NHS Issues Open Letter Demanding Improved Cybersecurity Standards from Suppliers

NHS England and the Department of Health and Social Care issued an open letter on January 22 outlining plans to proactively engage suppliers to strengthen cybersecurity resilience across the UK health and social care system, building on the voluntary supply chain charter and aligned with the Cyber Security and Resilience Bill and Government Cyber Action Plan. The program, framed as collaborative risk identification rather than an audit, sets expectations such as timely patching, maintaining DSPT 'Standards Met', enabling MFA, robust monitoring and logging, immutable backups with tested recovery, and board-level exercising to reduce supply chain risk to patient care and operational continuity.