NHS to investigate suppliers’ security posture

Follows years of high profile cyber incidents

Image:

Hospitals across south London cancelled operations in 2024 following a ransomware attack on supplier Synnovis

The NHS will begin probing suppliers’ cybersecurity risk management stance following a series of cyber incidents.

There has been a steady uptick in the number of high-profile attacks targeting NHS suppliers in recent years. These include one in 2022 against Advanced Computer Software Group, which disrupted services across the country for weeks; a 2024 attack on private blood testing company Synnovis, which saw patients diverted from London hospitals; and a massive data breach at HCRG last year.

In an open letter to suppliers, Phil Huggins - CISO for Health and Care at the Department of Health and Social Care - and Mike Fell - Executive Director of National Cyber Operations at NHS England – note that “the health and care sector is not exempt” from cyber attacks, and “the scale and endurance of the threat” necessitates a “more direct, proportionate engagement with suppliers to safeguard essential services.”

This direct engagement will aim to strengthen cyber resilience across the sector. From this month, NHS England “or the relevant contracting authority” will begin reaching out to suppliers to discuss key cyber controls, with the ability to request supporting information “where relevant.”

NHS England launched the Cyber Security Supply Chain Charter last year, and suppliers began to sign up in November. This month's announcement marks the next step in the resilience process.

The letter stresses that contact from NHS England is “not an audit,” or a “pass or fail exercise.” However, it contains several recommendations for suppliers in how to prepare now – much of which, we would hope, is already common best practice:

Keeping systems supported and patched against known vulnerabilities
Maintaining 'Standards Met' in the Data Security and Protection Toolkit (DSPT)
Applying Multi-Factor Authentication (MFA) and enabling it on NHS-facing products where appropriate
Deploying effective monitoring and logging of critical IT infrastructure
Ensuring backups that cannot be changed, and having tested recovery plans
Conducting board-level exercising
Following the Department for Science, Innovation and Technology and National Cyber Security Centre Software Code of Practice

Questions can be sent to england.cyber@nhs.net.

Designed exclusively for senior security professionals, Computing’s Security Leaders Summit returns to London on 26^th March. Register now to share insights, explore new technologies and uncover real-world solutions for protecting your organisation’s data, infrastructure and reputation.