Summary
- NHS England's 19 October guidance provides audit material aligned with the five-objective Cyber Assessment Framework.
- The framework covers governance, access controls, data protection, detection, response, recovery and appropriate information sharing.
- The changes concern assurance and evidence requirements, not the announcement of a wholly new cybersecurity regime.
NHS England has published updated guidance for evaluating cybersecurity and information-governance controls across healthcare organisations, providing auditors with a structured approach to examining the protection and recovery of essential services.
The material, updated and supplemented on 19 October, sits within the Cyber Assessment Framework-aligned Data Security and Protection Toolkit (DSPT) independent assessment guidance.
The guidance is organised around five objectives: managing security risk; protecting against cyberattacks and data breaches; detecting cybersecurity events; minimising the impact of incidents; and using and sharing information appropriately.
The publication does not create an entirely new cybersecurity framework. It develops assessment material within an established NHS assurance process and sets out the control areas independent assessors are expected to consider.
The operational task is to produce evidence of effective arrangements, rather than merely adopt new security policies.
Governance, suppliers and asset management
Objective A concerns the structures used to understand and manage risks to information, systems and networks that support essential functions. Its principles address governance, risk management, asset management and supply chain security.
A healthcare organisation cannot reliably assess the risks to a service without identifying its supporting systems, accountable owners and external providers.
Those dependencies can include electronic patient record systems, clinical applications, identity services, connected medical equipment and outsourced infrastructure.
Assurance should examine whether these relationships are documented and actively managed, rather than checking only that an asset inventory or supplier policy exists.
Protection, detection and recovery
Objective B evaluates proportionate protection measures. Its principles cover policies and procedures, identity and access control, data security, system security, resilient networks and staff awareness.
Access management is particularly significant in healthcare because information must remain available for authorised care while unnecessary or unjustified access to records is restricted.
Assessment includes examining how permissions are granted and withdrawn, how systems are configured, and whether the technical controls support the intended security policies.
Objective C concerns detection, including the ability to identify, assess and investigate suspicious cybersecurity events. Since preventive controls cannot be assumed to stop every incident, monitoring effectiveness affects how quickly an organisation recognises an intrusion and understands its impact.
Objective D addresses incident response and recovery. The organisation must be able to limit consequences and restore essential functions, taking account of identity infrastructure, suppliers and the interdependencies of clinical applications.
A documented recovery plan may be inadequate if it does not identify the infrastructure needed to resume a service safely or the parties responsible for its restoration.
Evidence from exercises, incidents and subsequent reviews helps determine whether lessons have led to practical changes.
Appropriate use and sharing of information
Objective E extends the assessment beyond conventional technical cybersecurity measures to the appropriate use and sharing of information.
It concerns transparency, individuals’ rights, records management and the governance arrangements under which sensitive information is handled.
Healthcare data security depends on more than defending networks from external attackers. Information can also be misused through unjustified access, inappropriate sharing or failures to maintain accountable records.
Assurance must therefore consider how organisations inform people about the use of their information, respond to applicable rights, maintain records and manage authorised sharing between care providers and other parties.
The inclusion of this objective is part of the established CAF-aligned DSPT structure; it is not a newly introduced fifth requirement on 19 October.
Evidence-based assurance across NHS systems
Independent assessments can bring consistency to how organisations document controls and identify gaps, but their value depends on the evidence supporting each conclusion.
Different trusts and care organisations may have different technologies, suppliers and service priorities. The same control objective can therefore require different technical and organisational evidence in different settings.
Assurance also extends across systems outside an organisation’s direct administration where those services are necessary to deliver care or manage information.
The updated material supplies a common framework for examining those dependencies and relating findings to the five assessment objectives.
The wider NHS cybersecurity environment remains under scrutiny over resources, independent audit capacity and the pace at which identified weaknesses are corrected.
NHS England’s 19 October audit pages offer detailed guidance for the 2026/27 assurance process. Their contribution is to clarify the evidence auditors should examine across the existing five-objective framework, not to announce an entirely new security regime.
