IT & Microsoft cloud for medical & healthcare

The assessment covers areas that will look familiar to anyone who has done Cyber Essentials, with a stronger emphasis on people and governance: staff training and awareness, access control and account management, patching and supported software, backup and business continuity, incident reporting, and how the organisation manages the suppliers who touch its data. Different organisation types complete different versions, so the number of assertions varies.

What makes it awkward is that it is a self-assessment carrying real weight, published and relied on by commissioners and partners. Overstating your position is a genuine risk, and the common failure is answering from how things are supposed to work rather than how they demonstrably do. The practical approach is to gather the evidence first, patch compliance reports, access reviews, training records, backup test results, and let the answers follow from what the evidence actually shows.

The approaches that survive contact with a working clinic are the ones that shorten authentication rather than lengthen it: fast sign-in methods such as smartcards or Windows Hello so switching user is seconds rather than a password ceremony, session timeouts tuned to the realities of a room where someone may step out mid-consultation, and device-level controls, encryption, compliance policy, restricted local admin, that apply regardless of who is signed in.

Underneath that, conditional access does the heavy lifting: patient data is reachable only from devices that are managed and compliant, so an unmanaged laptop or a personal tablet cannot reach records even with valid credentials. That control is invisible to clinicians in normal use, which is precisely why it works.

That means deciding in advance what clinicians do when records are unavailable: whether a read-only copy of essential information exists and where, how notes made during the outage are captured and reconciled afterwards, who decides whether the session continues, and how patients are informed. Most clinical systems are supplier-hosted, so restoring service is often not in your hands, which makes the continuity plan more important rather than less.

The questions worth answering with the supplier before you need them are the same ones every sector should ask and few do: what recovery time is contractually committed, has it been tested, is your data recoverable independently of the supplier's own infrastructure, and does their backup protect against your own errors as well as their outages. Backup and recovery for the estate you do control, email, documents, the devices themselves, should then be monitored and tested rather than assumed.

Translated into configuration, that means access scoped to role rather than granted broadly because it is simpler, reviewed when people change roles rather than only when they leave, and audited so you can answer who accessed which record and when. A flat permissions model where all clinical staff can see all records is difficult to defend against the minimum-necessary principle, however convenient it is.

The principle people forget is the last one: the duty to share information for care can be as important as the duty to protect it. Controls that make legitimate sharing so difficult that staff route around them, personal email, unmanaged file sharing, a photo on a phone, have made things worse rather than better. Good design makes the safe path the easy one, which usually means secure sharing that works well enough that nobody looks for an alternative.

Consolidating means people exist once in Entra ID rather than once per site, devices are built and secured identically through Intune and Autopilot wherever they are delivered, and access follows the person as they move between locations, which matters when clinical and care staff routinely work across sites. Conditional access then replaces the older assumption that being physically on a site network makes someone trustworthy.

Two site-specific realities still need designing around. Connectivity varies, and a care home or branch surgery on a poor line needs resilience planned deliberately, whether that is a second connection, mobile failover, or keeping enough function available locally to continue during an outage. And smaller sites rarely have anyone technical on the premises, so remote management has to be genuinely complete: a device that cannot be fixed remotely means somebody travelling, and in a dispersed estate that becomes the dominant support cost if it is not designed out.