NRS EXECUTIVE MANAGEMENT BOARD MEETING
Thursday 2 October 2025
09:30 – 12:15
Lord Clerk Room, GRH
Attendees:
Alison Byrne Chief Executive, Registrar General and Keeper (Chair)
Director of Corporate Services and Accountable Officer
Director of Customer Service Operations and Archives
Director of Delivery
Interim Director of Statistics
Corporate Governance Manager
Business Support Officer (secretariat)
Head of NRS People Services
Head of Cyber Security, Risk and Resilience
Apologies:
Director of Census Statistics
Corporate Business Assurance Manager
Head of NRS Business Management
Interim Director for Digital & IT Services
Corporate Finance Lead
1. Welcome, Introductions and apologies
Alison Byrne welcomed everyone to the meeting. Apologies were noted as above.
1.1 Members approved the draft minutes from the meeting held on 2 September 2025.
1.2 A review of the action log was undertaken. The Data analyst post was proposed for mid-year budget review. The action log would be updated accordingly.
Action EMB 487: To check in the Mid-Year Review data that the Data Analyst Post had been included. Action Owner: Director of Corporate Services and Accountable Officer
1.3 Members noted the decision log. Alison Byrne requested a link to the EMB decision log be provided in the fortnightly CEO blog to improve EMB transparency on decision making.
Action EMB 488: Comms fortnightly blog standing link to the EMB decision log. Action Owner: BMU / NRS Comms
2.1 Work Force Planning & People Board
2.1.1 The Head of NRS People Services provided an update on Work Force Planning & People Board with the key areas below:
· NRS Core and Census headcount and vacancy figures remained stable between August and September 2025
· 6.84 Full Time Equivalent (FTE) available across Directorates, with improved tracking expected via Oracle’s new Enterprise Performance Management (EPM) module
· Staffing data updates in Oracle Human Capital Management (HCM) delayed full benefits of EPM until November 2025
· Priority posts deemed affordable under current budget assumptions
· Workforce Planning Lead identified for Census Programme, expected to start in November 2025
· Delivery Bodies discussed potential for short-term staff sharing transfers to address skill gaps
· The People Board focused on hybrid working, learning and development, and training budget challenges
· October People Board would explore staff views on hybrid working via survey
2.1.2 EMB noted the paper and provided the following feedback:
· EMB agreed to prioritise outstanding NRS staff vacancies
· HR agreed to explore recharge options
· EMB were supportive of NRS taking part in the Public Bodies Delivery Pilot for short term shared staffing with initial resourcing tested on a small scale for specific roles
· NRS Stats Team had some feedback/lessons learned/suggestions from recent recruitment experiences that would be helpful
· Colleagues in IT also had a helpful set of 'to do list' for different stages of the recruitment process which they used in teams planner. HR would consider/cascading to all staff
· Review new forecasting tools from Oracle alongside developments from next phase of corporate dashboard
· Align the People Board survey with the workplace planning group space delivery plan, space survey and NRS flexible working policy
· Census 2031 recruitment structure and reporting lines were debated
· Digital programme structure and skill needs were flagged for review
Action EMB 489: Align the People Board survey with the workplace planning group space delivery plan, space survey and NRS flexible working policy. Action Owner: Head of NRS People Services
Action EMB 490: Census 2031 Commercial, Finance and Resourcing Group to consider progress on the resource and structure planning for the Programme. Census 2031 to run a workshop for EMB (plus the new programme director, Esta Clarke and Tessa Quinn) in late October on the emerging Programme structure and delivery approach to consider the future staffing requirements and the professional support model (line management for SME functions) from Directors. Action Owner: Director of Census Statistics
3.1 Review of live issues, corporate risks and risk appetite markings
3.2.1 The Director of Corporate Services and Accountable Office provided an overview of live issues, corporate risks and risk appetite markings. A review of the live issues and corporate risks were undertaken by EMB. The logs would be updated accordingly. EMB noted a Risk Appetite Workshop was scheduled for December 2025 with preliminary discussions being held.
3.2.2 EMB provided the following feedback:
· EMB noted Out-of-hours cyber support was identified as a critical issue for HMRC data sharing
· EMB noted options for cyber support included internal rota and external contract
· EMB noted BC out of hours may also be required for emergency responses
· EMB suggested the contract was charged to Census 2031
· EMB noted funding risks for Archive Services Programme
· EMB noted Refreshed Risk Appetite to be drafted by Corporate Business Assurance Team
· EMB agreed Census 2031 should not have a high-risk appetite
Action EMB 491: Digital Archiving Issue to be closed as an issue and rewritten as a risk to reflect current position. Action Owner: Director of Customer Service Operations and Archives
Action EMB 492: Cyber Essentials Plus to be included in the Issues Log and continue to investigate options for achieving Cyber Essentials Plus without SCOTS inclusion. Action Owner: Interim Director for Digital & IT Services
Action EMB 493: Corporate Business Assurance Team to prepare a first draft of the revised risk appetite markings with description of appetites included, liaising as required with Directors, to inform the December workshop on risk appetite. Action Owner: Director of Corporate Services and Accountable Officer (with Corporate Business Assurance Team)
3.2 NRS Security update
3.2.1 The Head of Cyber Security, Risk and Resilience provided an update with the key areas below:
Interim Admin Data Environment Project
· Storage and networking base build completed in July 2025
· Final build for user access and file transfer configuration scheduled for mid-October with user testing to follow
· Data transfer planned for November and December 2025 by Admin Data team with IT support
· IT project supported wider Census business project engaging with HMRC on new data acquisition
· Phase Two of IT project approved to adapt environment based on emerging HMRC requirements
· Objective One delivery remained on track with low overall risk
· Objective Two faced risks due to potential policy, technical or cost constraints
Cyber Update
· SCOTS desktop removed from Cyber Essentials Plus scope due to SG decision
· IASME raised concerns over scope removal causing delays
· CE+ required third-party audit of environments
· Failure to achieve CE+ would require bespoke security assurance efforts by Cyber Team
· HMRC/ONS audits highlighted gaps in out-of-hours cyber incident coverage
· Cyber Team enhanced alerting capabilities for better out-of-hours visibility
· Formal out-of-hours rota being drafted to replace ad hoc on-call service
· Interim coverage provided solely by Cyber Team due to challenges in wider rota formation
Cyber Simulation Exercise for EMT / IMT
· NRS have partnered with CoreToCloud to design and facilitate a cyber simulation exercise
· CoreToCloud use Immersive Labs’ Crisis Sim product to deliver exercises
· CoreToCloud design and deliver exercises for NHS NSS and SG
· Alison Byrne & Director of Corporate Services and Accountable Officer approved the L&D budget in principle, Cyber Team were awaiting on MYR
· Budget approval from EMB to proceed to next steps with CoreToCloud
· On approval look to schedule a suitable date for all parties
· A catch-up call with CoreToCloud was scheduled for afternoon of 2 October 2025
3.2.3 EMB provided the following feedback:
- EMB requested NRS cyber team explored if there was potential for public bodies to set up shared procurement on external cyber support
- Cyber Essentials Plus to be added to NRS Issues Log and potential budget risks
- EMB approved the Cyber simulation exercise budget allocation to proceed to next steps with CoreToCloud.
Decision EMB-D241: EMB approved the Cyber simulation exercise budget allocation to proceed to next steps with CoreToCloud.
Action EMB 494: Alison Byrne to contact Andy McClintock, Chief Digital Officer, Social Security to explore potential shared procurement on external cyber support contract. Action Owner: Alison Byrne
Action EMB 495: Draft a framework outlining out-of-hours coverage and business continuity payment models, supporting discussion with IT on OOH coverage, ensuring consistency with wider practice in NRS and HR allowances. Engage with the Partnership Board on this work. Action Owner: Head of NRS People Services
Action EMB 496: Cyber tabletop exercise to be confirmed and scheduled with EMT and IMT approving funding of £8k in advance of the Mid-Year Review decisions. Action Owner: Head of Cyber Security, Risk and Resilience
The Director of Corporate Services and Accountable Office provided an update on physical security with the key areas below:
· GRH security system: site visits and surveys were underway for design and costing
· Still in discussion with SG on wider security system project
· Archive lockdown rollout was completed successfully
· Updating security controls at WRH
3.3 NRS Information Security Policy
3.3.1 The Director of Customer Services, Operations and Archives presented a proposal to review the approach to information security management in NRS to inform the review of the Information Security policy.
3.2.2 EMB provided the following feedback:
3.3.3 EMB noted the report and agreed the recommendations set out in the paper. EMB asked Iain Gray to develop a draft framework with input from Directors on assets and systems required. EMB requested the Information Governance Committee reported progress to EMB.
Decision EMB-D241: The Information security policy review was approved by EMB to align with current needs and roles.
3.4 Delivery portfolio update
The Director of Delivery provided a Portfolio update which covered progress on strategic projects and corporate planning. EMB noted the report and provided the following feedback:
· EMB noted visibility required to ensure SMEs and corporate functions allocated to the right priorities
Action EMB 497: Map out EMT planning sessions to coordinate publication of strategy and corporate planning over coming months. Action Owner: Director of Delivery
5.1 Finance Q2 outputs
5.1.1 The Director of Corporate Services and Accountable Officer provided an update on Q2 outputs as at August Period Five with the key points below:
· MYR review was on going with final review meetings scheduled with Directors
· Core was projecting a £0.6m overspend, this mainly lay within staffing costs due to the 9% vacancy assumption
· Income was underperforming, to date NRS were expecting this to be £445k under budget
· Census was projecting an underspend for the year of £137k, mainly in the staffing budget. This was being reviewed as part of the MYR and an update would be provided
· Capital was showing a slight underspend of £92k but projecting a materially balanced outturn to year end. Plans would be reviewed as part of midyear review exercise with some reorganisation anticipated
· Programme was projecting an underspend of £162k, with a total of £220k spent year to date. As the majority of spend was anticipated in the final two quarters of the financial year, there was a risk of underutilisation of budget
5.1.2 EMB noted the report and provided the following feedback:
· Finance Q2 outputs financial update showed staffing and goods/services pressures with mid-year review planned
· EMB noted NRS vacancy assumption budget would be reviewed at MYR meeting in October 2025
· EMB noted underspend in digital archiving was with potential reallocation to service design
· Clarification was provided on vacancy cost projections and staffing forecasts
5.1 AOB
5.1.1 EMB noted storm warnings were being monitored with contingency planning in place.
5.2 EMB Forward Look
5.3 EMB noted the forward look.
Next meeting: 4 November 2025
