File – 0010_20180717 HSCN Compliance CR Form

Details of the changes and the relevant documents are contained in the file above

008/20180802

Title – HSCN Network Analytics Service (NAS) – CN-SPs Incident severity classifications around IPFIX feed issues

Change to: Obligations: S01, S02

Dialogue

The Obligations framework states that CN-SPs must send all data to NHS Digital – the Service Addendum states that any loss of data would constitute a Severity 1 incident. After internal discussions around a more granular requirement for NAS data and to reduce the Service overhead of all losses being treated as Severity1, we would like to propose that the Obligation be clarified to state that:

– a Total Loss of NAS data feeds from a CN-SP be classed as a Severity 1 Incident
– a partial loss (single NAS feed failure) be classed as a Severity 2 Incident
– a loss of feed from an NHS Site under contract with the CNSP be classed as a Severity 3 Incident.

In addition, if an issue is detected by the NAS monitoring systems, CN-SPs need to provide responses to the questions contained within an MDS (Minimum Data Set) covering the incident. This should include what NDS logs during the incident and what needs to be provided to enable the CN-SP to investigate and resolve the incident.
Types of issue could include:

• A transmission issue with CNSP data (a CNSP issue)
• A tunnel issue with CNSP data (a NHSD issue)

Main contents of the MDS will include:
• Date/Time the Incident Occurred
• Is there a Workaround available (Details)
• Impact fault is having
• If security related, variant, type, details
• Steps taken for resolution so far
• Contact details for updates
• Customer impact, who and what
• Reference number for previous incidents if applicable.

Comment. –