January’s open letter from NHS England and DHSC landed quietly, but it matters.
Not because it introduces anything radical.
And not because it signals a sudden wave of audits.
It matters because it confirms something many suppliers, care homes and care providers have sensed for a while:
Cyber security in health and care is no longer just a local IT concern – it’s a shared operational responsibility.
What’s actually changing
The Cyber Security Supply Chain Charter has been around since 2025. Many organisations have already signed up and taken it seriously.
The shift now is engagement.
From January 2026, NHS England and contracting authorities may start conversations with suppliers about:
how systems are patched and supported
whether DSPT is maintained at Standards Met
how MFA is applied, especially on NHS-facing systems
visibility through logging and monitoring
whether backups are immutable and recovery is tested
whether cyber risk is discussed at board level
This isn’t an audit.
It isn’t pass or fail.
It’s about understanding risk in the real world and agreeing sensible improvements where needed, without duplication or unnecessary burden.
Where Black Swan fits into this
At Black Swan Cyber Security Solutions, this isn’t new territory for us.
Our own environment is already aligned with these expectations:
supported, patched systems
MFA by default
monitored endpoints and identities
immutable backups with tested recovery
governance that treats cyber as a business risk, not an IT afterthought
But more importantly, this is the work we already do with:
care homes
domiciliary care providers
professional services firms supporting health and care
Often quietly. Often before it becomes urgent.
Why this matters for care providers and the supply chain
Many care organisations don’t see themselves as “suppliers” in the NHS sense, until a questionnaire lands, or a contract renewal stalls.
The reality is:
patient care depends on interconnected systems
incidents don’t respect organisational boundaries
assurance requests tend to arrive at the worst possible moment
The organisations that cope best aren’t the biggest.
They’re the ones that can evidence what they already do.
That usually means:
DSPT kept current, not rushed
MFA enabled everywhere it reasonably can be
backups that ransomware can’t tamper with
basic logging that tells you what happened, not just that something broke
a plan people recognise when things go wrong
Partnership, not pressure
The tone of the NHS letter matters.
This is about collaboration.
Reducing surprises.
Using existing evidence where possible.
That only works if suppliers and care providers have support that understands:
NHS expectations
the reality of stretched teams
the difference between proportionate controls and box-ticking
That’s where we focus.
No scare tactics.
No gold-plated solutions.
Just helping organisations get to a place where a phone call from a contracting authority is manageable, not disruptive.
If you’re in the health and care supply chain and want to sense-check where you stand, we’re happy to talk it through.
Quietly. Practically. Properly.
