Information Technology (IT) Infrastructure Management Policy

The School operates a defined set of authoritative systems-of-record in accordance with the Information Governance Policy:

• The Student Management System (SMS) is the authoritative system-of-record for student identity, enrolment, engagement, progression and outcomes.
• The Virtual Learning Environment (VLE) is the authoritative system-of-record for learning delivery content and learning activity evidence.
• The Automated Governance System (AGS) is the governance and assurance system-of-record used to manage approvals, committee records, registers, issue logs, workflows, and governance evidence.

Supporting technologies may provide access, presentation, or workflow functionality, but authoritative records must be created, stored, and evidenced only within the designated systems-of-record. This approach ensures traceability, auditability, and defensible evidence for regulated submissions, operational decisions, and compliance obligations.

The Board of Governors retains ultimate accountability for the integrity, resilience, and security of the School’s digital infrastructure. The President is accountable for institutional assurance. Operational ownership of digital architecture, technical controls, resilience, and day-to-day infrastructure management sits with the Director of Technology in their role as Information Governance Lead and Senior Information Risk Owner (SIRO). Oversight and assurance are exercised through the Executive Committee and the Quality, Compliance and Audit Committee in line with the School’s Information Governance framework.

The dedicated IT and AGS Team, operating under the Director of Technology, is responsible for:

• Providing 24/7 support.
• Routinely evaluating and checking the School’s systems for vulnerabilities.
• Using automated monitoring systems to receive alerts for any incidents.
• Maintaining secure, monitored, and tested backups for each system-of-record and critical service using School-approved and contracted infrastructure that meets the School’s security, retention, and resilience requirements, with restoration testing and evidence retained to demonstrate recovery capability in line with the Information Governance Policy and Data Protection Policy.
• Managing system patches to ensure security and stability.
• Implementing security practices such as firewalls, detection systems, and conducting penetration tests.
• Training all staff and students in the use of School technology during their induction.

The IT and AGS Team reports to the Director of Technology, who then reports to the Executive Committee and submits a formal IT infrastructure management report to the Quality, Compliance, and Audit Committee.

IT infrastructure risks are managed as part of the School’s enterprise risk management and information governance framework. Risks relating to systems-of-record, infrastructure resilience, information security, and personal data processing are identified, recorded, and tracked within the School’s governed risk and assurance registers. The Director of Technology is responsible for identifying and assessing technical and operational risks, proposing mitigations, and reporting material risks and trends to the Executive Committee and the Quality, Compliance and Audit Committee. Where risks affect regulated submissions, personal data, or critical services, evidence of assessment, decisions, and mitigations is retained within the governance and assurance system-of-record. This approach ensures that infrastructure risk management is proportionate, documented, and aligned with institutional governance and regulatory expectations.

The School maintains comprehensive IT Regulations, accessible on the School’s website. All staff and students receive induction on these regulations upon joining. The IT Regulations state:

• Users must not compromise the integrity of the IT infrastructure by, for instance, deliberately or recklessly introducing malware or attempting to disrupt or bypass IT security measures.

Additionally, the Academic Governance System (AGS) Policy outlines appropriate use of the AGS. The Director of Technology oversees these policies, ensures their implementation, and reports on their effectiveness.

The School’s IT Incident Response Plan is designed to address IT incidents effectively. The primary goal of the plan is to minimise disruptions to students' learning and ensure the continued delivery of the School's services.

Security incidents, service disruptions, and personal data breaches affecting IT infrastructure must be managed through the School’s governed incident and breach management processes as defined in the Information Governance Policy and Data Protection Policy. All incidents must be logged immediately through the approved service desk or governance system to ensure central recording, triage, and evidence retention. The Director of Technology coordinates technical containment and recovery. The Internal Data Protection Lead coordinates privacy assessment and statutory obligations where personal data is involved. Material incidents are escalated promptly to the President and reported through the Executive Committee and the Quality, Compliance and Audit Committee, with Board oversight where required under the Scheme of Delegation.

The Director of Technology, as the chair, must collaborate with designated School teams to form the Response Committee. The response structure will operate proportionately to the severity and impact of the incident. Coordination meetings will occur at an appropriate frequency to manage containment, recovery, and communication. Status updates, decisions, and actions will be documented within the governance and assurance system-of-record, with formal reporting provided through the Executive Committee and the Quality, Compliance and Audit Committee and escalated to the Board of Governors where required. The President will then formally declare the incident closed.

1. Director of Technology: The Director of Technology chairs the Response Committee.

2. IT and AGS Team: Upon incident occurrence, the IT and AGS Team must assign at least one member to handle the incident exclusively. This member will investigate, contain the incident, oversee resolution, and report to the Director of Technology. They will also act as the secretary, maintaining minutes and tracking actions.

3. Marketing Team: The Marketing Team must designate at least one member to manage communications while the system is down. They will use backup systems to email and text stakeholders and students. The Marketing Team will manage stakeholder communications in line with the School’s incident communication plan, providing timely, accurate, and proportionate updates based on the nature and impact of the incident. Communications must be coordinated with the Director of Technology and President to ensure accuracy, safeguarding considerations, and regulatory compliance. Records of communications must be retained within the governance and assurance system-of-record. The Marketing Team will provide contact details for students to direct all queries through them and maintain a record of all communications.

4. Director of Education (DoE): The DoE ensures minimal disruption to learning and teaching. The School maintains regular backups of the AGS, VLE, and course content on diverse servers, including cloud platforms. If a server fails, the School can switch to alternative servers. In cases of software or platform issues, physical and electronic copies of materials are kept updated for continuity. The School will use Google Classroom, Microsoft Teams, physical classrooms, video conferencing, its website, email, and post for ongoing education. Assessment Regulations may be adjusted during emergencies to maintain flexibility. The DoE will create and provide protocols to the Director of Technology covering communication, timetables, staffing, content, delivery, assessments, and collaboration with external examiners and regulatory bodies. Daily updates will be provided to students through marketing messages and the DoE will coordinate with lecturers to ensure consistent information.

5. Student Success Team: The Student Success Team must assign at least one member to support student wellbeing during system outages. Contact information for the team will be provided to students. The team will implement a plan to maintain student support throughout the incident and is an essential part of the Response Committee.

6. Resources Team: The Resources Team must assign at least one member to help coordinate necessary resources during outages. 

7. Student Experience Committee: The Committee must assign at least one student member to represent student interests.

The Director of Technology is required to meet with the Heads of IT, Marketing, Wellbeing, and the Director of Education (DoE) at least twice each academic year to review and update the Response Plan. During these meetings, specific actions needed to keep the plan current will be assigned, and progress must be reported to the Director of Technology. Regular testing of the plan will also be conducted. The Director of Technology is operationally responsible for maintaining and testing the Response Plan. Ultimate accountability for the effectiveness of incident response arrangements rests with the Board of Governors, with institutional assurance provided by the President and oversight through the Executive Committee and the Quality, Compliance and Audit Committee. It is also the responsibility of all committee members to ensure their teams are trained on the plan.

Following each material incident, a documented post-incident review must be completed to identify root causes, control weaknesses, lessons learned, and improvement actions. The review must include evidence of timelines, decisions, communications, and recovery actions and must be stored within the governance and assurance system-of-record. Findings and recommended improvements are reported through the Executive Committee and the Quality, Compliance and Audit Committee, with Board oversight where appropriate. Actions are tracked to completion to support continuous improvement and demonstrable resilience.

Where an incident does not require full escalation, proportionate response actions may be taken under the School’s governed incident management process. The Director of Technology may coordinate technical and operational actions, with oversight from the President. All such incidents must still be logged, assessed, and evidenced within the governance system to ensure transparency, accountability, and auditability, with escalation applied where impact or risk increases.