IT chiefs of UK's massive health service urge vendors to make public security pledge
(2025/05/19)
- Reference: 1747647195
- News link: https://www.theregister.co.uk/2025/05/19/nhs_it_chiefs_urge_vendors/
- Source link:
Top cybersecurity officials within the UK government and the National Health Service (NHS) are asking CEOs of tech suppliers to pledge their allegiance to sound security by signing a public charter.
The letter refers to ransomware being an "endemic" threat to the NHS, with several disasters hitting healthcare facilities and the health org's supply chain in recent years.
Signed by the NHS's Vin Diwakar and Mike Fell, director of transformation and director of cyber operations respectively, and the government's healthcare CIO Phil Huggins, the letter states: "the severity of incidents, and increasing frequency, has demonstrated a step change in recent months.
[1]
"The complexity of cybersecurity and the NHS's supply chain alongside the endemic criminal cyber threat faced by the UK make partnership crucial," said Fell via LinkedIn.
[2]
[3]
"This letter outlines our commitment to enhancing cybersecurity and ensuring the safety of our digital infrastructure. Collaboration through our supply chain is crucial, and we must work together to protect healthcare and defend as one."
Without naming any attacks specifically in the letter, in just the past 12 months, two major incidents were declared at NHS trusts. Three if you go back a few months further and count [4]INC's attack on NHS Scotland in February 2024.
[5]
Perhaps the most infamous of these was the attack on pathology services provider Synnovis last summer, which led to thousands of appointment cancellations across London and unexpected, last-minute changes to major surgeries.
More recently, the November hit on [6]Wirral University Teaching Hospitals caused it to [7]miss cancer care targets , a follow-up report revealed, and that's not factoring in the deplorable [8]attack on Liverpool's Alder Hey children's hospital later that same month.
The accumulation of attacks has left [9]insiders believing the NHS has a security culture problem, one that's years in the making, which can only be solved by changes at the board level.
[10]
Vendors being asked to sign the charter comes as Britain waits for the Cyber Security and Resilience Bill to take final shape and be implemented. The new legislation will expand the scope of the current Network and Information Systems regulations to promote substantially better protection of supply chains, including those related to the NHS.
The healthcare leaders are making a special appeal to suppliers whose services support clinical systems or process sensitive data on behalf of NHS organizations.
The charter's requirements of vendors are detailed fully in the [11]open letter , but here's a quick summary:
Systems are fully patched against the latest vulnerabilities
Achieve and maintain compliance with the NHS' Data Security and Protection Toolkit (DSPT)
MFA applied to networks and systems
Deploy effective 24/7 cyber monitoring
Reliable, immutable backups to minimise impact to business continuity
Run board-level incident response exercises
Timely reporting of incidents to clients and regulators
Software provided to the DHS [Department of Health and Social Care] meets the [12]Software Code of Practice launched by the NCSC and DSIT last week
The NHS will be launching a self-assessment form at an unspecified time during the autumn months, at which point tech suppliers can sign up to the charter.
"This will allow time for suppliers to work through the eight statements and be ready to commit," the letter reads.
Should these suppliers sign up to the charter, it is purely voluntary – the associated obligations are not legally binding. However the NHS is also reminding them of the legal obligations they already have, such as the contractual agreements with the Service and GDPR.
"Signing up to the Cyber Security Charter is a helpful and positive step, but it does not amount to a legal obligation and does not result in priority or enhanced status in terms of the tendering process for contracts with NHS organizations.
"The requirements of the DSPT remain whether or not you sign up to the Cyber Security Charter."
[13]How sticky notes saved 'the single biggest digital program in the world'
[14]Staff at UK's massive health service still have interoperability issues with electronic records
[15]British govt wants to mainline AI, but its arteries are clogged with legacy tech
[16]Qilin ransomware gang boasts of cyberattacks on cancer clinic, Ob-Gyn facility
Suppliers will also be asked to join future summits and other engagements to share ideas with the NHS and others intended to help secure the UK's healthcare systems.
The expectations set out in the letter will ultimately make their way into NHS contracts, similar to how the Software Code of Practice aims to introduce new standards via industry bodies.
Huggins [17]said : "Over time, the expectations set out in the charter will make their way into assurance processes, contractual terms, and regulatory obligations across the NHS."
NHS contracts are also under review, as part of a cross-government push, so that the cybersecurity expectations of awardees are clear. ®
Get our [18]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2024/06/18/nhs_dumfries_and_galloway_letter/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/11/26/third_major_cyber_incident_declared/
[7] https://www.theregister.com/2025/02/04/cyberattack_on_nhs_hospitals_sees/
[8] https://www.theregister.com/2024/11/29/inc_ransom_alder_hey_childrens_hospital/
[9] https://www.theregister.com/2025/03/10/nhs_security_culture/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/cyber-security-charter-for-suppliers-to-the-nhs/letter-to-ceos-of-suppliers-to-the-nhs?key=8YM7KIaJ934oy55f6ehmKYxSwPYJSLfxa4UjZXg3SOZwGs0au9HfpB4w9dL5PTzd](https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/cyber-security-charter-for-suppliers-to-the-nhs/letter-to-ceos-of-suppliers-to-the-nhs?key=8YM7KIaJ934oy55f6ehmKYxSwPYJSLfxa4UjZXg3SOZwGs0au9HfpB4w9dL5PTzd
[12] https://www.theregister.com/2025/05/12/uks_cyber_agency_and_industry/
[13] https://www.theregister.com/2025/05/16/universal_credit_commons_committee/
[14] https://www.theregister.com/2025/04/10/nhs_electronic_records_face_skepticism/
[15] https://www.theregister.com/2025/03/26/legacy_systems_uk_ai/
[16] https://www.theregister.com/2025/03/05/qilin_ransomware_credit/
[17] https://www.linkedin.com/posts/activity-7328708629350551552-Hczj/?utm_source=share&utm_medium=member_desktop&rcm=ACoAABvgIC0Bx1xUu-E97QUzl6wtDuTtUHlFX7g
[18] https://whitepapers.theregister.com/
The letter refers to ransomware being an "endemic" threat to the NHS, with several disasters hitting healthcare facilities and the health org's supply chain in recent years.
Signed by the NHS's Vin Diwakar and Mike Fell, director of transformation and director of cyber operations respectively, and the government's healthcare CIO Phil Huggins, the letter states: "the severity of incidents, and increasing frequency, has demonstrated a step change in recent months.
[1]
"The complexity of cybersecurity and the NHS's supply chain alongside the endemic criminal cyber threat faced by the UK make partnership crucial," said Fell via LinkedIn.
[2]
[3]
"This letter outlines our commitment to enhancing cybersecurity and ensuring the safety of our digital infrastructure. Collaboration through our supply chain is crucial, and we must work together to protect healthcare and defend as one."
Without naming any attacks specifically in the letter, in just the past 12 months, two major incidents were declared at NHS trusts. Three if you go back a few months further and count [4]INC's attack on NHS Scotland in February 2024.
[5]
Perhaps the most infamous of these was the attack on pathology services provider Synnovis last summer, which led to thousands of appointment cancellations across London and unexpected, last-minute changes to major surgeries.
More recently, the November hit on [6]Wirral University Teaching Hospitals caused it to [7]miss cancer care targets , a follow-up report revealed, and that's not factoring in the deplorable [8]attack on Liverpool's Alder Hey children's hospital later that same month.
The accumulation of attacks has left [9]insiders believing the NHS has a security culture problem, one that's years in the making, which can only be solved by changes at the board level.
[10]
Vendors being asked to sign the charter comes as Britain waits for the Cyber Security and Resilience Bill to take final shape and be implemented. The new legislation will expand the scope of the current Network and Information Systems regulations to promote substantially better protection of supply chains, including those related to the NHS.
The healthcare leaders are making a special appeal to suppliers whose services support clinical systems or process sensitive data on behalf of NHS organizations.
The charter's requirements of vendors are detailed fully in the [11]open letter , but here's a quick summary:
Systems are fully patched against the latest vulnerabilities
Achieve and maintain compliance with the NHS' Data Security and Protection Toolkit (DSPT)
MFA applied to networks and systems
Deploy effective 24/7 cyber monitoring
Reliable, immutable backups to minimise impact to business continuity
Run board-level incident response exercises
Timely reporting of incidents to clients and regulators
Software provided to the DHS [Department of Health and Social Care] meets the [12]Software Code of Practice launched by the NCSC and DSIT last week
The NHS will be launching a self-assessment form at an unspecified time during the autumn months, at which point tech suppliers can sign up to the charter.
"This will allow time for suppliers to work through the eight statements and be ready to commit," the letter reads.
Should these suppliers sign up to the charter, it is purely voluntary – the associated obligations are not legally binding. However the NHS is also reminding them of the legal obligations they already have, such as the contractual agreements with the Service and GDPR.
"Signing up to the Cyber Security Charter is a helpful and positive step, but it does not amount to a legal obligation and does not result in priority or enhanced status in terms of the tendering process for contracts with NHS organizations.
"The requirements of the DSPT remain whether or not you sign up to the Cyber Security Charter."
[13]How sticky notes saved 'the single biggest digital program in the world'
[14]Staff at UK's massive health service still have interoperability issues with electronic records
[15]British govt wants to mainline AI, but its arteries are clogged with legacy tech
[16]Qilin ransomware gang boasts of cyberattacks on cancer clinic, Ob-Gyn facility
Suppliers will also be asked to join future summits and other engagements to share ideas with the NHS and others intended to help secure the UK's healthcare systems.
The expectations set out in the letter will ultimately make their way into NHS contracts, similar to how the Software Code of Practice aims to introduce new standards via industry bodies.
Huggins [17]said : "Over time, the expectations set out in the charter will make their way into assurance processes, contractual terms, and regulatory obligations across the NHS."
NHS contracts are also under review, as part of a cross-government push, so that the cybersecurity expectations of awardees are clear. ®
Get our [18]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2024/06/18/nhs_dumfries_and_galloway_letter/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/11/26/third_major_cyber_incident_declared/
[7] https://www.theregister.com/2025/02/04/cyberattack_on_nhs_hospitals_sees/
[8] https://www.theregister.com/2024/11/29/inc_ransom_alder_hey_childrens_hospital/
[9] https://www.theregister.com/2025/03/10/nhs_security_culture/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCsBPWpvd-6awguK-FYDDQAAAlQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/cyber-security-charter-for-suppliers-to-the-nhs/letter-to-ceos-of-suppliers-to-the-nhs?key=8YM7KIaJ934oy55f6ehmKYxSwPYJSLfxa4UjZXg3SOZwGs0au9HfpB4w9dL5PTzd](https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/cyber-security-charter-for-suppliers-to-the-nhs/letter-to-ceos-of-suppliers-to-the-nhs?key=8YM7KIaJ934oy55f6ehmKYxSwPYJSLfxa4UjZXg3SOZwGs0au9HfpB4w9dL5PTzd
[12] https://www.theregister.com/2025/05/12/uks_cyber_agency_and_industry/
[13] https://www.theregister.com/2025/05/16/universal_credit_commons_committee/
[14] https://www.theregister.com/2025/04/10/nhs_electronic_records_face_skepticism/
[15] https://www.theregister.com/2025/03/26/legacy_systems_uk_ai/
[16] https://www.theregister.com/2025/03/05/qilin_ransomware_credit/
[17] https://www.linkedin.com/posts/activity-7328708629350551552-Hczj/?utm_source=share&utm_medium=member_desktop&rcm=ACoAABvgIC0Bx1xUu-E97QUzl6wtDuTtUHlFX7g
[18] https://whitepapers.theregister.com/
Safe and sound
elsergiovolador
So after years of repeated ransomware hits, the solution is… a voluntary charter with no legal weight, no procurement benefit, and a self-assessment form sometime in the autumn.
Meanwhile, hospitals cancel surgeries, children's wards are breached, and "board-level incident response exercises" are treated as revolutionary thinking.
It’s comforting to know that while attackers evolve rapidly, our defence strategy is still in the “open letter and LinkedIn post” phase.
Yippee
Pen-y-gors
Massive cash injection into the NHS to pay for increased IT security!
What do you mean...? Nope?
Oh, of course, they're putting all the extra cash into paying for more staff. No?
What do you mean, "all the cash is going in profits for private health providers who make donations to Labour ministers"?
Clueless?
Pen-y-gors
For various reasons, I've recently been doing some work to harden security on a number of pretty non-critical websites that were originally developed 10-20 years ago. They still work fine, they don't hold any sensitive data, but the hackers have got really sneaky over the years. I've been genuinely shocked to see the sort of devious things they're attempting, even before you get to social engineering.
I suspect those in power really have no idea of what this implies. Some hefty investment, obvs, but a change in thinking. Security is not just about blocking attacks, it's about accepting that successful attacks WILL happen at some stage, and building systems to minimise the impact. Does this mean a rethink of the entire network architecture? Probably. Is there money to pay for that - not just in the NHS? I think not.
Or you could just mandate national services like the NHS use a national provider. Have it headed up by GCHQ/NCSC. Let them control it.
This fucking nonsense of getting CEOs who exist to make their company's turn a profit to write some meaningless document is just that - nonsense. It won't force them to do anything that requires spending money and time on making it do the job it's meant to do.