Minimum standards definition and guidance

The following definitions and implementation guidance has been adopted to assist with the categorisation of the requirements in section 2.

A control falls into this category if any of the following are true:

Risk‑severity criteria

• the control mitigates a clear and present danger (active threat or confirmed vulnerability)
• high impact (patient harm, operational outage, data compromise)
• high likelihood (probability of exploitation or failure is high based on known evidence)
• high inherent risk score (before controls) and high residual risk if not implemented immediately

Regulatory or legal criteria

• required to meet statutory obligations, national cyber standards, or NIS regulations
• required to avoid risk of regulatory non‑compliance, enforcement notices, or material sanctions

Operational criteria
Prevents or mitigates risks that could cause:

• major service disruption, including clinical services
• critical infrastructure failure
• immediate safety implications
• uncontrolled security breaches or lateral movement

Threat environment criteria
Addresses vulnerabilities that:

• are known to be actively exploited “in the wild”
• have recent incidents or near misses
• represent a single point of failure with no compensating controls

These controls are equivalent to “critical controls” in cyber frameworks.

A control falls into this category if it meets any of the following:

Risk and operational criteria

• presents a medium or increasing risk if left unaddressed but not an immediate threat
• has moderate-to-high impact, but low-to-moderate probability of occurring in the short term
• risks compound over time (for example technical debt, visibility gaps, incomplete inventories)

Compliance and governance criteria

• supports compliance with NHS policy or national cyber standards but is not immediately regulatory‑critical
• required for achieving baseline operational maturity (e.g., CMDB, monitoring, asset lifecycle)

Strategic criteria

• necessary for NHS‑wide standardisation and future interoperability
• required to reach the target architecture state by the defined timeline

Financial criteria

• supports ongoing cost control and optimal investment capital allocation

A control belongs here if:

Risk and impact criteria

• it has low-to-moderate impact and low probability of materialising
• it reduces risk further but is not required to reach an acceptable level
• optional enhancements rather than mandatory safeguards

Maturity criteria

• enables optimisation, advanced automation, or future-proofing
• represents industry leading practice, not baseline minimum

Operational criteria

• provides performance, cost efficiency, or architectural elegance rather than essential safety or security

Dependency criteria

Implementation may depend on:

• future tooling
• modernisation programmes
• architectural redesign not feasible immediately

The following requirements are classified as Best Practice Requirements (“Should”) only and are strongly recommended but not mandatory by April 2030.

Dual or single path  (PC-3)

Where feasible, dual-path or redundant cooling and power systems should be implemented to enhance resilience. Cooling systems should be monitored for performance and environmental compliance.

Single-path systems with dedicated cooling capacity that runs outside office hours may be suitable for non-critical environments, but redundancy is recommended for high-availability requirements. Cooling capacity planning should consider peak loads and environmental factors.

A single path for power and cooling can be acceptable in non-critical environments because it reduces complexity and cost compared to dual-path designs. This approach simplifies maintenance and lowers operational expenses while still providing dedicated cooling outside office hours to prevent overheating during unattended periods. However, for mission-critical workloads, dual-path redundancy is recommended to ensure resilience and minimise downtime risk.

TCO and ROi (CM-3) 

Total cost of ownership (TCO) and return on investment (ROI) analyses should be performed to inform decision-making and ensure cost-effectiveness.

TCO and ROI analyses should be reviewed and updated regularly, especially before major investments or renewals. Results should be documented and shared with relevant stakeholders.

TCO includes direct and indirect costs over the asset or service lifecycle. ROI calculations should consider both financial and strategic benefits. Documentation supports transparency and auditability.

Cost allocation methodology (CM-5) 

Cost allocation methods should be reviewed regularly to ensure fairness and alignment with business objectives.

Methods should be updated as needed to reflect organisational changes or new services. Stakeholder feedback should be solicited during reviews.

Allocation methods may include direct, indirect, or hybrid approaches. Documentation supports transparency and stakeholder understanding.

Chargeback models (CM-6)

Chargeback or showback models should be applied for IT services, allocating costs to business units or projects based on usage.

Models should be reviewed periodically for fairness and accuracy. Stakeholders should be consulted during model updates, and results should be communicated transparently.

Chargeback assigns costs directly, while showback provides visibility without direct billing. Models should be aligned with organisational goals and support cost optimisation.

Resource usage optimisation (CM-7)

Regular resource usage reviews should be conducted at least quarterly and efficiency measures implemented with the objective of controlling costs.

Unused or underutilised assets should be identified and eliminated to optimise spending and reduce waste. Decommissioning processes should be documented and tracked.

Automated tools should be used to identify underutilised resources, and recommendations for optimisation should be tracked to resolution. Savings achieved should be reported to management.

Optimisation may include rightsizing, scheduling, and decommissioning unused resources. Continuous improvement processes support ongoing cost reduction.

Asset management systems should support automated discovery and reporting. Decommissioning of underutilised assets includes secure data erasure and environmentally responsible disposal.

Vendor contracts (CM-8)

Vendor contracts should be reviewed for cost effectiveness, ensuring value for money and alignment with business needs.

Reviews should be conducted before renewals or major changes. Benchmarking against industry standards should be performed where possible.

Contract reviews should consider pricing models, service levels, and flexibility. Documentation supports negotiation and compliance.

Licensing costs (CM-9)

Software licensing costs should be monitored and managed to ensure compliance and avoid unnecessary expenditure.

Regular audits should be conducted to verify licence usage and identify opportunities for consolidation or renegotiation.

Licence management includes tracking entitlements, renewals, and usage. Automated tools may be used to enhance accuracy and efficiency.

Industry benchmarking (CM-10)

IT costs should be benchmarked against industry standards to assess competitiveness and identify improvement opportunities.

Benchmarking should be performed at least annually, and results should be used to inform strategy and negotiations.