NHS Secure Boundary
About our secure boundary service
Our secure boundary service provides a perimeter security solution offering protection against security threats.
This solution is part of a larger programme of work being delivered by NHS Digital’s Data Security Centre (DSC) to ensure the confidentiality, integrity, and availability of patient data, as well as protecting clinical and business systems from emerging threats.
The solution uses next generation firewall (NGFW) and web application firewall (WAF) protection to protect internet traffic from digital and cloud-based threats.
Following the closure of the onboarding programme at the end of July 2021, there will be a cost to NHS organisations to fund the onboarding. The run the service element will remain free.
Benefits
Find out about the benefits of NHS Secure Boundary.
An increased visibility of network traffic, so NHS organisations can better manage their own risk.
It enables us to identify malicious content within encrypted traffic on behalf of the wider NHS.
It provides enriched threat intelligence, enabling us to respond quickly across the NHS during incidents.
Advanced threat protection provides a detailed view of what's happening locally.
It provides capabilities to improve Data Security Protection Toolkit (DSPT) and Cyber Essentials plus (CE+) assessment scores.
The solution is compliant with CE+, DSPT, National Cyber Security Centre (NCSC) and IT Healthcare (ITHC) regimes and will remain compliant throughout the development of the service.
It's procured at scale to one national standard, enabling improved planning and better value for money for the NHS.
The solution is free (centrally funded) to run the service for NHS organisations. However, there is a cost to NHS organisations to fund the onboarding project, following the closure of the onboarding programme which has been running for over 2 years.
How the service is being developed
Find out how the service is being developed by expanding each phase:
How it works
NHS Secure Boundary contains two main technology parts, protecting two types of internet traffic:
Bi-directional traffic (internal traffic)
This is traffic from within the NHS perimeter. Internet activity is protected by PaloAlto and Prisma Access technology.
Inbound traffic (external traffic)
This is traffic from outside of the NHS perimeter. Data is protected by the Imperva Incapsula web application firewall.
Components
Below are details of the different secure boundary components. You can expand them to find out more:
Capabilities
Here are some of the capabilities offered by the secure boundary service. Expand them to find out more:
IP allow list
During your organisation’s migration to NHS Secure Boundary, the public IP addresses will change.
If your organisation uses HSCN to access the internet, your CNSP will be in contact to communicate the new IP addresses. If your organisation is on-boarding to NHS Secure Boundary directly to protect a local internet breakout, the new IP addresses will be communicated to you through your on-boarding project manager.
Following this, your organisation will need to notify any services your organisation accesses to ensure they add the new IP address range to the allow list.
If you don't take action your organisation could lose access to any services that manage access through an allow list.
Register for the service
To register for the secure boundary service, or if you have any questions, please email nhssecureboundary@nhs.net.
Access our knowledge base
If you've already registered for NHS Secure Boundary, you can access our knowledge base, which contains guidance on the service.
NHS Secure Boundary news
Last edited: 30 July 2021 11:08 am