Naoise Ó Cearúil (Kildare North, Fianna Fail)
Link to this: Individually | In context

146. To ask the Minister for Finance to confirm if any staff devices (laptops, phones, USBs) containing departmental information or sensitive data were reported lost or stolen in the past five years; the number of devices reported; the data risk involved; and the associated cost of mitigation. [54386/25]

Paschal Donohoe (Dublin Central, Fine Gael)
Link to this: Individually | In context

I can confirm for the Deputy that my department takes cyber, network and data security extremely seriously.  

All members of staff issued with a department owned laptop or mobile phone must confirm their acceptance of the department’s relevant ICT and mobile phone policies. These policies require staff to inform our IT providers immediately if their department issued laptop or mobile phone has been lost or stolen. The device in question can then be remotely wiped and connectivity removed.

Staff are also advised to report the event to relevant policing authorities. My department and IT provider follow relevant guidance from the National Cyber Security Centre (NCSC) on mobile device management for public sector bodies and mobile device security.  ICT services for my department are provided by the Office of the Government Chief Information Officer (OGCIO) under the Department of Public Expenditure, Infrastructure, Public Service Reform and Digitalisation.

Official devices are protected with the latest advanced encryption technologies.  In addition multiple security layers are deployed on official devices for protection including for identity verification. These security measures and controls ensure that the data risks involved are effectively managed and as such are considered to be low.

The security mitigations, controls, measures and policies have been implemented as part of an overall suite of enterprise security systems by OGCIO.  Therefore it is not possible to provide a cost for the specific mitigations indicated.

It should be noted that my department uses USBs on a very limited basis and that they are blocked on the majority of devices. No USBs have been reported lost or stolen in the last five years.  The number of lost or stolen devices as reported by my department’s IT provider in each of the past five years is as follows: