Skip to main content

NHS Secure Boundary

Our NHS Secure Boundary service is a perimeter security project supporting NHS organisations. Find out how we can help you secure your organisation.

About our Secure Boundary service 

Our Secure Boundary service provides a perimeter security solution offering protection against security threats.

This solution is part of a larger programme of work being delivered by NHS England’s Cyber Operations to ensure the confidentiality, integrity, and availability of patient data, as well as protecting clinical and business systems from emerging threats.

The solution uses next generation firewall (NGFW) and web application firewall (WAF) protection to protect internet traffic from digital and cloud-based threats.

There will be an initial cost to NHS organisations to fund the onboarding. The ongoing run service element is centrally funded and is therefore free for NHS organisations.


Find out about the benefits of NHS Secure Boundary.

Service delivery and onboarding

We currently have 192 organisations onboarded to Secure Boundary, including 22 CNSPs. The high-level process for onboarding is:

  1. Expression of interest.
  2. Data validation.
  3. Onboarding costs agreed.
  4. Technical assessment.
  5. Implementation (migration support).
  6. Ongoing support.

The overall process to onboard is expected to take 6 to 8 weeks for a Prisma onboarding and 1 to 2 weeks for an Imperva onboarding. These timescales may vary depending on the size and complexity of the organisation onboarded.

Accenture will provide tier 2 support into the NHS Customer Service Function with tier 3 support from Palo Alto and Imperva.

Managed services will be delivered utilising an IT Service Management (ITMS) Framework with ISO 20000 accredited ITIL practices.

How it works 

NHS Secure Boundary contains 2 main technology parts, protecting 2 types of internet traffic:

Graphic showing how the service works

Bi-directional traffic (internal traffic) 

This is traffic from within the NHS perimeter. Internet activity is protected by PaloAlto and Prisma Access technology. 

Inbound traffic (external traffic) 

This is traffic from outside of the NHS perimeter. Data is protected by the Imperva Incapsula web application firewall.


Below are details of the different secure boundary components. You can expand them to find out more:

Palo Alto Prisma Access 

This is a software as a service (SaaS) based, modern next-generation firewall (NGFW) capability in the cloud, which can be used by NHS organisations to increase their digital security.  

It includes: 

  • stateful High Availability (HA) pairs of VM-Series NGFW 
  • the ability to be hosted across availability zones 
  • dedicated firewalls for each tenant 
  • a bandwidth pool apportioned to tenants based on identified bandwidths 
Cortex Data Logging Service 

This collates all logs from the firewalls and management platforms within the solution.  

It includes: 

  • retention of traffic, configuration and system logs for 30+ days in Cortex Data Lakes (CDL’s) accessible by an organisation (logs for six months   up to 180 days are accessible via a ticket to the CSF)
  • forwarding of filtered logs to the Cyber Operations, Cyber Security Operations Centre (CSOC), enabling us to monitor cyber events across the NHS estate, and provide rapid protection as incidents and risks emerge

Wildfire is a sandboxing platform designed to identify zero-day threats.  

It includes:  

  • file sandboxing for analysis of unknown threats 
  • creation of signatures to block malware and block the other behaviours 
  • dissemination of threat signatures to all Wildfire users, so detection by one can protect all  
  • static and dynamic analysis over multiple operating systems and application versions 
Panorama Management Console 

Management of the Prisma platform will be done via the central management console, Panorama.  

It includes: 

  • a common Graphical User Interface (GUI) integrated with NHS Mail Single Sign On (SSO) 
  • a tenant-in-tenant approach to provide global and local control 
  • Amazon Web Services (AWS) hosted Panorama with additional NGFWs and role-based access control 
Imperva Cloud Web Application Firewall (WAF) 

This is a SaaS based WAF solution to protect applications from malicious online attacks.  

It includes: 

  • protection against the most critical web application security risks, such as Structured Query Language (SQL) injection, cross-site scripting, illegal resource access, remote file inclusion 
  • multiple capability offerings to meet current and future requirements whilst being cost effective 

Features and capabilities 

Here are some of the features and capabilities offered by the Secure Boundary service. Expand them to find out more:

Uniform Resource Locator (URL) filtering 

Monitors and controls access to websites and website categories. 

Application ID (APP ID) 

Visibility of active applications. 


Protects against​ viruses, worms and​ trojans, and​ spyware.


Prevents spyware and malware from 'phoning home'.

Application whitelisting

Protects against​ potentially harmful​ applications.

File blocking

Blocks files that are known to carry threats.

Zone and DoS protection

Reduces the portion of the​ network exposed to potential​ attack.

Custom signatures

Can be created to detect​ and block specific​ traffic.

Intrusion protection (IPS)

Protects against attempts to ​exploit flaws or gain​ unauthorised access into​ NHS systems.


Protects publicly hosted web services from a wide range of online threats.


Identification of all users on the network enabling enforcement of user and group-based access rules.

Response pages

Customised messages and​ instructions to users when​ blocked websites​ or files are accessed.

QOS/rate limiting

Highest priority activity is not compromised when the network is busy.

Data loss prevention (DLP)

Prevents sensitive information from ever leaving the network.

IP allow list

During your organisation’s migration to NHS Secure Boundary, the public IP addresses will change.

If your organisation uses HSCN to access the internet, your CNSP will be in contact to communicate the new IP addresses. If your organisation is onboarding to NHS Secure Boundary directly to protect a local internet breakout, the new IP addresses will be communicated to you through your onboarding project manager.

Following this, your organisation will need to notify any services your organisation accesses to ensure they add the new IP address range to the allow list. 

If you don't take action your organisation could lose access to any services that manage access through an allow list.

NHS related services that may implement allow list access

As we progress through on-boarding, NHS related services using IP allow lists to control access will become known and will be advertised on this support page.

Several services outlined below are thought to use allow list access.

If you are aware of any services that use allow list access but do not appear on this list, email the NHS Secure Boundary team at [email protected] so records can be updated.

Service Type Contact Phone number
Easy (Giltbyte) Finance [email protected] N/A
ISOxford Library [email protected] N/A
NHS Resolution Risk and legal [email protected] 020 7811 2820
Open Athens Library and
[email protected] 
0300 121 0043
PharmPress (Digital BNF) National [email protected] N/A
Phin SFTP [email protected] N/A
Warwick University Medical study [email protected] and
[email protected]
York University Remote access to HYMS University [email protected] 01904 323838
Ignaz Smartphone app for healthcare professionals [email protected] N/A
National Joint Registry Joint replacement registry [email protected] 0845 345 9991
NYH Trauma Network Major trauma network for North Yorkshire and Humberside [email protected] 01482 622394
Taycare Orthotics [email protected] 0113 231 1800
Infopoint ESR Human resources and payroll database system [email protected] IBM Servicedesk: 0845 600 8249
NHS Blood and Transplant Blood and transplantation service to the NHS [email protected] 0300 123 23 23
National Institute for Health and Care Excellence (NICE) – Clinical Knowledge Summaries Providing primary care practitioners with a summary of the current evidence base and practical guidance on best practice 0300 323 0140

Register for the service

To register for the secure boundary service, or if you have any questions, please email [email protected].

Access our knowledge base

If you've already registered for NHS Secure Boundary, you can access our knowledge base, which contains guidance on the service.

How this service aligns with the Cyber Assessment Framework

Open the expanders below to find out how this service aligns to the principles and outcomes of the Cyber Assessment Framework (CAF).

Objective A: Managing security risk

A1.b Your organisation has established roles and responsibilities for the security of networks and information systems at all levels, with clear and well-understood channels for communicating and escalating risks.

A2.b You have gained confidence in the effectiveness of the security of your technology, people, and processes relevant to essential functions.

Objective B: Defending systems against cyber attack

B3.b You have protected the transit of data important to the operation of the essential function. This includes the transfer of data to third parties.

B4.a You design security into the network and information systems that support the operation of essential functions. You minimise their attack surface and ensure that the operation of the essential function should not be impacted by the exploitation of any single vulnerability.

B4.b You securely configure the network and information systems that support the operation of essential functions.

B4.c You manage your organisation's network and information systems that support the operation of essential functions to enable and maintain security.

Objective C: Detecting cyber security events

C1.a The data sources that you include in your monitoring allow for timely identification of security events which might affect the operation of your essential function.

C1.b You hold logging data securely and grant read access only to accounts with business need. No employee should ever need to modify or delete logging data within an agreed retention period, after which it should be deleted.

C1.c Evidence of potential security incidents contained in your monitoring data is reliably identified and triggers alerts.

C2.a You define examples of abnormalities in system behaviour that provide practical ways of detecting malicious activity that is otherwise hard to identify.

C2.b You use an informed understanding of more sophisticated attack methods and of normal system behaviour to monitor proactively for malicious activity.

Last edited: 15 November 2023 4:08 pm