Costs of Cyber Security Operations Centre: FOI release

FOI reference: FOI/17/01920
Date received: 20 August 2017
Date responded: 30 August 2017

Information requested

The following information:

A detailed and itemised breakdown of the costs of building and operating the Scottish Government Cyber Security Operations Centre in Saughton House, Edinburgh

This should be for FY 2015/16, 2016/17 and both current and projected spend in 2017/18. Please include the cost of all building works, fixtures, fittings and furniture, a list of all electrical and electronic equipment, IT hardware and software (including licences and ongoing support) plus any other equipment used in the Cyber Security Operations Centre.

Response

I will answer your request in two parts. Part one will address the cost per year and part 2 all other information you have requested.

Part One

Financial Year	Spend	Staffing Spend
2015/16	£486,560.59	£48,288
2016/17	£337,299.71	£159,908
2017/18 (Projected)	£466,960	£179,845.15

Part Two

This section relates to an itemised breakdown of the costs including a list of all electrical and electronic equipment, IT hardware and software (including licenses and ongoing support) plus any other equipment used in the Cyber Security Operations Centre. Whilst we are content to provide you with an overall figure for these items as per the details in part one of this reply for part two we are exempt from providing this information under section 30(c) of FOISA (prejudice to effective conduct of public affairs) applies your request.

Disclosing this information would substantially prejudice our ability to protect government assets and digital information. Providing specific details about the poducts and equipment we use in the Cyber Security Operations Centre could subsequently be used by attackers or hackers circumvent these defences. This could therefore enable them to target other types of attack or specific components of our defences and would constitute substantial prejudice to the effective conduct of public affairs in terms of the exemption.

This exemption is subject to the 'public interest test'. Therefore, taking account of all the circumstances of this case, we have considered if the public interest in disclosing the information outweighs the public interest in applying the exemption. We have found that, on balance, the public interest lies in favour of upholding the exemption. We recognise that there is a public interest in disclosing information as part of open, transparent and accountable government. However, there is a greater public interest in protecting government information systems from attack or compromise and ensuring that the Scottish Government is able conduct its business effectively. There is also greater public interest in ensuring that ensuring that any identified vulnerabilities could not be used to attack Scottish Government systems that hold information entrusted to us by the citizens for whom we provide online services, and for whom we also have responsibilities under the Data Protection Act to protect personal information.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses