Blogs & News
SATRE: Standardised Architecture for Trusted Research Environments – Supporting Capabilities
This is the fifth in a series of five blogs, assessing the Aridhia DRE, our enterprise Trusted Research Environment (TRE), against the SATRE specification. The first blog provided an overview of the SATRE specification, and discussed the importance of open specifications for Trusted Research Environments. The second blog scored the Aridhia DRE against the SATRE Information Governance specification, the third evaluated the DRE against the Computing Technology specification, and the fourth assessed the DRE in respect of the Data Management specification. This blog evaluates the DRE against the SATRE Supporting Capabilities Specification.
Supporting Capabilities and the Aridhia DRE
Overall Score 30/30
The Supporting Capabilities section of SATRE covers all the non-technical capabilities an organisation needs to successfully build and maintain a Trusted Research Environment, including project management, legal and financial support, and the business processes required to ensure service continuity.
We scored the Aridhia DRE at 30 from a possible 30, because:
- • Each Aridhia customer has their own dedicated project manager.
- • All Aridhia DRE users have the support of a full-time service desk team.
- • The Aridhia DRE is backed by a comprehensive business continuity plan which is tested multiple times per year.
- • All customers can be provided with a full breakdown of the costs for running their projects in the Aridhia DRE.
See below for more detail on how the DRE scores against each item in the SATRE Information Governance Specification.
(Note on scoring – where a field has been marked as NA, it is not counted as part of the total possible score for that section.)
SATRE 4.1 – Business continuity management
Score: 4/4
The Aridhia DRE is backed by a comprehensive business continuity plan. This is tested in quarterly business continuity exercises, monthly restore checks, and an annual full restore exercise.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.1.1 | You should have a business continuity plan that includes consideration of loss of service for deployed TREs. | Recommended | 2 |
| 4.1.2 | You should regularly test the aspects of your business continuity plan concerning TREs, and have a process in place to iterate the plan if required. | Recommended | 2 |
SATRE 4.2 – Project and programme management
Score: 2/2
All Aridhia customers have a dedicated project manager for the lifetime of their hub. The PM can assist in all aspects of hub management and connect users with other specialists within Aridhia.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.2.1 | You should ensure that all projects using your TRE have a named project manager. | Recommended | 2 |
| 4.2.2 | You should not give project managers direct access to the TRE. | Recommended | NA |
SATRE 4.3 – Knowledge management
Score: 6/6
The features of the Aridhia DRE are documented in our service description documents. In addition, we provide users with a comprehensive Knowledge Base and online training courses. The customers’ dedicated project manager can arrange bespoke training as required.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.3.1 | You must document all features of your TRE implementation. | Mandatory | 2 |
| 4.3.2 | You should have an education programme in place to upskill stakeholders in the use and management of your TRE. | Recommended | 2 |
| 4.3.3 | You should periodically carry out a training needs analysis (TNA) for all stakeholders included within your TRE provision. | Recommended | 2 |
SATRE 4.4 – Financial management
Score: 6/6
Aridhia customers are provided with a full breakdown of their costs for use of the DRE, which can be tracked on a per project basis. All costs are reviewed by the Aridhia finance team and the assigned project manager to ensure value for money.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.4.1 | You must ensure that all projects using your TRE are aware of any associated costs and are able and willing to pay them. | Mandatory | 2 |
| 4.4.2 | You should be able to track the costs associated with each TRE project. | Recommended | 2 |
| 4.4.3 | You should have a process in place to ensure your TRE provision remains financially sustainable. | Recommended | NA |
| 4.4.4 | You should minimise the cost of your TRE infrastructure wherever possible. | Recommended | 2 |
SATRE 4.5 – Procurement
Score: 2/2
The Aridhia finance team track contract renewals for all suppliers.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.5.1 | You must identify any goods or services that will be needed to operate the TRE and ensure that a plan is in place to purchase them as needed. | Mandatory | 2 |
SATRE 4.6 – IT Service management
Score: 2/2
All users of the Aridhia DRE have the support of a full-time service desk team, and access to a customer portal to raise issues with them. The Service Desk targets a two-hour initial response time for all tickets.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.6.1 | Your TRE must have a team of Operators in place to support projects working with TREs. | Mandatory | 2 |
SATRE 4.7 – Relationship management
Score: 2/2
Customers have a variety of means of providing feedback on the Aridhia DRE. They can do so via the Service Desk portal, through their project manager, or in regular reviews with the DRE product team.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.7.1 | You should have a clear process in place for stakeholders to feedback on your TRE infrastructure. | Recommended | 2 |
SATRE 4.8 – Public Involvement and Engagement
Score: NA
No score is provided for this section. As a platform provider, Aridhia is not involved in the governance of individual projects.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.8.1 | All public engagement activities must include a range of perspectives and be inclusive (*optional for TREs without personal data). | Mandatory* | NA |
| 4.8.2 | Details of TRE operations, data available and projects which have accessed the data should be publicly available (*optional for TREs without personal data). | Mandatory* | NA |
| 4.8.3 | Members of the public should be included in TRE operations and/or oversight (*optional for TREs without personal data). | Mandatory* | NA |
| 4.8.4 | You should publicly share details of incidents, near misses, and mitigations in a timely fashion, in line with good practices for responsible disclosure. | Recommended | NA |
SATRE 4.9 – Legal services
Score 6/6
The Aridhia general council is consulted on all issues related to security, privacy, health and safety laws, regulations, and policies. Our information security team can also provide advice to customers on data protection issues.
| Item | Statement | Importance | Score |
|---|---|---|---|
| 4.9.1 | You should identify areas where legal advice may be required and ensure that you have ready access to it. | Recommended | 2 |
| 4.9.2 | You should identify areas where advice on data protection issues may be required and ensure that you have ready access to it. | Recommended | 2 |
| 4.9.3 | You should identify who will be responsible for managing contracts related to the TRE. | Recommended | 2 |
Hopefully this blog series will have given you some insight into how the DRE measures up when it comes to these standards. We will be writing very soon about where the UK goes next with regards to TRE and SDE certifications, so stay tuned.