We have detected that you are using Internet Explorer to visit this website. Internet Explorer is now being phased out by Microsoft. As a result, NHS Digital no longer supports any version of Internet Explorer for our web-based products, as it involves considerable extra effort and expense, which cannot be justified from public funds. Some features on this site will not work. You should use a modern browser such as Edge, Chrome, Firefox, or Safari. If you have difficulty installing or accessing a different browser, contact your IT support team.
Our NHS Secure Boundary service is a perimeter security project supporting NHS organisations. Find out how we can help you secure your organisation.
About our secure boundary service
Our secure boundary service provides a perimeter security solution offering protection against security threats.
This solution is part of a larger programme of work being delivered by NHS Digital’s Data Security Centre (DSC) to ensure the confidentiality, integrity, and availability of patient data, as well as protecting clinical and business systems from emerging threats.
The solution uses next generation firewall (NGFW) and web application firewall (WAF) protection to protect internet traffic from digital and cloud-based threats.
Following the closure of the onboarding programme at the end of July 2021, there will be a cost to NHS organisations to fund the onboarding. The run the service element will remain free.
Find out about the benefits of NHS Secure Boundary.
An increased visibility of network traffic, so NHS organisations can better manage their own risk.
It enables us to identify malicious content within encrypted traffic on behalf of the wider NHS.
It provides enriched threat intelligence, enabling us to respond quickly across the NHS during incidents.
Advanced threat protection provides a detailed view of what's happening locally.
It provides capabilities to improve Data Security Protection Toolkit (DSPT) and Cyber Essentials plus (CE+) assessment scores.
The solution is compliant with CE+, DSPT, National Cyber Security Centre (NCSC) and IT Healthcare (ITHC) regimes and will remain compliant throughout the development of the service.
It's procured at scale to one national standard, enabling improved planning and better value for money for the NHS.
The solution is free (centrally funded) to run the service for NHS organisations. However, there is a cost to NHS organisations to fund the onboarding project, following the closure of the onboarding programme which has been running for over 2 years.
How the service is being developed
Find out how the service is being developed by expanding each phase:
This phase ran until December 2019 and consisted of configuring and testing the platform, and the design and build of operational services, processes and procedures.
The onboarding phase will consist of project teams working with NHS organisations and consumer network service providers to deploy the service.
This phase is expected to last for two years.
Accenture will provide tier 2 support into the NHS Customer Service Function with tier 3 support from Palo Alto and Imperva. Managed services will be delivered utilising an IT Service Management (ITMS) Framework with ISO 20000 accredited ITIL v3 processes.
This phase is expected to last for at least five years.
How it works
NHS Secure Boundary contains two main technology parts, protecting two types of internet traffic:
Bi-directional traffic (internal traffic)
This is traffic from within the NHS perimeter. Internet activity is protected by PaloAlto and Prisma Access technology.
Inbound traffic (external traffic)
This is traffic from outside of the NHS perimeter. Data is protected by the Imperva Incapsula web application firewall.
Below are details of the different secure boundary components. You can expand them to find out more:
Palo Alto Prisma Access
This is a software as a service (SaaS) based, modern next-generation firewall (NGFW) capability in the cloud, which can be used by NHS organisations to increase their digital security.
stateful High Availability (HA) pairs of VM-Series NGFW
the ability to be hosted across availability zones
dedicated firewalls for each tenant
a bandwidth pool apportioned to tenants based on identified bandwidths
Cortex Data Logging Service
This collates all logs from the firewalls and management platforms within the solution.
retention of traffic, configuration and systems logs for six months
forwarding of filtered logs to the Data Security Centre Cyber Security Operations Centre (CSOC), enabling us to monitor cyber events across the NHS estate, and provide rapid protection as incidents and risks emerge
WildFire is a sandboxing platform designed to identify zero-day threats.
file sandboxing for analysis of unknown threats
creation of signatures to block malware and block the other behaviours
dissemination of threat signatures to all Wildfire users, so detection by one can protect all
static and dynamic analysis over multiple operating systems and application versions
Panorama Management Console
Management of the Prisma platform will be done via the central management console, Panorama.
a common Graphical User Interface (GUI) integrated with NHS Mail Single Sign On (SSO)
a tenant-in-tenant approach to provide global and local control
Amazon Web Services (AWS) hosted Panorama with additional NGFWs and role-based access control
MindMeld is a platform taking in threat data from sources outside of the secure boundary, allowing that threat data to be used by the firewalls in the solution.
aggregation and correlation of threat intelligence feeds
enforcement of new prevention controls, including IP deny lists
Imperva Cloud Web Application Firewall (WAF)
This is a SaaS based WAF solution to protect applications from malicious online attacks.
protection against the most critical web application security risks, such as Structured Query Language (SQL) injection, cross-site scripting, illegal resource access, remote file inclusion
multiple capability offerings to meet current and future requirements whilst being cost effective
Here are some of the capabilities offered by the secure boundary service. Expand them to find out more:
Uniform Resource Locator (URL) filtering
Monitors and controls access to websites and website categories.
Application ID (APP ID)
Visibility of active applications.
Selective decryption of traffic for the advanced detection of threats.
Protects publicly hosted web services from a wide range of online threats.
IP allow list
During your organisation’s migration to NHS Secure Boundary, the public IP addresses will change.
If your organisation uses HSCN to access the internet, your CNSP will be in contact to communicate the new IP addresses. If your organisation is on-boarding to NHS Secure Boundary directly to protect a local internet breakout, the new IP addresses will be communicated to you through your on-boarding project manager.
Following this, your organisation will need to notify any services your organisation accesses to ensure they add the new IP address range to the allow list.
If you don't take action your organisation could lose access to any services that manage access through an allow list.
NHS related services that may implement allow list access
As we progress through on-boarding, NHS related services using IP allow lists to control access will become known and will be advertised on this support page.
Several services outlined below are thought to use allow list access.
If you are aware of any services that use allow list access but do not appear on this list, please email the NHS Secure Boundary team at email@example.com so records can be updated.