{
    "document_id": 16815,
    "page": 73,
    "width_pt": 595.32,
    "height_pt": 841.92,
    "rotation": 0,
    "pipeline_version": "paddleocr-vl-1.6+paul-48",
    "engine": "paddleocr_vl",
    "source_run_id": 16926,
    "item_count": 26,
    "counts_by_type": {
        "figure": 1,
        "header": 3,
        "heading": 3,
        "list": 2,
        "list_item": 14,
        "text": 2,
        "title": 1
    },
    "build_ms": 2,
    "items": [
        {
            "id": "p73.1",
            "order": 1,
            "type": "header",
            "bbox": {
                "l": 39.832,
                "t": 806.16,
                "r": 384.1626,
                "b": 793.92
            },
            "text": "SCOTTISH ENTERPRISE ANNUAL REPORT AND ACCOUNTS 2026",
            "attrs": {
                "block_label": "header"
            },
            "level": 2
        },
        {
            "id": "p73.2",
            "order": 2,
            "type": "header",
            "bbox": {
                "l": 40.7918,
                "t": 786.24,
                "r": 153.809,
                "b": 773.52
            },
            "text": "Accountability Report",
            "attrs": {
                "block_label": "header"
            },
            "level": 2
        },
        {
            "id": "p73.3",
            "order": 3,
            "type": "header",
            "bbox": {
                "l": 538.9314,
                "t": 805.68,
                "r": 553.8084,
                "b": 794.64
            },
            "text": "73",
            "attrs": {
                "block_label": "number"
            },
            "level": 2
        },
        {
            "id": "p73.4",
            "order": 4,
            "type": "figure",
            "bbox": {
                "l": 42.4714,
                "t": 742.56,
                "r": 93.5811,
                "b": 694.08
            },
            "text": "",
            "attrs": {
                "role": "page_header",
                "block_label": "header_image"
            }
        },
        {
            "id": "p73.5",
            "order": 5,
            "type": "title",
            "bbox": {
                "l": 113.7371,
                "t": 726.96,
                "r": 399.2795,
                "b": 710.64
            },
            "text": "Cyber security and operational resilience",
            "attrs": {
                "block_label": "doc_title"
            },
            "level": 2
        },
        {
            "id": "p73.6",
            "order": 6,
            "type": "heading",
            "bbox": {
                "l": 45.5908,
                "t": 671.04,
                "r": 77.0245,
                "b": 658.8
            },
            "text": "RISK",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p73.7",
            "order": 7,
            "type": "text",
            "bbox": {
                "l": 39.592,
                "t": 644.4,
                "r": 552.1287,
                "b": 561.6
            },
            "text": "Within the context of increasingly sophisticated and frequent cyber-attacks on organisations, there is a risk that Scottish Enterprise is subject to a successful attack. In addition, there is also a risk of sustained disruption to our systems/networks/services due to third party actions, negligence/misconduct and/or broader events in the tech ecosystem and supply chain."
        },
        {
            "id": "p73.8",
            "order": 8,
            "type": "heading",
            "bbox": {
                "l": 41.0317,
                "t": 547.44,
                "r": 133.893,
                "b": 533.76
            },
            "text": "This may cause:",
            "level": 3
        },
        {
            "id": "p73.9",
            "order": 9,
            "type": "list",
            "bbox": {
                "l": 39.3521,
                "t": 525.5799999999999,
                "r": 489.2614,
                "b": 403.68
            },
            "text": "",
            "attrs": {
                "item_count": 6
            },
            "children": [
                {
                    "id": "p73.9.1",
                    "order": 10,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.592,
                        "t": 525.5799999999999,
                        "r": 337.6119,
                        "b": 510.24
                    },
                    "text": "Unlawful disclosure of sensitive or personal data.",
                    "marker": "•"
                },
                {
                    "id": "p73.9.2",
                    "order": 11,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.832,
                        "t": 507.75999999999993,
                        "r": 446.55,
                        "b": 492
                    },
                    "text": "Significant and prolonged disruption to SE's operations and services.",
                    "marker": "•"
                },
                {
                    "id": "p73.9.3",
                    "order": 12,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.832,
                        "t": 489.93999999999994,
                        "r": 489.2614,
                        "b": 457.44
                    },
                    "text": "Inability to access/operate key systems/networks that support our business operations, including EIS."
                },
                {
                    "id": "p73.9.4",
                    "order": 13,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.3521,
                        "t": 455.25999999999993,
                        "r": 368.8057,
                        "b": 439.68
                    },
                    "text": "Reputational damage and erosion of stakeholder trust.",
                    "marker": "•"
                },
                {
                    "id": "p73.9.5",
                    "order": 14,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.832,
                        "t": 437.47999999999996,
                        "r": 413.9166,
                        "b": 421.44
                    },
                    "text": "Significant financial penalties under data protection legislation.",
                    "marker": "•"
                },
                {
                    "id": "p73.9.6",
                    "order": 15,
                    "type": "list_item",
                    "bbox": {
                        "l": 40.0719,
                        "t": 419.65999999999997,
                        "r": 448.2296,
                        "b": 403.68
                    },
                    "text": "Increased operational costs due to recovery and remediation efforts.",
                    "marker": "•"
                }
            ]
        },
        {
            "id": "p73.10",
            "order": 16,
            "type": "text",
            "bbox": {
                "l": 39.592,
                "t": 389.76,
                "r": 550.449,
                "b": 340.56
            },
            "text": "This risk has been a principal risk for Scottish Enterprise throughout 2025-26. The external cyber threat landscape remains active and reinforced the need for continuous improvement in our cyber resilience."
        },
        {
            "id": "p73.11",
            "order": 17,
            "type": "heading",
            "bbox": {
                "l": 44.871,
                "t": 323.04,
                "r": 154.7688,
                "b": 309.6
            },
            "text": "KEY MITIGATIONS",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p73.12",
            "order": 18,
            "type": "list",
            "bbox": {
                "l": 39.592,
                "t": 296.29999999999995,
                "r": 547.5696,
                "b": 53.28
            },
            "text": "",
            "attrs": {
                "item_count": 8
            },
            "children": [
                {
                    "id": "p73.12.1",
                    "order": 19,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.832,
                        "t": 296.29999999999995,
                        "r": 501.7389,
                        "b": 263.52
                    },
                    "text": "Dedicated cyber security team working alongside the EIS Cyber Security team, combining central expertise and local support."
                },
                {
                    "id": "p73.12.2",
                    "order": 20,
                    "type": "list_item",
                    "bbox": {
                        "l": 40.0719,
                        "t": 261.62,
                        "r": 531.013,
                        "b": 228.72
                    },
                    "text": "Renewal of Scottish Enterprise's Cyber Essentials Plus accreditation (October 2025) and cyber maturity assessment (October 2024)."
                },
                {
                    "id": "p73.12.3",
                    "order": 21,
                    "type": "list_item",
                    "bbox": {
                        "l": 40.0719,
                        "t": 226.93999999999994,
                        "r": 529.3333,
                        "b": 194.4
                    },
                    "text": "Approved cyber security strategy in place with delivery of associated action plan to address risks in our environment.",
                    "marker": "-"
                },
                {
                    "id": "p73.12.4",
                    "order": 22,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.832,
                        "t": 192.26,
                        "r": 294.1807,
                        "b": 176.4
                    },
                    "text": "Key information security policies in place."
                },
                {
                    "id": "p73.12.5",
                    "order": 23,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.832,
                        "t": 174.43999999999994,
                        "r": 547.5696,
                        "b": 141.84
                    },
                    "text": "Mandatory training for all colleagues on cyber and threat awareness, as well as regular phishing exercises and focused follow-up."
                },
                {
                    "id": "p73.12.6",
                    "order": 24,
                    "type": "list_item",
                    "bbox": {
                        "l": 40.0719,
                        "t": 139.74,
                        "r": 519.9752,
                        "b": 123.6
                    },
                    "text": "Continued work with our shared services partner EIS on cyber security measures.",
                    "marker": "•"
                },
                {
                    "id": "p73.12.7",
                    "order": 25,
                    "type": "list_item",
                    "bbox": {
                        "l": 40.0719,
                        "t": 121.9799999999999,
                        "r": 426.3941,
                        "b": 105.84
                    },
                    "text": "Oversight of key groups, including the Audit and Risk Committee."
                },
                {
                    "id": "p73.12.8",
                    "order": 26,
                    "type": "list_item",
                    "bbox": {
                        "l": 39.592,
                        "t": 104.15999999999997,
                        "r": 537.4917,
                        "b": 53.28
                    },
                    "text": "Business continuity and disaster recovery plans in place for critical assets and processes. Further testing and improvement actions planned for business continuity and disaster recovery arrangements to help reduce the impact of cyber disruption."
                }
            ]
        }
    ],
    "excluded_furniture": {
        "first": [],
        "last": []
    }
}