Better Security, Better Care Programme

Better Security, Better Care has been running from April 2021, delivered through the National Care Association, the sector-based model has been successful in building compliance with the cyber security and data protection assessment across health and social care, the Data Security and Protection Toolkit (DSPT). There are now over 20,000 organisations within the care sector completing the toolkit.

The Department for Health and Social Care and NHS England in 2023 published their cyber security strategy for health and social care to 2030. This strategy outlines five outcome-based pillars for which cyber security across the health and care system is prioritised against. To achieve the outcomes laid out in this strategy a programme of support is required for adult social care to ensure that it gets equal focus to the NHS and that care providers have the necessary support in place. This is again reiterated in the ministerial foreword provided as a part of the report into the state of cyber security in adult social care.

In line with this strategy last year, for large NHS organisations we introduced the National Cyber Security Centre’s (NCSC) Cyber Assessment Framework (CAF), into the DSPT. This gave organisations more flexibility when it came to meeting cyber security and information governance standards. We as the department are now in the process of embedding the CAF into the DSPT for other organisations including adult social care; whilst this won’t introduce the same level of flexibility it will mean that standards are significantly increased. To enable this increase we require a programme of support within the sector; the Better Security, Better Care programme grant will provide this support.

This grant will provide funding for a national programme who will deliver onward grants to local care associations across England. The programme will be responsible for maintaining compliance with the DSPT whilst the department and NHS England raise the standards that the toolkit is built on. The programme will own the relationships between the local care associations and will be responsible for finding suitable local and regional organisations, it is therefore a requirement that this programme is run nationally. This will require consistent management across England, but should be understanding of the differences in locality and the needs of care providers across different areas – different approaches may be required to meet the same outcomes.

The programme will also be required to build cyber expertise within the care associations to enable them to understand the new standards and present them to care providers in a manner that is easily understood.

The programme will provide a link into the sector from the department, facilitating engagement and allow the standards to be built in proportion to the needs and capacity of the sector. This engagement approach whilst providing an appropriate link in for the department, should create a national presence for the programme so that care providers across England have a point of contact for cyber security within the adult social care sector.

The programme will maintain awareness and collaborate with other national, regional and local organisations to ensure that cyber security is embedded both into the wider digital landscape but also the care sector as a whole. They should also remain cognisant of wider pressures in the adult social care system, and form or hold good relationships with core sector partners to ensure that cyber security remains a part of that conversation.

Whilst the maximum funding for this grant is £21,062,366, roughly 25% will be retained by the national organisation, the remaining funding is to be distributed locally and regionally. The Department wants to retain this model of local and regional grants, but we welcome bids from organisations who have different proposals for the funding and how it is utilised. As a part of the questions we will be requesting a pricing table, an outline of this has been provided as a part of the question.