NHS Cyber Security Charter Signatory
NHS England and the Department of Health and Social Care launched the charter in May 2025, asking current and prospective suppliers to commit to a shared set of cyber security principles. As a cyber security partner to NHS organisations, we signed to show our support for keeping vital public services safe, and to hold ourselves to the same expectations we help our clients meet.
"We welcome the introduction of the Cyber Security Charter, are committed to upholding it, and stand ready to help the NHS and its suppliers strengthen their resilience, both individually and collectively.” - Andy Kays, CEO, Socura
Our commitments under the charter
Supported, patched systems: Keeping our systems in support and applying the latest patches to address known vulnerabilities.
DSPT Standards Met or above: Achieving and maintaining Standards Exceeded in the NHS Data Security and Protection Toolkit .
Multi-factor authentication: Applying MFA across our own networks and systems.
24/7 monitoring and logging: Monitoring our critical IT infrastructure around the clock to prevent, detect and investigate cyber-attacks. This is the same discipline at the heart of the service we deliver to our clients .
Immutable backups and tested recovery: Keeping immutable backups of critical data, with tested plans for business continuity and rapid recovery.
Board-level exercising: Testing our leadership’s ability to respond to a cyber-attack through board-level exercises.
Timely, open incident reporting: Reporting incidents to our customers promptly, meeting all regulatory requirements, and working openly with NHS England if we discover an attack affecting patient care or data.
Supporting your supplier assurance
NHS England publishes the list of suppliers who have signed the charter, so you can confirm our commitment directly. Our pledge builds on our NHS DSPT Standards Exceeded status, ISO 27001 certification and Cyber Essentials Plus , giving health and care organisations independent evidence alongside our public commitment.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
