…’

Will Maude find someone authoritative and influential but without a big ego to replace Watmore at the top of the Cabinet Office? A difficult assignment.

IT: bringing both growth and headaches for developing nations

By David Bicknell

A number of developing nations are turning to IT to drive economic growth and create new employment opportunities.

Rwanda in Africa recently attracted the interest of the US Carnegie-Mellon University to invest in the country. French writer Francis Pisani is also visiting Rwanda on his global innovation tour.

But investing in IT can create headaches for developing countries too. For example,  a lack of money is threatening to halt the implementation of a Government IT project planned to increase Vietnam’s e-Government capability.  

The project, originally approved by Vietnamese Prime Minister Nguyen Tan Dung in September 2010, has largely failed to get off the ground.

Part of the project’s plan was to apply e-Government at all State-owned agencies from communal to central levels.

But according to the country’s Ministry of Information and Communications, Vietnam News reported, to date, 31 out of 63 provinces and cities across the country have not developed plans to implement the project. Most local authorities say they don’t know where or how to start.

Cao Dang Phuong, head of the ministry’s representative office in Da Nang City, said only seven out of 16 provinces and cities in the central region had plans to carry out the project.

Ho Quang Thanh, director of the Department of Information and Communications in central Nghe An Province, said that the biggest problem for most localities was the lack of funds for implementation.

To Thi Thu Huong, deputy director of the ministry’s IT Department, said: “This is a big project and to bring it into practice is a challenge as there is no financial source for it.”

The ministry has registered to carry out part of the project in 2012 at a cost of VND55.4 billion (US$2.6 million), but the lack of funding has hindered its implementation.

Nguyen Van Hai from the ministry’s IT Application Promotion Department told Thoi bao Ngan Hang (Banking Times) newspaper that VND100 billion (US$4.8 million) had been approved to execute plans at different ministries and localities this year, but it seems that is much too small to drive the successful IT development Vietnam needs.

Security breach costs US CIO his job

By David Bicknell

Beware of data security – a breach can cost you your job.

According to Government Technology, a breach of health data within the Utah Department of Health in the US has cost the state’s CIO, Steve Fletcher, his position.

Fletcher’s departure was part of Utah Governor Gary Herbert’s actions following the breach, which was discovered on April 2 and is believed to have compromised 280,000 Social Security numbers other personal information of an estimated 500,000 people, including names, addresses, birth dates and some details contained in patient health records.

In response to the data loss, Utah has now started a comprehensive security audit of the state’s technology systems and created a new position of “health data security ombudsman.”

The data breach was found to have occurred on March 30, and is believed to have been caused by a weak password that allowed hackers to break through the department’s security and steal the personal information of as many as 780,000 people.

Government Technology reported that the breach was regarded as ‘preventable’, and that the incident shows that greater funding is needed to protect government’s IT systems.

At the same time, it shows the problems CIOs – in both the public and private sectors – face in trying to put adequate protection in place to prevent security breaches before they occur.

The problem is that if you ask for security funding before anything has happened, the request risks being rejected by executives. And if you wait until a breach occurs, as in the latest Utah case, it’s a bit like shutting the gate after the horse has bolted.

Dept of Technology Services CIO resigns over UDOH data breach