Your name
Your Postion
Organisation
Email
When did you last restore your EPR (or main clinical system) end to end, and time it?
Never
More than 12 months ago
In the last 12 months, partial restore only
In the last 6 months, full and timed
How long did this take?
Less than 4 hours
4 to 8 hours
Longer than 8 hours
Has your board received a report on recovery plans for critical systems, with evidence they've been tested?
No
Plans reported, but not tested
Some tested evidence
Yes, tested evidence in the last 12 months
Are your backups immutable, isolated from the domain, and restore-tested?
No
Some systems only
Yes, but restores not tested
Yes, isolated, immutable and restore-tested
Is the order in which systems are restored agreed with clinicians?
No agreed order
Defined by IT only
Agreed with clinicians, not rehearsed
Agreed and exercised with clinical and operational teams
Where did your last DSPT submission land?
Not met
Approaching standards
Standards met, with gaps in the foundational outcomes
Standards met, foundational outcomes evidenced
Is security monitoring in place 24/7 across identity, endpoints, servers, network and cloud?
No out-of-hours monitoring
Partial, office hours only
24/7, but only part of the estate
24/7 with full coverage, logs collected centrally
Do you keep a register of critical suppliers, with security terms in their contracts?
No
Register only, no assessment
Register and assessment; contract terms partial
All in place and monitored
Do you know which AI tools clinicians are using, and has IG signed off the data each one touches?
Unknown
Some known, few DPIAs
Known, with DPIAs for most
All approved, DPIAs complete, use monitored
Could your infrastructure host AI and analytics workloads while keeping patient data sovereign?
No, or not assessed
Unlikely
With upgrades
Yes
Is any data centre or core infrastructure on the corporate risk register?
Yes, with no plan
Yes, with an unfunded plan
Yes, with a funded plan in progress
No significant infrastructure risk
