Annex B
UK BORDER AGENCY (INTERNATIONAl GROUP) RESULTS
OF SURPRISE AUDITS OF COMMERCIAL PARTNERS
CONTEXT
UK Border Agency (International Group) provides
visa services in over 130 countries, promoting travel and migration
and providing a vital component of the UK's immigration controls.
Success of these operations is supported by the use of Commercial
Partners who operate 105 visa application centres (VACs) in 49
countries on behalf of the UK Border Agency (UKBA).
Over 80% of all visa applications are managed
through Commercial Partners. Their use improves the efficiency
and effectiveness of visa operations overseas, delivering an accessible
service to customers and supporting enhanced integrity checks
of visa applicants through the collection of biometric data from
all applicants.
DATA SECURITY
UKBA's contracts with Commercial Partners impose
stringent security assurance requirements for the operation of
VACs. Commercial Partners have to comply with internationally
recognised security standards (including the ISO27001 data security
standard) and have to detail their security measures on a country
by country basis, to address specific security risks to buildings,
people, data and assets.
Compliance with security requirements is reviewed
before each VAC becomes operational. Where Commercial Partners
fail to demonstrate that risks have been adequately mitigated,
decisions to begin operations at VACs have been deferred until
the security situation has improved.
Once VACs are operational, their compliance
is monitored, including through unannounced security audits.
In late 2007 and early 2008, unannounced security
audits took place at VACs in West Africa, the Middle East, South
Asia and Europe.
A team comprising a general security specialist
and a penetration tester audited each VAC against security requirements,
including physical security, compliance with ISO 27001, personnel
security and IT Security Health.
OCTOBER/NOVEMBER
2007 AUDITS
The results of audits completed in 2007 were
satisfactory. The auditors did identify some areas that required
further attention, and UKBA (International Group) has worked with
Commercial Partners to establish plans for remedial action and
has tracked progress against these plans.
JANUARY—MARCH
2008 AUDITS
The audits undertaken so far in 2008 show a
distinct improvement compared to those undertaken in 2007. Overall,
the auditors were satisfied with operations at the VACs. The surprise
audits are proving to be a valuable tool for monitoring the compliance
of Commercial Partners with their contracts.
| 
