³ÉÈË¿ìÊÖ

A full Active Directory recovery was not performed due to not having an environment where this could be done safely. This is now being re-assessed. However, the backups have been used previously to perform granular recovery of Active Directory objects in the live active directory.

A system can be designed and implemented in a manner deemed fit for purpose and resilient, and yet still suffer from an unforeseen incident.

Reduced auditing was in place due to the impact that such services have on systems performance. We are however reviewing this in light of the recent incident and will introduce appropriate and proportionate auditing in due course.

Maternity and emergency services were maintained throughout the period disrupted by the IT incident.

The position of Scottish Government and NHS Greater Glasgow and Clyde remains unchanged. The eHealth Strategy makes clear the commitment for all health boards to become ‘paper-light’ in a controlled and incremental fashion because of the considerable benefits that this brings (including better service continuity and information availability compared to paper). Paper workarounds do have their place in certain circumstances, but increasingly health boards are deploying more resilient ICT which means that information can still be available from alternative digital sources. Each board has business continuity plans, and associated guidance in this area.

Information processing has been completed. All national returns have been provided and all patient transactions processed. No business or patient data was lost.

NHS Greater Glasgow and Clyde regards its IT Information Systems as critical health infrastructure. Accordingly it would not be appropriate to put detailed systems documentation (especially Information Security) into the public domain.

Native Windows Server Backup was not being used prior to the incident. Symantec Backup Exec was used to backup the domain controllers. It was Symantec Backup Exec which was used to recover Active Directory.

NHS Greater Glasgow and Clyde runs dual active data centres, separated by 14 km and the River Clyde. These are linked by multiple super-high speed data connections, making the concept of a passive disaster recovery site redundant. This design is accepted best practice for modern data centres.

The new Local Delivery Plan format, focusing on the 12 priority areas for action in the Routemap to the 2020 Vision for Health and Social Care, will give NHS boards the opportunity to set out the action they are taking to implement Neonatal Care in Scotland: A Quality Framework.

Considerable progress has already been made, with the vast majority of statements in Neonatal Care in Scotland: A Quality Framework already being met, and full implementation taking place over the next five to 10 years.