Summary
- The Times reports central funding for annual independent NHS board cyber audits has ended.
- The Scottish government says cyber oversight continues under other assurance arrangements.
- The precise funding decision is attributed to reporting, not presented as independently documented government confirmation.
The Scottish government has stopped centrally funding annual independent cybersecurity audits of NHS health boards, according to a report published by The Times on 17 October. The reported change shifts more responsibility for securing external assessment to individual boards, while ministers maintain that cyber oversight of health services continues through other arrangements.
The Times said the government previously commissioned external firms to examine hospital and health-board security. The newspaper described criticism from opposition politicians and security specialists, who questioned whether internal assurance could replace specialist independent testing. No government decision notice confirming the exact funding change was identified in the material reviewed; the reported withdrawal is therefore attributed to The Times.
The reported decision concerns a specific centrally funded programme of annual independent audits. It is not evidence that Scottish NHS boards have stopped vulnerability management, internal reviews, technical testing, or compliance work altogether. The Scottish government’s position, as reported, is that cyber security remains a priority and oversight continues through its health competent authority and assessment arrangements.
Independent technical testing and framework-based self-assessment are not necessarily interchangeable. A governance framework can establish a consistent description of risks, responsibilities, controls, and maturity. Penetration testing and other specialist assessments may identify exploitable weaknesses in particular networks or applications. Whether a revised assurance model achieves the same coverage depends on the services delivered, their frequency, the qualifications of assessors, and whether findings are independently challenged.
Who pays for independent scrutiny?
Health boards face distinct operating conditions. Clinical environments combine legacy equipment, supplier-managed systems, identity platforms, patient administration services, and networks that cannot always be interrupted on an ordinary corporate maintenance cycle. The approach to testing has to account for clinical continuity, yet systems that are not safely testable without planning can also carry significant operational risk if their weaknesses remain undiscovered.
Moving commissioning responsibility to separate boards may increase local flexibility but could also produce uneven assurance if budgets, supplier contracts, or technical capacity differ. That is a risk to be examined rather than a demonstrated outcome of the reported funding change. The Times’ account does not establish how many boards have reduced testing, which services have been replaced, or how independent assessors will be appointed under the revised approach.
Central procurement can offer common standards and comparable findings across an entire health system. Local ownership can place responsibility closer to the services and the risks being assessed. Neither structure is automatically sufficient: a central review without remediation funding may leave issues unresolved, while locally funded assurance can lack consistency if independent challenge is optional or under-resourced.
Financial accountability also depends on the status of findings. It is possible to complete a risk assessment while leaving substantial work outstanding because remediation requires replacement equipment, service redesign, supplier cooperation, or planned downtime. A reliable comparison of the old and new arrangements would establish not merely the number of audits commissioned, but how findings are escalated, funded, resolved, and retested.
The annual frequency of a centrally commissioned audit is itself only one measure of assurance. Some systems change quickly and may require testing between annual reviews; others depend on long-term supplier contracts and maintenance windows. The reported funding decision should therefore be assessed against what boards can commission independently and whether technical findings are shared across the system. No consolidated list of replacement contracts or agreed minimum external testing requirements was available in the reporting reviewed for this draft, leaving the impact on practical testing coverage unquantified.
The Scottish government’s continuing oversight claims and the newspaper’s account of withdrawn central funding describe different parts of the assurance system. At present, the publicly reported change leaves open which independent tests NHS boards will obtain, what minimum coverage is expected, and whether results will be reported in a comparable form across Scotland.
