Dear Mr Sergeant

Thank you for your request for information under the Freedom of
Information Act 2000.  Under the Act we have 20 working days to respond to
a request, therefore we will aim to provide you with our response by 6
October 2021.  However, please be advised that our resources have been
diverted to support our front-line colleagues who are working tremendously
hard to provide care for our patients, and to those in need of our
services.  As you can hopefully understand, this is resulting in delays
responding to information requests.  We apologise for any inconvenience
this may cause, we do remain committed to responding to your request and
will respond as soon as we are able.  

Should our response to your request breach the statutory timeframe and you
remain unhappy with our response you have the right to complain to the
Information Commissioners Office.  The Information Commissioner’s offices
will be closed for the foreseeable future, and are therefore unable to
receive correspondence via post but can be contacted at
[1]https://ico.org.uk/global/contact-us/

Should you need to contact us in the meantime, please quote reference
number 2021.948.

Kind regards

Freedom of Information Team

Kent Community Health NHS Foundation Trust

The Oast, Hermitage Court

Hermitage Lane, Maidstone

Kent, ME16 9NT

01622 211900

In accordance with GDPR Art. 6(1)(c) processing of your data by Kent
Community Health NHS Foundation Trust is necessary for compliance with its
legal obligation under the Freedom of Information Act 2000 to respond to
you. Please refer to the “access to information” section available on our
website: [2]https://www.kentcht.nhs.uk/about-us/acce...

From: Allan Edwards <[3][email address]>
Sent: 31 August 2021 18:29
To: FOI (KENT COMMUNITY HEALTH NHS FOUNDATION TRUST) <[4][Kent Community Health NHS Foundation Trust request email]>
Subject: FOI request

Good afternoon,

I am writing to you under the Freedom of Information Act 2000 to request
the following information from Kent Community Health NHS Foundation Trust.
Please can you answer the following questions:

 1. In the past three years has your organisation:

 a. Had any ransomware incidents? (An incident where an attacker
attempted to, or successfully, encrypted a computing device
within your organisation with the aim of extorting a payment or
action in order to decrypt the device? )

                                                               i.      If
yes, how many?

 b. Had any data rendered permanently inaccessible by a ransomware
incident (i.e. some data was not able to be restored from back up.)
 c. Had any data rendered permanently inaccessible by a systems or
equipment failure (i.e. some data was not able to be restored from
back up.)
 d. Paid a ransom due to a ransomware incident / to obtain a decryption
key or tool?

                                                               i.      If
yes was the decryption successful, with all files recovered?

 e. Used a free decryption key or tool (e.g. from
[5]https://www.nomoreransom.org/)?

                                                               i.      If
yes was the decryption successful, with all files recovered?

 f. Had a formal policy on ransomware payment?

                                                               i.      If
yes please provide, or link, to all versions relevant to the 3 year
period.

 g. Held meetings where policy on paying ransomware was discussed?
 h. Paid consultancy fees for malware, ransomware, or system intrusion
investigation

                                                               i.      If
yes at what cost in each year?

 i. Used existing support contracts for malware, ransomware, or system
intrusion investigation?
 j. Requested central government support for malware, ransomware, or
system intrusion investigation?
 k. Paid for data recovery services?

                                                               i.      If
yes at what cost in each year?

 l. Used existing contracts for data recovery services?
 m. Replaced IT infrastructure such as servers that have been compromised
by malware?

                                                               i.      If
yes at what cost in each year?

 n. Replaced IT endpoints such as PCs, Laptops, Mobile devices that have
been compromised by malware?

                                                               i.      If
yes at what cost in each year?

 o. Lost data due to portable electronic devices being mislaid, lost or
destroyed?

                                                               i.      If
yes how many incidents in each year?

 2. Does your organisation use a cloud based office suite system such as
Google Workspace (Formerly G Suite) or Microsoft’s Office 365?

 a. If yes is this system’s data independently backed up, separately
from that platform’s own tools?

 3. Is an offsite data back-up a system in place for the following?
(Offsite backup is the replication of the data to a server which is
separated geographically from the system’s normal operating location
site.)

 a. Mobile devices such as phones and tablet computers
 b. Desktop and laptop computers
 c. Virtual desktops
 d. Servers on premise
 e. Co-located or hosted servers
 f. Cloud hosted servers
 g. Virtual machines
 h. Data in SaaS applications
 i. ERP / finance system
 j. We do not use any offsite back-up systems

 4. Are the services in question 3 backed up by a single system or are
multiple systems used?

 5. Do you have a cloud migration strategy? If so is there specific budget
allocated to this?

 6. How many Software as a Services (SaaS) applications are in place
within your organisation?

 a. How many have been adopted since January 2020?

Please provide the information requested in the form of an email.

If it is not possible to provide the information requested due to the
information exceeding the cost of compliance limits identified in Section
12, please provide advice and assistance, under the Section 16 obligations
of the Act, as to how I can refine my request.

If you can identify any ways that my request could be refined I would be
grateful for any further advice and assistance.

If you have any queries please don’t hesitate to contact me via email or
phone and I will be happy to clarify what I am asking for and discuss the
request, my details are below.

Thank you for your time and I look forward to your response.

Best regards,

Allan Edwards

Associate Director

Kaizo

PR: Social: Digital: Content

Email: [6][email address]

Phone: +44 (0) 7956 583080

[7]http://twitter.com/allanedwards

Please check out our work at [8]www.kaizo.co.uk

This message originated from outside of NHSmail. Please do not click
  links or open attachments unless you recognise the sender and know the
content is safe.

show quoted sections

Dear Mr Sergeant

With regard to your request for information via the Freedom of Information
Act 2000, please find attached our response.

Kind regards

FOI Team

Kent Community Health NHS Foundation Trust

The Oast, Hermitage Court

Hermitage Lane, Maidstone

Kent, ME16 9NT

01622 211900

In accordance with GDPR Art. 6(1)(c) processing of your data by Kent
Community Health NHS Foundation Trust is necessary for compliance with its
legal obligation under the Freedom of Information Act 2000 to respond to
you. Please refer to the “access to information” section available on our
website: [1]https://www.kentcht.nhs.uk/about-us/acce...

show quoted sections