Hertfordshire Partnership University NHS Foundation Trust provides health and social care for over 400,000 people. It helps those suffering with mental and physical ill health and learning disabilities across Hertfordshire, Buckinghamshire, Norfolk and North Essex. Employing around 4,000 people, these services are delivered both within the community and in inpatient settings.
The Trust relies on outsourcing various services to ensure it continues to run within its financial constraints. The supply chain is a particular attack vector that the NHS needs to increasingly assure against as cyber threat actors look to incapacitate vital services or compromise confidential and critical patient data.
The organisation faced several formidable challenges that necessitated a comprehensive and robust approach in order to secure their supply chain. With an extensive network of suppliers, service providers, and partners, the Trust needed a 360-degree view of their supply chain and the levels of risk they were tolerating, thus enabling them to plan for improvements. They also needed a way to better assess prospective suppliers on their cyber security practices and generate a risk score so that they could more confidently and independently risk assess new suppliers.
The Trust chose i3Secure to carry out their supply chain assurance and risk framework. They recognised that our specialist consultants have extensive experience working within the NHS and therefore a deep understanding of the unique cyber security challenges faced by healthcare organisations, including their regulatory compliance obligations such as the Data Security and Protection Toolkit (DSPT).
Furthermore, i3Secure’s reputation for flexibility and reliability as a consultancy partner played a crucial role in the decision-making process. Their ability to adapt to the Trust’s schedule and collaborate with stakeholders demonstrated commitment to ensuring a seamless, efficient engagement.
i3Secure’s consultant initiated the process by thoroughly researching each supplier that the Trust had existing contracts with, validating their security certificates, such as ISO 27001 and Cyber Essentials. These credentials were then meticulously catalogued and presented to the Trust, along with renewal dates for each certificate. This empowered the organisation to proactively monitor their suppliers’ certificates and conduct future due diligence.
Subsequently, our consultant conducted an in-depth analysis of the terms and conditions for frameworks utilised by the Trust. This highlighted the obligations to which suppliers were subject before being accepted into those frameworks. An extensive examination of contracts was undertaken, with the objective of extracting detailed security requirements for each supplier. Our consultant then organised these findings into a comprehensive matrix, allowing the Trust to gain a holistic perspective and verify that current requirements were appropriately aligned with each supplier.
To provide a more permanent solution for future supplier risk assessments, i3Secure’s consultants developed a Cybersecurity Maturity Assessment for the Trust. This assessment adopted a similar format to the Cybersecurity Maturity Model Certification developed by the US Department of Defence and incorporated a scoring mechanism, which also considered applicability. This ensured the Trust could accurately gauge prospective suppliers’ cybersecurity maturity, thus facilitating well-informed decision-making and enhanced supply chain assurance.
As a result of the engagement, the Trust achieved comprehensive oversight of its supply chain risk landscape, enabling them to confidently engage with new and existing suppliers.
Our consultant established continuous monitoring in order to help manage third-party risk, giving them an overview of their entire vendor ecosystem. This also allowed them to independently assess their cyber security maturity using the Cybersecurity Maturity Assessment.
Transparent communication channels were set up between the Trust and suppliers, thus enabling prompt response to NHS cyber security concerns and proactive incident management.
i3Secure’s consultants advised the Trust on pre-procurement standards, so that they could establish a minimum threshold of security that vendors must meet before moving forward, neutralising the risk to their systems and networks.
Get in touch with our specialists to learn how we can enhance your cyber security posture.
Contact Us 
Contact