DOCUMENT 1 FOI 24/25-1345 - DISCLOSURE LOG OFFICIAL
EXECUTIVE BRIEF
Required Action: For decision / For information PDR: EC24-000104 Critical Date: Due date for Executive action — min. 3 bus. days Div: OCIO
MICROSOFT COPILOT RISK ASSESSMENT
Purpose
1.1. To seek authorisation and inform you of the findings of the Short Form Risk Assessment (SFRA) for the Microsoft 365 CoPilot Trial.
Background
2.1. ASFRA has been conducted on the implementation of Microsoft 365 CoPilot planned trial and determined that the level of residual risk to the NDIA Operating Environment after the application of treatments is LOW.
2.2. This trial is being introduced to a number of different government agencies and is being managed as a project with the Digital Transformation Agency (DTA) of which NDIA is a participant.
2.3. The SFRA conducted to support the trial can be found in Attachment A. Risks 3.1. Three risks were identified in the assessment. This included:
3.1.1. R1 Unauthorised data access
3.1.2. R2 Improper use of output
3.1.3. R3 Instability introduced into the NDIA environment.
3.2. CoPilot is a generative Artificial Intelligence tool integrated with the Microsoft 365 tenancy. It makes use of the existing permissions and access provided to users within the current SharePoint environment. An existing error or misconfiguration of permission could result in output from CoPilot utilising information and producing output that the user may not be permitted to access.
3.3. While a potentially valuable business tool, the output generated by CoPilot may be incorrect or produce biased or unreliable answers. A lack of understanding of the level of trust that can be placed in these tools could result in incorrect data being used to make a business decision.
3.4. CoPilot is a relatively new technology being offered by Microsoft 365. There is currently little experience and knowledge regarding how this tool will function in an established organisation and what impact it may have on the environment.
3.5. Four treatments have been proposed to reduce the residual risk to LOW. These are:
3.5.1. Treatment 1: Development of a process to enable users to report any instances of incorrect or excessive data permissions.
3.5.2. Treatment 2: Restrictions on any direct import of large volumes of participant data
3.5.3. Treatment 3: CoPilot User Awareness training to provide users with perspectives on how to best utilise this tool.
3.5.4. Treatment 4: Incident Disengagement Plan to ensure quick response in the event of problems or degradation of services being introduced into the NDIA environment.
page Fup r6
FOI 24/25-1345 - DISCLOSURE LOG OFFICIAL
- Authorisation
4.1. The Microsoft CoPilot Trial Project Manager, Director of Desktop Services and Director of Cyber Security Operations were consulted during this assessment. They endorse the findings and treatments.
- Recommendation
5.1. That you authorise the use of Microsoft 365 CoPilot within the NDIA environment within the constraints of this risk assessment and the following additional considerations:
5.1.1. CoPilot is in the final stages of an IRAP Assessment. The IRAP Assessment will be made available to trial participants. In the event that significant negative findings are identified in the IRAP Assessment, this authorisation is revisited.
Signature: Date: 24/01/24.
CISO
- Distribution
A copy of this brief has been provided to: Sean Giddings
CISO
- Attachments Attachment A: Microsoft CoPilot Short Form Risk Assessment
page rire
Page 2 of 2