How should Disclosure Reports work in the future? Contract Management Committee on 20th March 2019

Introduction This agenda item is for discussion not approval Prompted by lessons learned from the progress of AltHANCo Disclosure Report, we would like to discuss how we can improve the process of Disclosure Reports by looking at the following: Re-confirm the aim and purpose of the Disclosure Report The responsibilities for each party associated with the process of considering additional disclosures of information including what the responsibilities are of each party How could the structure of the report be improved to align with the aim and enable more efficient decision making? Whether the Disclosure Report template be improved by being clearer about who is responsible for providing input into it and who is responsible for completing it and scoring the risk.

What is the purpose of Disclosure Requests? Outline how the disclosure will be delivered and the process by which it’ll be delivered, Identify the commercial, security and privacy risks of the service. And present these findings to CoMC so they can make the final risk assessment and approve/defer/reject

Roles and Responsibilities Who is responsible for the completion, management and delivery of Disclosure Requests, and who provides consultancy? We have suggested a RACI for CoMC to review; if agreed, we’ll work with the Contract Managers to embed the RACI Xoserve’s suggestions can be found on the next slide

Ideas for a Disclosure Request RACI If we define RACI by the following, we have come up with two concepts the assignment of ownership: R – Responsible - Takes ownership for the completion and population of the Disclosure Request, and its provision to CoMC for approval; the party responsible can do this using input from the Content Provider A – Accountable - Approval of the Disclosure Request C – Content Provider – Provides the party responsible with information about risks, delivery mechanisms, process of the service, etc. I – Informed – Informed of the progress with the Disclosure Request Concept 1 Concept 2 GT Sponsor CoMC Xoserve GT Sponsor Xoserve CoMC GT Sponsor Xoserve R A C I R A C I

Summary Regardless of which concept is preferred, there needs to be collaboration in the development of the Disclosure Request between Xoserve and the GTs As there are multiple GTs, we are considering whether it would be a good idea to rotate a GT sponsor for each Disclosure Request; therefore, there would be a single GT associated with the development of each Disclosure Request We are also thinking about whether a CoMC sub-group would be useful to support the development of Disclosure Requests As part of the improvement initiative, we’ll also ask the GTs to agree on a DPIA template to be included in each Disclosure Request

Next Steps Xoserve to seek confirmation of the above suggestions, and feedback, from the Contract Managers Does CoMC have any contacts for us to check our framework? Think about who you need in order to support your decision at CoMC Does CoMC have any thoughts on the above slides?