Cybersecurity is an ongoing priority in healthcare (read: obsession), and the NHS is no different. In June 2026, NHS England held a webinar to update stakeholders on the upcoming changes to cybersecurity in UK healthcare. The webinar provided a broad overview, but you know we like the detail here at 8foldGovernance. Ahead of the consultation, here is what we would like to see from NHS England to improve cybersecurity for patients and healthcare organisations while creating a workable framework for you as healthtech suppliers.
Right now, healthtech suppliers are expected to navigate a highly fragmented compliance landscape. To enter and operate within the NHS, you must often address multiple overlapping security frameworks, including:
While every company would love a single, tailored list of requirements for them, the scale of the NHS means multiple frameworks apply and can currently overlap. This creates confusion and administrative burdens rather than focusing on genuine security outcomes. We believe the industry needs a more streamlined approach.
What should the new NHS cyber framework look like?
DSPT and Done
Rather than adding another framework to the list, we would like to see the NHS consolidate all data protection and cyber security requirements into the DSPT. Because there is already significant overlap between Cyber Essentials, ISO 27001, DTAC, and DSPT requirements, embedding them into one unified framework offers a much clearer route.
The existing organisational categories within DSPT offer a highly workable way to manage this. Larger or higher-risk organisations would face stricter controls, while smaller or lower-risk organisations would face fewer controls, alongside exemptions for holding ISO 27001 or Cyber Essentials Plus certifications.
It’s apparent that cyber security is a focus area for the NHS and many organisations, especially with increasing threats from new technologies and cyberwarfare. To maintain confidentiality and prevent serious outages, the NHS is going to need to apply more cybersecurity controls on itself and on its suppliers. Given that this is the case, these requirements should be put into a framework that organisations are used to, and our recommendation is to start with a logical and well-recognised standard – ISO 27001 – and add UK- or NHS-specific clauses to the standard framework. Precedents already exist for this expansion-pack approach to international standards. For example, the automotive and aerospace industries add additional terms to ISO 9001 to establish their supply chain management requirements, and the French healthcare system uses ISO 27001 as the basis of its Healthcare Data Hosting certification.
Basing NHS compliance on an international standard means that UK companies looking to expand globally will be able to demonstrate their cyber security credentials through a recognised framework. Similarly, international companies looking to support the NHS can implement UK-specific requirements into a system they already recognise. The infrastructure for this assurance already exists, as dozens of organisations are accredited to certify businesses to ISO 27001. Furthermore, certification does not need to become the baseline benchmark. A revised framework could maintain the current DSPT principle, ensuring that only larger or higher-risk organisations face the requirement for independent audits.
Next steps
At the end of September 2026, we were invited to participate in the “NHS England Cyber Third Party Risk Management Standard Research & Refinement Exercise.” We will be sharing these exact recommendations with them (and of course, publishing anything we can find out about the new framework proposal)
What if clear, effective governance became your strongest competitive advantage as you scale rather than something that was holding you back?
- FAQs
Common Questions
What cyber security frameworks apply to NHS suppliers?
The key cyber security frameworks for NHS suppliers are the Data Security and Protection Toolkit (DSPT), Cyber Essentials Plus, Digital Technology Assessment Criteria (DTAC), NHS Supplier Cybersecurity Charter, and for software suppliers – DSIT Software Security Code of Practice.
Is ISO 27001 required for NHS suppliers?
While some procurement frameworks require ISO 27001, these are not common and ISO 27001 is generally not required for NHS suppliers.
What is the NHS Cyber Third Party Risk Management Standard?
The NHS Cyber Third Party Risk Management framework is a work-in-progress cybersecurity standard that NHS England is currently working on to enhance cyber security protections throughout the NHS. Their intention is to make a risk-based framework for cybersecurity controls.
- Book a 30-minute call
Let’s map your cyber compliance
Not sure where to start? We’ll map your DSPT and ISO 27001 requirements together, so you do the work once.
