The client is one of the leading independent healthcare providers in England, operating a large number of facilities across the country. Its hospitals and clinics deliver a wide range of specialised clinical services, including routine and complex surgery, day case procedures, diagnostic services, and physiotherapy. Given the breadth of services delivered and the critical role of its suppliers — from those providing clinical systems and medical equipment to contractors working within hospital sites — robust supplier assurance was essential to ensure patient safety, compliance, and operational resilience.
The organisation identified weaknesses in its supplier assurance process, which was inadequate for the scale and diversity of its operations. Existing processes were inconsistent, labour-intensive, and failed to provide meaningful assurance over third-party suppliers handling sensitive data and critical services.
The supply chain was vast and varied — ranging from medical equipment providers supporting surgery, to on-site contractors, to software developers delivering critical healthcare applications. Any new framework therefore had to be robust, flexible, and capable of proportionately assessing different types of supplier risk.
Supplier assessments also needed to align to the Digital Technology Assessment Criteria (DTAC) — the NHS national baseline for digital health technologies — which brings together requirements for clinical safety, data protection, technical security, interoperability, usability, and accessibility. Alongside DTAC, the new assurance process also had to meet the relevant clauses of ISO 27001 relating to supplier relationships and third-party risk.
i3Secure was engaged to redesign and deliver a new supplier assurance model. The engagement began with a discovery phase to understand the current process, identify risks, and map inefficiencies. This diagnostic stage provided the evidence base for change.
We then designed a new supplier assurance framework, supported by a policy, standard, and procedure document, to formalise governance and embed accountability across the organisation. Crucially, the programme was delivered in close collaboration with the organisation’s Procurement and IT departments, ensuring supplier assurance became an integrated part of purchasing, contracting, and technical risk management rather than a standalone compliance activity.
Key elements of the delivery included:
The organisation’s supplier assurance process was transformed into a modern, risk-based, ISO 27001-aligned and DTAC-compliant framework. Through OneTrust, assurance became centralised, automated, and scalable. Real-time dashboards gave leaders confidence, intelligent workflows tailored assurance to supplier risk, and automation reduced delays while holding suppliers accountable.
Download the Case Study
Jason McAdam, Director & Co-Founder of i3Secure commented on the work:
“Cyber attackers increasingly exploit third parties and supply chains as entry points into critical systems. For healthcare providers, the stakes are even higher: the compromise of a supplier can directly impact patient safety, service continuity, and trust. That’s why supplier assurance and risk management are not just compliance exercises — they are fundamental to resilience.
“This project shows what’s possible when standards, technology, and collaboration come together. By aligning to ISO 27001 and DTAC, and leveraging OneTrust to automate and scale assurance, we created a framework that is both rigorous and practical. Working closely with Procurement and IT, we ensured supplier risk management became part of the organisation’s DNA, not a siloed process.
“The client was delighted with the outcome. They now have confidence that risks across their diverse supplier base are identified, assessed, and actively managed. For i3Secure, this engagement reinforces the importance of proactive supplier assurance in defending against evolving cyber threats — and the tangible difference it makes to organisational resilience.”
Get in touch with our specialists to learn how we can enhance your cyber security posture.
Contact Us 
Contact