Vacant job

Assignment Description:

Lexicare AB is looking for IT consultants to conduct a comprehensive investigation in line with requirements and principles used by authorities, such as the Swedish Tax Agency's risk assessment.

Assignment Location: Umeå Municipality is flexible with workplace, and work can be carried out in another location in consultation with the municipality.

Scope:

The assignment is divided into two parts. The first part focuses on Microsoft as a supplier. The second part, with an option, focuses on Microsoft's cloud-based services:

• Part 1: Assessment of whether Microsoft as a supplier can meet the requirements in Article 28 GDPR (taking into account, among other things, the CLOUD Act and Microsoft's collection of customer data/information for its own use) and the municipality's ability to legally handle information covered by confidentiality under the Public Access to Information and Secrecy Act (OSL) in Microsoft's services. Including an analysis of their ability to meet other regulatory requirements such as GDPR and OSL
• Part 2: Assessment of Microsoft's cloud-based services focusing on conditions and risks related to information security, IT security, data protection, and confidentiality. Based on a prioritized list of current cloud services for the municipality. Prioritization criteria may include dependencies for risk assessment or services used by many. Subject to adjustment.

Current cloud services may include M365 for Apps (Office), Entra, Teams, Sharepoint, Copilot, Azure, Fabric, OneDrive, Defender, and Purview – but may be adjusted based on priorities. Other cloud services from other providers may also be relevant.

The consultant(s) are expected to deliver the following:

• Report or PM: Documented, descriptive assessment including:
• Indicate how or if Microsoft meets the requirements in Art. 28 GDPR and whether the municipality can legally handle confidential information in Microsoft's services with the current technical and contractual solution.
• Identified risks (including risks related to information security, IT security, data protection, and confidentiality).
• Assessment of identified risks as above
• Proposals for actions and recommendations to reduce or address the risks.
• In parity with the Swedish Tax Agency's assessment, see appendix.
• Workshop: Presentation of the results to relevant stakeholders
• Materials for Continued Work: Training and materials so that the municipality can independently conduct further risk assessments of other cloud services and products after completing the assignment.

Requirements:

• Documented experience in similar risk assessments for public entities or large organizations
• Expertise in areas such as:
• Information security and IT security (level 3-4)
• Legal expertise in IT legislation (e.g., OSL and GDPR) (level 3-4)
• Cloud-based services and technologies
• Ability to analyze and communicate complex information clearly and understandably to various stakeholders

Methodology:

The consultant is expected to use a risk analysis methodology adapted for the public sector and follow established standards.

Schedule:

Contract period: 12 months with an option for a 12-month extension

• Start Date: 2025-01-20
• End Date: 2026-01-20

Objective: We aim to complete Part 1 in the first quarter and be able to deliver, based on the municipality's priorities, Part 2 before the summer of 2025.

Workshops and Presentations: Planned in consultation with the client

Short Application Period:

We review applications continuously and may fill the position before the application deadline. Feel free to submit your application now!

______