I refer the member to the answer to question S5W-35327 on 1 March 2021.

No firm estimate has yet been made of the cost of fully restoring data lost during the cyber-attack.

While SEPA has already restored a number of services, it is likely to take many months to fully recover its capacity to normal levels. This is a sophisticated criminal cyber-attack that has had a major impact on all of SEPA’s work.

Further significant steps to restore IT functionality for SEPA staff are expected towards the end of March and SEPA aims to make significant progress in its recovery by 30 June 2021. Nevertheless, there will be much work to do in the remainder of 2021-22 to fully recover from the cyber-attack.

Drinks with added sugar will no longer be permitted in schools as from 8 April 2021, the date on which The Nutritional Requirements for Food and Drink in Schools (Scotland) Regulations 2020 will come into effect.

Drinks permitted in primary schools will be plain, still or sparkling water; plain lower-fat milk; plain lower-fat, calcium-enriched milk alternatives; and no added sugar, lower-fat milk drinks and drinking yogurts. These drinks will also be permitted in secondary schools, however secondary schools will also be permitted to serve tea, coffee and sugar-free soft drinks (excluding high caffeine - 150 mg per litre).

All school meals must meet the nutrient standards set out in The Nutritional Requirements for Food and Drink in Schools (Scotland) Regulations 2020, ensuring that children and young people are provided with an appropriate amount of energy and nutrients from their lunches. We engaged extensively with the National Farming Union for Scotland, as the representative organisation, whilst the new school food and drink Regulations were being developed and the accompanying statutory guidance was being drafted.

We also carried out a public consultation on the proposed Regulations during the summer of 2018 which received over 1,350 responses, including from organisations representing the farming community and the food and drink industry.

We continue to work closely with stakeholders as preparations are being made for the implementation of the new Regulations on 8 April 2021.

The nutrient standards in The Nutritional Requirements for Food and Drink in Schools (Scotland) Regulations 2020 require that menus provide children and young people with an appropriate amount of a range of nutrients, including iron, as a part of their school lunches.

Once these regulations come into effect on 8 April, schools will be able to provide up to 175 grams of red and red processed meat over the course of a primary school week, and up to 230 grams over the course of a secondary school week. These amounts have been calculated based on the advice given in the Scottish Dietary Goals. Our guidance on Healthy Eating in Schools makes it clear that quality locally sourced Scottish meat is an important source of iron and other nutrients which can contribute towards meeting the nutrient requirements.

However, our guidance recognises that other foods such as tofu, lentils and pulses can also provide those nutrients for children and young people who are unable or unwilling to consume red meat. Some of these iron rich foods already feature on school menus, and we encourage children and young people to eat a wide range of familiar and new foods as part of those menus.

The Scottish Government's Cyber Security Operations Centre continues to proactively monitor the SCOTS network for indicators of compromise related to the SEPA attack. Additional work will be undertaken as necessary to review security arrangements as lessons from the SEPA incident are identified.

In terms of wider public sector, organisations are responsible for their own IT security arrangements. However, the Scottish Government advised public sector organisations on 27 December 2020 to block specific IP addresses associated with this attack. Further recommendations were issued on 8 January to:-

1. highlight phishing guidance and advice on staying safe online,

2. ensure cyber protection technologies were being updated appropriately; and

3. increase vigilance and protective monitoring on all platforms and systems

Any further advice and lessons resulting from the SEPA attack, investigation and recovery will be shared across the public sector organisations by the Scottish Government at the earliest opportunity.

The Scottish Government is not aware of any similar attacks on the Scottish Government or any of its other agencies in the last 12 months.

SEPA’s forecast expenditure for 2020-21 on response and recovery actions is circa £790,000. The assessment of the cost of fully restoring its systems is still a work in progress.

More than 90% of SEPA’s projected charging income for the financial year had already been received ahead of the attack on 24 December. Work is ongoing to assess the extent to which outstanding sums can be recovered this financial year.

The Scottish Government is committed to continuing to work with partners to take forward the recommendations of the National Review of Care Allowances, including consideration of a Scottish Recommended Allowance for foster care and kinship care. This will improve consistency and transparency for looked-after children, their families and their carers across Scotland.

As I advised the Justice Committee when I wrote to them in December, a consultation seeking views on a new framework of legal services regulation, and associated complaints system, initially planned for 2020, was delayed due to the combined pressures of Covid-19 and EU exit. It is now anticipated to follow in the next parliamentary session. I can assure Mr Carson that the consultation will seek views around Parliamentary scrutiny of the legal complaints budget.