NHS Secure Boundary

Our NHS Secure Boundary service is a perimeter security project supporting NHS organisations. Find out how we can help you secure your organisation.

Help us to improve

Your feedback matters and will make a difference. Help us understand your experience of the cyber and data security pages by taking our 5 minute survey. Start the survey.

NHS Secure Boundary service will remain available until July 2026

Since August 2019, NHS England, in partnership with its technology suppliers, have been supporting NHS organisations with their onboarding to Secure Boundary and operational delivery, aiming to offer an improved security posture for internet-facing traffic and publicly facing websites. This has provided the system with a significant level of protection and a central provision of on-going risk reduction and prevention of cyber events.

As we go past the 5-year milestone of the delivery of this service, we’d like to communicate the future for this national offering. We can confirm that the current service will remain available in its current state until July 2026. As we move into this extension period, we would like to ensure that there will be no interruption to the service that is currently being delivered. We expect change to be minimal until 2026 but we will keep you informed.

Working towards the future service offering

NHS England is currently working towards the future service offering for Secure Boundary post 2026. If you would like more information or to get involved with this, please contact your Cyber Regional Lead for details or email [email protected].

About our Secure Boundary service

Our Secure Boundary service provides a perimeter security solution offering protection against security threats.

This solution is part of a larger programme of work being delivered by NHS England’s Cyber Operations to ensure the confidentiality, integrity, and availability of patient data, as well as protecting clinical and business systems from emerging threats.

The solution uses next generation firewall (NGFW) and web application firewall (WAF) protection to protect internet traffic from digital and cloud-based threats.

There will be an initial cost to NHS organisations to fund the onboarding. The ongoing run service element is centrally funded and is therefore free for NHS organisations.

Benefits

Find out about the benefits of NHS Secure Boundary.

Visibility

An increased visibility of network traffic, so NHS organisations can better manage their own risk.

It enables us to identify malicious content within encrypted traffic on behalf of the wider NHS.

Intelligence

It provides enriched threat intelligence, enabling us to respond quickly across the NHS during incidents.

Advanced threat protection provides a detailed view of what's happening locally.

Compliance

It provides capabilities to improve Data Security Protection Toolkit (DSPT) and Cyber Essentials plus (CE+) assessment scores.

The solution is compliant with CE+, DSPT, National Cyber Security Centre (NCSC) and IT Healthcare (ITHC) regimes and will remain compliant throughout the development of the service.

Value

It's procured at scale to one national standard, enabling improved planning and better value for money for the NHS.

The solution is free (centrally funded) to run the service for NHS organisations. However, there is a cost to NHS organisations to fund the onboarding project.

Service delivery and onboarding

We currently have 192 organisations onboarded to Secure Boundary, including 22 CNSPs. The high-level process for onboarding is:

Expression of interest.
Data validation.
Onboarding costs agreed.
Technical assessment.
Implementation (migration support).
Ongoing support.

The overall process to onboard is expected to take 6 to 8 weeks for a Prisma onboarding and 1 to 2 weeks for an Imperva onboarding. These timescales may vary depending on the size and complexity of the organisation onboarded.

Accenture will provide tier 2 support into the NHS Customer Service Function with tier 3 support from Palo Alto and Imperva.

Managed services will be delivered utilising an IT Service Management (ITMS) Framework with ISO 20000 accredited ITIL practices.

How it works

NHS Secure Boundary contains 2 main technology parts, protecting 2 types of internet traffic:

Graphic showing how the service works

Bi-directional traffic (internal traffic)

This is traffic from within the NHS perimeter. Internet activity is protected by PaloAlto and Prisma Access technology.

Inbound traffic (external traffic)

This is traffic from outside of the NHS perimeter. Data is protected by the Imperva Incapsula web application firewall.

Components

Below are details of the different secure boundary components. You can expand them to find out more:

Palo Alto Prisma Access

This is a software as a service (SaaS) based, modern next-generation firewall (NGFW) capability in the cloud, which can be used by NHS organisations to increase their digital security.

It includes:

stateful High Availability (HA) pairs of VM-Series NGFW
the ability to be hosted across availability zones
dedicated firewalls for each tenant
a bandwidth pool apportioned to tenants based on identified bandwidths

Cortex Data Logging Service

This collates all logs from the firewalls and management platforms within the solution.

It includes:

retention of traffic, configuration and system logs for 30+ days in Cortex Data Lakes (CDL’s) accessible by an organisation (logs for six months up to 180 days are accessible via a ticket to the CSF)
forwarding of filtered logs to the Cyber Operations, Cyber Security Operations Centre (CSOC), enabling us to monitor cyber events across the NHS estate, and provide rapid protection as incidents and risks emerge

Wildfire

Wildfire is a sandboxing platform designed to identify zero-day threats.

It includes:

file sandboxing for analysis of unknown threats
creation of signatures to block malware and block the other behaviours
dissemination of threat signatures to all Wildfire users, so detection by one can protect all
static and dynamic analysis over multiple operating systems and application versions

Panorama Management Console

Management of the Prisma platform will be done via the central management console, Panorama.

It includes:

a common Graphical User Interface (GUI) integrated with NHS Mail Single Sign On (SSO)
a tenant-in-tenant approach to provide global and local control
Amazon Web Services (AWS) hosted Panorama with additional NGFWs and role-based access control

Imperva Cloud Web Application Firewall (WAF)

This is a SaaS based WAF solution to protect applications from malicious online attacks.

It includes:

protection against the most critical web application security risks, such as Structured Query Language (SQL) injection, cross-site scripting, illegal resource access, remote file inclusion
multiple capability offerings to meet current and future requirements whilst being cost effective

Features and capabilities

Here are some of the features and capabilities offered by the Secure Boundary service. Expand them to find out more:

Uniform Resource Locator (URL) filtering

Monitors and controls access to websites and website categories.

Application ID (APP ID)

Visibility of active applications.

Antivirus

Protects against viruses, worms and trojans, and spyware.

Anti-spyware

Prevents spyware and malware from 'phoning home'.

Application whitelisting

Protects against potentially harmful applications.

File blocking

Blocks files that are known to carry threats.

Zone and DoS protection

Reduces the portion of the network exposed to potential attack.

Custom signatures

Can be created to detect and block specific traffic.

Intrusion protection (IPS)

Protects against attempts to exploit flaws or gain unauthorised access into NHS systems.

WAF

Protects publicly hosted web services from a wide range of online threats.

USER-ID

Identification of all users on the network enabling enforcement of user and group-based access rules.

Response pages

Customised messages and instructions to users when blocked websites or files are accessed.

QOS/rate limiting

Highest priority activity is not compromised when the network is busy.

Data loss prevention (DLP)

Prevents sensitive information from ever leaving the network.

IP allow list

During your organisation’s migration to NHS Secure Boundary, the public IP addresses will change.

If your organisation uses HSCN to access the internet, your CNSP will be in contact to communicate the new IP addresses. If your organisation is onboarding to NHS Secure Boundary directly to protect a local internet breakout, the new IP addresses will be communicated to you through your onboarding project manager.

Following this, your organisation will need to notify any services your organisation accesses to ensure they add the new IP address range to the allow list.

If you don't take action your organisation could lose access to any services that manage access through an allow list.

NHS related services that may implement allow list access

As we progress through on-boarding, NHS related services using IP allow lists to control access will become known and will be advertised on this support page.

Several services outlined below are thought to use allow list access.

If you are aware of any services that use allow list access but do not appear on this list, email the NHS Secure Boundary team at [email protected] so records can be updated.

Service	Type	Contact	Phone number
Easy (Giltbyte)	Finance	[email protected]	N/A
ISOxford	Library	[email protected]	N/A
NHS Resolution	Risk and legal	[email protected]	020 7811 2820
Open Athens	Library	https://www.openathens.net and [email protected]	0300 121 0043
PharmPress (Digital BNF)	National	[email protected]	N/A
Phin	SFTP	[email protected]	N/A
Warwick University	Medical study	[email protected] and [email protected]	N/A
York University	Remote access to HYMS University	[email protected]	01904 323838
Ignaz	Smartphone app for healthcare professionals	[email protected]	N/A
National Joint Registry	Joint replacement registry	[email protected]	0845 345 9991
NYH Trauma Network	Major trauma network for North Yorkshire and Humberside	[email protected]	01482 622394
Taycare	Orthotics	[email protected]	0113 231 1800
Infopoint ESR	Human resources and payroll database system	[email protected]	IBM Servicedesk: 0845 600 8249
NHS Blood and Transplant	Blood and transplantation service to the NHS	[email protected]	0300 123 23 23
National Institute for Health and Care Excellence (NICE) – Clinical Knowledge Summaries	Providing primary care practitioners with a summary of the current evidence base and practical guidance on best practice	https://cks.nice.org.uk/	0300 323 0140

Register for the service

To register for the secure boundary service, or if you have any questions, please email [email protected]

Access our knowledge base

If you've already registered for NHS Secure Boundary, you can access our knowledge base, which contains guidance on the service.

How this service aligns with the Cyber Assessment Framework

Open the expanders below to find out how this service aligns to the principles and outcomes of the Cyber Assessment Framework (CAF).

Objective A: Managing security risk

A1.b Your organisation has established roles and responsibilities for the security of networks and information systems at all levels, with clear and well-understood channels for communicating and escalating risks.

A2.b You have gained confidence in the effectiveness of the security of your technology, people, and processes relevant to essential functions.

Objective B: Defending systems against cyber attack

B3.b You have protected the transit of data important to the operation of the essential function. This includes the transfer of data to third parties.

B4.a You design security into the network and information systems that support the operation of essential functions. You minimise their attack surface and ensure that the operation of the essential function should not be impacted by the exploitation of any single vulnerability.

B4.b You securely configure the network and information systems that support the operation of essential functions.

B4.c You manage your organisation's network and information systems that support the operation of essential functions to enable and maintain security.

Objective C: Detecting cyber security events

C1.a The data sources that you include in your monitoring allow for timely identification of security events which might affect the operation of your essential function.

C1.b You hold logging data securely and grant read access only to accounts with business need. No employee should ever need to modify or delete logging data within an agreed retention period, after which it should be deleted.

C1.c Evidence of potential security incidents contained in your monitoring data is reliably identified and triggers alerts.

C2.a You define examples of abnormalities in system behaviour that provide practical ways of detecting malicious activity that is otherwise hard to identify.

C2.b You use an informed understanding of more sophisticated attack methods and of normal system behaviour to monitor proactively for malicious activity.

Last edited: 4 February 2025 8:50 am