Have you checked that your IT system suppliers have robust cyber security arrangements?

Official wording from NHS England

Assertion 10.2: Basic due diligence has been undertaken against each supplier that handles personal information

Does your organisation assure that your IT system suppliers have robust cyber security arrangements?

Your organisation should check that any supplier of IT systems – and your IT support company – has a cyber security certification. This may be done through external assurance, for example if your digital social care record supplier is on the Assured Solutions List then they have been assured by NHS England to meet cyber security requirements. Suitable certifications include: Cyber Essentials – ideally Cyber Essentials Plus. If a supplier states that they have Cyber Essentials, you can use the IASME website (https://iasme.co.uk/cyber-essentials/ncsc-certificate-search) to confirm that they have an in-date certificate. ISO 27001 is an international standard for managing information security. There isn’t a public register of ISO 27001 certified companies. But certified companies will have been issued with a certificate by their certification body so you can ask to see a copy. NHS Data Security and Protection Toolkit Standards Met – ideally Standards Exceeded as if their status is Standards Exceeded this means that they also have Cyber Essentials Plus. You can search the DSPT to check a supplier’s Toolkit status. Briefly explain what cyber security certification your suppliers have and what checks you have undertaken to assure this. If your suppliers do not have a cyber security certification you should briefly outline what activities, you undertake to ensure they are adequately prioritising data protection and cyber security. You could also check that the supplier can provide proof of some form of officially recognised cyber security training such as ISC2 (https://www.isc2.org/certifications). In addition, you could ensure that cyber security requirements are included in the contracts you have with your suppliers. If your organisation does not use any IT systems, then tick and write "Not applicable" in the comments box. Guidance is available from Digital Care Hub (https://www.digitalcarehub.co.uk/data-protection-and-cyber-security/cyber-security/reduce-the-risk-and-impact-of-a-cyber-incident/manage-your-suppliers/).