NHS Supply Chain (NHSSC) used its June 2026 supplier webinar to share important updates for suppliers, with cyber security requirements forming the main focus of the session.

Cyber security remains a key priority

Cyber security was a major focus of the webinar, reflecting the growing risks facing healthcare supply chains. NHSSC highlighted how cyber incidents can disrupt operations, affect product availability, and ultimately impact patient care.

Suppliers were reminded of several practical steps that can help strengthen cyber security, including enabling multi-factor authentication, training staff to recognise and report phishing emails, using strong, unique passwords, implementing conditional access policies, maintaining business continuity and disaster recovery plans, and building a strong cyber security culture through awareness and training.

Suppliers in scope of Procurement Policy Note (PPN) 014 are expected to demonstrate compliance with Cyber Essentials Plus. This applies to relevant suppliers handling personal information relating to employees, customers, or suppliers, or providing ICT systems and services.

Where a supplier does not hold Cyber Essentials Plus certification, NHSSC requires completion of an Information Security Third Party Questionnaire (ISTPQ). This is reviewed by NHSSC’s cyber security team and is only required where a valid Cyber Essentials Plus certificate is not held.

Suppliers that handle patient information, such as home addresses, must also demonstrate compliance with the Data Security and Protection Toolkit (DSPT). NHSSC emphasised that DSPT is a separate NHS England requirement to Cyber Essentials Plus and must be reviewed and submitted annually where applicable.

NHSSC also clarified that routine business emails alone do not automatically trigger a Cyber Essentials Plus requirement. The requirement applies where a supplier stores, processes, retains, or has ongoing access to personal data, such as information relating to employees, patients, customers, or other individuals, as part of the service, system, or solution it provides.

Members may also wish to attend NHS England’s free Cyber Resilience Across the Health and Care Supply Chain webinar on 30 June. The session will cover evolving cyber security expectations across the health and care system, what these mean in practice for NHS suppliers, and how suppliers can support stronger supply chain resilience.

Supplier Management Team update

NHSSC also provided an update on its newly established Supplier Management Team, which brings together supplier relationship management, supplier development, resilience, sustainability, performance, and risk functions into a single team.

The aim is to create a more integrated approach to supplier management, strengthen supplier relationships, improve resilience and sustainability, and support better risk management across the supply chain.

Recent activity includes supplier assurance work, lessons learned from supply disruptions experienced during the year, and development of a new Incident Management Framework intended to improve future responses to supply chain incidents.

NHSSC is also working to provide suppliers with greater visibility of customer demand through initiatives such as a Customer Insights Dashboard and enhanced demand allocation processes. Other ongoing work includes Clinical Product and Supplier Risk Segmentation, due diligence activity, and closer alignment with NHS England on cyber security.

The team is also increasing engagement with suppliers and industry bodies. Planned activity includes SME-focused forums, workshops for medium-sized and smaller businesses, renewed engagement with trade associations, and broader collaboration with industry partners and health innovation organisations.

NHS Core List update

NHSSC also briefly provided an update on the NHS Core List programme, an NHS England initiative designed to simplify procurement, reduce unnecessary product variation, and leverage collective buying power through a single procurement route.

Products included within the NHS Core List are selected against a range of principles, including standardisation, resilience, supplier assurance, and the availability of clinically appropriate alternatives.

At present, NHS Core List products do not cover BHTA member product categories. The BHTA will continue to monitor developments and assess whether relevant product categories become available through the NHS Core List in future.

The April 2026 NHSSC (NHSSC) supplier webinar highlighted several important developments for suppliers, with a particular focus on cyber resilience requirements, supplier processes, and upcoming engagement expectations. Below is a summary of the key updates for BHTA members.

NHS cyber resilience expectations

Presented by Liam Donaghy and Hannah Shelton (NHS England), this session focused on the increasing importance of cyber security across the health and social care system.

Suppliers are a critical part of the NHS supply chain and are increasingly being targeted as a potential route into the wider system. As cyber threats grow in frequency and sophistication, there is a stronger expectation for suppliers to take an active role in protecting systems and services.

The NHS Cyber Improvement Programme is a national initiative designed to strengthen cyber resilience across health and social care. See the slide below for more information on the programme.

A key development is the next phase of cyber engagement, including the Third-Party Risk Management (TPRM) remediation process. This follows a national open letter to suppliers and signals increased engagement across the sector.

Suppliers can expect engagement on key cyber security controls, requests for supporting evidence where appropriate, and a more coordinated, risk-based approach to assurance. There will also be a continued effort to reduce duplicated requests across NHS organisations.

Suppliers are encouraged to review requirements such as the Cyber Security Supply Chain Charter and prepare for upcoming engagement.

Suppliers can also engage with the programme through webinars, consultations, and pilot activities. For further information or queries, suppliers can contact: england.cyberimprovement@nhs.net

Supplier escalation and contact readiness programme

Presented by Lisa Harmsworth, this session highlighted the importance of maintaining accurate supplier contact information.

NHSSC has identified that supplier contact data is not always up to date, which can impact communication and delay issue resolution. To address this, a structured approach to contact management is being introduced.

Five core supplier contact categories are being established to support effective communication and escalation. See the slide below for further details.

Suppliers will be contacted in the coming months to verify and update their contact details. There is an expectation that suppliers will provide accurate contact information, notify NHSSC of any internal staff changes, and regularly review and confirm contact details.

Maintaining accurate contact data will support more efficient communication, clearer escalation processes, and improved supply chain resilience.

Novation: what suppliers need to know

Presented by Steph Holmes-Fletcher, this session outlined NHSSC’s policy on supplier novation.

Supplier novation refers to changes in how framework agreements, contracts, or awarded lots are transferred between suppliers under NHSSC (Supply Chain Coordination Limited (SCCL)) arrangements.

The slide below explains SCCL’s novation policy.

NHS Core List: brief update

Presented by Hamish Makanji, NHSSC provided a brief update on the NHS Core List.

The NHS Core List is a broader NHS initiative, being implemented by NHSSC, which aims to standardise commonly used products and reduce unwarranted variation across the system.

The programme continues to develop, with a pipeline of product categories under review and ongoing engagement planned with suppliers once this pipeline is established.

Suppliers can share suggestions or feedback on NHS Core List opportunities by contacting CoreList@supplychain.nhs.uk.

For a more detailed overview of the NHS Core List and its implications, see our previous article.

Key takeaways for suppliers

• Prepare for increased cyber security engagement and assurance requirements
• Ensure supplier contact details are accurate and regularly updated
• Understand how supplier novation may affect your framework agreements
• Engage with NHS initiatives, including providing feedback on the NHS Core List

BHTA will continue to monitor developments from NHSSC and share relevant updates with members.