NHS England Rolls Out Voluntary Cyber Charter for IT Suppliers

The English National Health Service is prodding suppliers to commit to voluntary cybersecurity measures in a bid to prevent disruptive hacks.*

See Also: OnDemand | CISO Leadership Blueprint to Managing Budgets, Third-Party Risks & Breaches

In a Thursday open letter, the publicly funded healthcare system asked vendors handling clinical and confidential information systems to sign up to a voluntary cybersecurity charter. The charter is intended to help the NHS tackle “growing and ever-changing cybersecurity threat level,” the agency said.

Among the proposed measures are regularly patching IT systems, instituting multifactor authentication and requiring IT suppliers to monitor and log their systems to allow prompt incident response in the wake of an incident.

“Signing up to the cybersecurity charter is a helpful and positive step, but it does not amount to a legal obligation,” the NHS said. The government agency is currently mapping its supply chain to minimize risk.

The plea comes in the wake of ransomware hacks targeting IT suppliers. In December 2024, the Russian-speaking ransomware group INC Ransom hit three National Health Service hospitals in the U.K. (see: Cyber Incidents Hit Three NHS Hospitals in UK).

In June 2024, the Russian-speaking Qilin ransomware group attacked Synnovis, a provider of medical laboratory services for NHS hospitals. The attack disrupted services at NHS King’s College and Guy’s and St. Thomas’, forcing the health facilities to reschedule at least 1,500 medical appointments (see: Qilin Ransomware Group Leaks NHS Data).

The voluntary measures come ahead of legislation the government plans to introduce that would boost reporting requirements and introduce more cyber hygiene requirements for essential and digital service supply chain entities (see: UK Government Previews Cybersecurity Legislation).

*Update May 16, 2025 13:02: NHS England, not NHS UK as previously reported, published the letter, meaning the voluntary framework only applies to England and Wales, and not Northern Ireland and Scotland. We regret the error.