Launched in 2021, the NHSx COVID Pass and Letter Service was a critical initiative by the NHS to provide digital COVID-19 vaccination certificates and official vaccination letters to individuals. The service played a vital role in enabling safe travel and access to various venues during the COVID-19 pandemic. NHSx has since been merged with NHS Digital and now operates as part of the NHS England Transformation Directorate.
NHSx required a dedicated Cyber Security Risk Manager for their COVID-19 Pass and Letter Service. This would bring specialised expertise in identifying, assessing, and mitigating vulnerabilities that could compromise the service’s security and integrity.
The role demanded an experienced consultant to assume accountability for the Cyber Security Risk Register and associated tasks. These included identifying digital assets, reviewing existing security measures, and either continuing what was working or mitigating security risks that may pose threats to the programme and NHSx.
i3Secure was appointed to support the Service due to our specialised expertise in healthcare cyber resilience, having worked with numerous NHS Trusts providing cyber security and information assurance consultancy. Our understanding of and flexible approach towards the unique challenges faced by the NHS proved to be key factors for the client in making this decision.
Faced with strict time constraints, NHSx sought an accomplished consultant to oversee the efficient administration of their Cyber Risk Register. The consultant had to:
This included a continuous cycle of identifying, analysing, evaluating, and mitigating NHSx’s cyber security risks.
The client required a consultant with significant risk management experience who could assume a multifaceted role. Their role would range from urgent threat prioritisation to strategic vulnerability management, and from threat modelling to fraud risk guidance. By rigorously executing these responsibilities, our consultant played a pivotal role in securing the NHSx COVID Pass and Letter Service and strengthening cyber resilience amidst evolving threats.
Thanks to i3Secure’s flexible engagement approach, we were able to promptly deploy a seasoned Cyber Risk professional for a four-month tenure, meeting the immediate demands of the role.
Our appointed Cyber Risk Manager conducted an exhaustive assessment of the service’s digital infrastructure, data handling procedures, and third-party integrations. This assessment identified potential vulnerabilities and helped us formulate a robust risk mitigation strategy to address these weaknesses.
Key actions taken during the engagement included:
We implemented a comprehensive cyber security framework designed specifically for the healthcare sector, ensuring alignment with industry best practices and regulatory standards. This framework included:
We carried out regular penetration testing, identifying and addressing critical vulnerabilities before they could be exploited. For example, we uncovered and resolved 12 high-risk vulnerabilities, strengthening the system’s overall cyber resilience.
Our Cyber Risk Manager orchestrated specialized training sessions for NHSx team members, improving their awareness of cyber threats, social engineering tactics, and optimal security practices. This proactive approach helped NHSx staff recognize and avoid potential risks, ensuring a more secure operating environment.
i3Secure played a pivotal role in assisting NHSx in crafting a comprehensive incident response plan. This plan detailed the exact steps for communication, containment, eradication of threats, and post-incident recovery. By preparing NHSx for potential security breaches, we ensured that the team would respond swiftly and effectively.
By implementing these proactive measures, we not only enhanced the security posture of the COVID Pass and Letter Service. We also established a framework for ongoing security management, further bolstering cyber resilience.
i3Secure’s engagement led to substantially improved cyber resilience across multiple facets of the COVID Pass and Letter Service’s cybersecurity infrastructure:
Through penetration testing and remediation efforts, we significantly reduced the potential for exploitation.
By integrating advanced intrusion detection mechanisms, we improved real-time threat detection significant, allowing for quicker responses to potential breaches.
The newly implemented incident response plan was tested and refined, ensuring a faster and more effective reaction time to security events.
NHSx was able to meet regulatory compliance requirements more efficiently, with the assurance that the service was operating under robust security measures. This helped to bolster user confidence in the system, particularly important as the service expanded to handle more users.
By the end of the contract, i3Secure successfully handed over the Cyber Risk Register to the Programme Management Office RAID Lead, ensuring a seamless transition of responsibilities and continued risk management efforts.
As part of our ongoing commitment to NHSx, we provided a roadmap for future cybersecurity enhancements, helping them to remain resilient against emerging threats. This roadmap was designed to guide future improvements in security protocols and risk management processes, providing long-term protection for sensitive health-related data and ensuring sustained cyber resilience.
Get in touch with our specialists to learn how we can enhance your cyber security posture.
Contact Us 
Contact