Cyber security for NHS suppliers

The NHS supplier charter in brief

NHS England's Cyber security charter for suppliers to the NHS is aimed at current and potential IT suppliers to the NHS. Suppliers sign it through an online form on NHS England's digital website, declaring their commitment to eight security practices.

Two points are worth being clear about. First, NHS England describes signing as a statement of intent: there is no commercial or contractual commitment, implied or otherwise, in being a signatory. Second, NHS England advises purchasers to add specific clauses to their procurement contracts so that suppliers make the required cyber security functionality and assurances available. So while the charter itself is voluntary, the practices it describes can be written into tenders, contract clauses and supplier assurance questions.

NHS England also publishes a list of suppliers who have signed. Declarations are reviewed before publication: a supplier must confirm it meets commitments one to seven, with the eighth applying where it supplies software. The list is based on suppliers' own declarations, is not independently verified, and NHS England states that inclusion is not an endorsement, certification or procurement approval.

For a supplier, the sensible reading is that the charter shows what NHS customers will expect, and that being able to evidence each commitment, not just sign, puts you in a stronger position when buyers ask.

The eight commitments and what they involve

The table summarises each commitment in plain words, what it involves in practice and where a managed security service can help. The wording on NHS England's page is the authority; this is our summary.

24/7 monitoring and logging without building a SOC

The fourth commitment is often the hardest for a smaller supplier to deliver in-house: effective 24/7 cyber monitoring and logging of critical IT infrastructure, in a way that prevents and detects attacks and allows investigation afterwards. Staffing that round the clock yourself means a security team on shifts.

The practical route is a vendor managed detection and response service, with logging and retention set up to support investigation. Options we supply include:

• Sophos MDR: 24/7 monitoring and response across Sophos and supported third-party tools, with 90 days of device data and an option to keep a year
• Check Point MDR, MDR 360 or MXDR 360: Check Point analysts across endpoint, email, network, cloud and identity, with incident response included; MXDR 360 adds a fully managed SIEM
• Blackpoint CompassOne Standard: 24/7 MDR and ITDR with SIEM and 365 days of log storage
• CrowdStrike Falcon Complete Next-Gen MDR: CrowdStrike's team monitors, investigates and remediates, with Falcon Next-Gen SIEM available as an add-on that includes 365-day retention as we supply it
• WatchGuard Total MDR: WatchGuard's SOC across endpoints, Firebox firewalls, network detection and identity
• Todyl MXDR: 24/7 analysts monitoring Todyl SIEM, endpoint and SASE data, with retention tiers

What counts as critical IT infrastructure, and which systems feed the service, is something to decide deliberately rather than by default. During scoping we map the systems behind the services you provide to the NHS, agree what is monitored and logged and for how long, and document it so you can show it to customers. Our pages on cyber security monitoring services and SIEM as a service go into more detail.

How our model works. Forever Systems does not run its own security operations centre. The 24/7 monitoring, investigation and response come from the vendor service you choose, run by that vendor's security analysts. We recommend the service, set it up, manage it, act as your escalation point and review it with you. Who does what is written down and confirmed at quote.

DSPT 'Standards Met'

The second commitment ties the charter to the Data Security and Protection Toolkit (DSPT), the online self-assessment that organisations with access to NHS patient data and systems must use to show they practise good data security, measured against the National Data Guardian's 10 data security standards. NHS England notes that this commitment applies to organisations that are required to complete the DSPT. The current version is DSPT 2026-27 (version 9), and NHS England publishes CAF-aligned audit guidance based on the NCSC Cyber Assessment Framework.

Several DSPT areas ask about the same things a managed security service produces: logging and monitoring, protection against malware, managing vulnerabilities and responding to incidents. Our DSPT and security monitoring page maps those areas to MDR, SIEM and incident response. The relationship between the toolkit and Cyber Essentials is explained on DSP Toolkit Cyber Essentials.

MFA, backups, exercising and reporting

The remaining infrastructure commitments are well understood, but they still need doing and evidencing.

Multi-factor authentication. MFA on your own networks and systems is the first step; NHS England also asks suppliers to support identity federation or offer MFA in the products they provide, to help NHS customers meet NHS England's MFA policy. Identity threat detection adds a second layer by watching for suspicious sign-ins and account changes that MFA alone may not stop.

Immutable backups. Backups that cannot be altered or deleted by an attacker, of both business data and products, with recovery plans you have tested. Forever Group supplies cloud backup services; Acronis MDR Advanced can include attack rollback and recovery from backup, by agreement.

Board-level exercising. Running a tabletop exercise with your board shows whether decisions, communications and responsibilities hold up under pressure. Incident response retainers such as the Cisco Talos Incident Response retainer include proactive services like tabletop exercises and playbooks.

Timely reporting. You can only report promptly what you know about. Clear escalation paths from the vendor SOC, which we help you set up and keep current, and vendor case reports help you tell NHS customers what happened, what was affected and what has been done.

Cyber security for healthcare more widely

The same principles apply to healthcare providers themselves, from GP practices and care providers to independent clinics, many of which also complete the DSPT. The vendor services we supply suit organisations without their own security staff, and staff awareness matters as much as technology: cyber security training for healthcare covers phishing and data handling for clinical and administrative teams.

Whether you supply the NHS or deliver care, we can review where you stand against the charter or the DSPT's monitoring and response areas, recommend vendor services that fit, and set them up and manage them. Responsibilities are confirmed at quote and pricing depends on users, devices and data sources, so ask us for a quote.

Contact us to work through the charter's monitoring and logging commitment.