Technical considerations

How fixed connectivity is delivered to your work area within the building, either via Local Area Network (LAN) or Wide Area Network (WAN) will shape the considerations when you look to share connectivity in a multi occupancy building.

For more on how to manage wireless networks and infrastructure at NHS sites see our guidance on Wireless Infrastructure: Building guidance for health and care organisations. 

Local Area Network (LAN) considerations, when sharing a site with others. 2 scenarios are given here as examples. 

In this scenario the area provided to is secure and dedicated, i.e. not shared with anyone else. The building owner provides all LAN service up to and including the point of connection. This could be to the data port in the floor or any Wi-Fi service that you plug into and use.

Considerations for this scenario include

• understanding security boundaries along with who outside your organisation has access to the systems and services and what is visible to them on the network.
• how access is provided, the supporting connectivity services needed and who is providing it, for example certificate services, network addressing management and address resolution
• how ‘non-computer’ devices can connect, for example printers and IoT devices

In this scenario the building owner has provided space and the environment for you to install your own LAN connectivity infrastructure and services.

Considerations for this scenario include:

• understanding the security boundaries. Do you need dedicated, secure rack space or can you use shared racking
• are there any specific access requirements for example do you need 24 hour access to the racks or equipment and can the building owner meet these requirements
• permissions for activities such as Wi-Fi surveys and building requirements for any installation for example cabling and Wi-Fi access points
• how any environmental factors will be measured and how you can access the relevant reporting and management information for example power usage and cooling costs

Wide Area Network (WAN) considerations when moving into someone else's building.

Do you need dedicated (is it for your organisations use only) WAN network connectivity? If so, where in the site can it be terminated and then connected for use.

Are you using shared WAN services for example any public services network service such as HSCN or internet?

How is this connectivity delivered is it for example express routes, PSN, HSCN, direct connect.

Do your partner organisations also use these connection methods and services?

What network segregation is in place or planned? For example, will you be using VRF’s or VPNs over the shared WAN service?

Which organisation is responsible for:

• racking
• cabling from the WAN rack to your shared space/area (across floors can be difficult and disruptive to other tenants)
• access rights
• management of different suppliers
• how will you connect the WAN services to your allocated area
• will you require any data separation (for example VPNs), and how will any minimum bandwidth, or other technical metric, requirements be achieved and ensured

We understand that Wi-Fi Roaming services are the most common way to provide wireless internet connectivity between multiple organisations at a site and for visiting staff members.

This topic has been addressed in detail in The future of Wi-Fi and Wi-Fi roaming for the NHS and Integrated Care Boards (ICBs) an independent study. 

This document focuses on the technical and commercial elements of security, rather than cyber security.

NHS organisations should have a robust local security policy in place for all communications, networking, and IT equipment that adheres to relevant NHS and government national policies and guidelines. This is even more critical if giving access to or sharing parts of your connectivity infrastructure with another organisation.

Be aware of partner organisations digital and cybersecurity maturity and have the relevant precautions in place so that partnering with less mature organisations doesn’t negatively impact you.

Have policies in place and be aware of processes for third parties or suppliers you are not directly contracted with (i.e. those contracted by partner organisations) requiring site or network access.

Understand who will have responsibility for reporting and responses to cyber incidents and ensure reporting and escalation routes for other partners are clearly defined.

This section provides considerations of several NHS England and UK government policies and guidelines that we consider relevant to organisations when deploying any IT systems. However, it is the responsibility of each separate organisation to conduct their own risk assessments and understand the associated risks. Links to policies and guidance below:

NHS England:

• Data Security and Protection Toolkit
• Network segmentation - An introduction for health and care organisations

Government:

• Secure by design 
• Data protection: The Data Protection Act

NCSC

• Secure design principles
• Cyber Assessment Framework

What level of security accreditation for personnel is required 

• does this differ across partner organisations or site areas
• consider building access as well as any data access.
• who issues the accreditations, and is the process to gain accreditation understandable and workable

Access control systems including how staff and visitors can gain entry if escorting is required and how engineer visits will be managed.

Who is providing what systems and/or service? If they are managed by a third party, do all partner organisations have the ability to contact them for support? (Including not only the ICT but also environmental such as power and cooling, racking).

Who needs physical access to individual racks and cabinets, how is access managed and monitored?

To ensure your connectivity once installed retains its capability to support your operations through your occupancy you should consider the following:

• service levels and response or fix targets and times where applicable
• if partnering with an organisation providing critical services they may require higher tiers of SLA for their connectivity, which will come with an associated cost and may impact the value for money of the overall service
• are service boundaries and responsibilities well understood and documented
• is there a service and audit reporting process in place

Capacity capabilities and management including networks, systems or services, and staff.

• is there sufficient space and building services for your systems for example power, racking, cooling
• can sharing this equipment, including servers, cabinets free up space at sites or reduce power consumption
• is there port space in existing distribution points
• is there space in cable runs/risers for your required connectivity and can it be accessed
•  is there sufficient potential for growth during your intended occupation and how is this allocated or reserved

Move and change process for systems and services.

• this could range from installation of data points to network hardware and services
• how is formal approval for changes applied for and received
• is approval a manageable and timely process
• are there notice periods, restrictions in when work can be carried out, maximum number of changes in a fixed period
• what are the costs or restrictions involved in any changes for example is it a PFI building, can you use your own contractors
• a breakdown of costs and potential future costs, including costs for change

Loss responsibilities and liabilities, including hardware, software, and data

• this includes responsibilities and liability for partial or total loss or damage of equipment for example in event of a building fire where shared equipment or equipment in a shared area is impacted
• liability to third parties due to issues with your equipment or service including cyber incidents

Are dispute resolution processes in place, and who will mediate multi-party disputes.

If you would like to request support on shared occupancy topics, or share your learnings or successes with the team please contact the Networks and Connectivity programme at [email protected].