Cyber recovery should leave the next care shift ready

The NCSC’s annual review, published on 3 November, describes incidents across UK sectors during September 2025 to August 2026. It identifies familiar vulnerabilities, stolen credentials and social engineering, alongside dependence on suppliers. These are national incident-management findings, rather than a measure of current care-sector exposure or evidence that a particular care platform was compromised. ^[1]

There is a constructive implication for providers: established controls and informed staff remain useful. Care leaders can ask what their existing support makes possible, where a dependency remains uncertain and which improvement would strengthen the service. That gives technical work a purpose staff can understand without requiring a registered manager to become a cyber specialist.

NCSC’s business-continuity guidance, published on 1 October, recommends understanding critical services, their dependencies, feasible workarounds and restoration priorities. Applied to care, the important connection is between the technology and the activity people need from the service. An ordered recovery should reflect that activity, with the relevant care and technical responsibilities considered together. ^[2]

Begin with one essential information flow in the provider’s approved continuity plan. Establish how authorised staff obtain the information they need when the usual system is unavailable, how changes remain recorded and how the next colleague understands the position. The question reaches beyond whether a backup exists. It concerns the information staff can actually use within their responsibilities.

Homecare needs its own examination of that route. Consider a worker between visits, a change to the planned schedule and an escalation when normal contact is unavailable. The office, worker and responsible manager need compatible arrangements. A residential service should examine its handover, including temporary colleagues and support available outside office hours. These are suggested review situations, not accounts of observed incidents.

When a system returns, technical staff can explain what was restored and any remaining limits. The service’s responsible leaders need a process for confirming that the information is usable for the care decisions ahead, with appropriate professional input. Clinical judgements and regulated care responsibilities remain with the relevant authorised people under established governance. A supplier’s recovery message cannot settle those decisions on their behalf.

Digital Care Hub’s recovery guidance reinforces the need to confirm normal functioning, work with the relevant IT support and learn from the response. Its practical emphasis is useful here: keep an incident timeline, understand the causes and update the continuity arrangements. A provider needs an account that survives the handover to the next responsible person. ^[3]

On 16 September, Digital Care Hub launched cyber-communication resources with separate homecare and residential checklists, designed to accompany business-continuity plans. They address who to contact, what to communicate, alternative routes and subsequent updates. The distinction between service types matters: a provider should adapt the resource to its actual care arrangements and contacts. ^[4]

People drawing on care and their families need an understandable explanation of a material interruption. Agree who can provide that explanation, how individual communication needs will be considered and when another update will follow. Staff should distinguish what has been confirmed from what remains under investigation. Protect confidential information and avoid promises about restoration that the technical team cannot substantiate.

The same clarity is needed inside the organisation. NCSC’s critical-decisions guidance, also published on 1 October, recommends establishing authority, escalation thresholds and communication arrangements in advance. For a care provider, that means the relevant technical, operational and professional decisions must have understood owners and deputies. The guidance supplies an organisational framework; it does not introduce a new care regulation. ^[5]

A useful update gives the receiving colleague enough context to act within their role. Explain the arrangement in use, its limits, the decision awaiting confirmation and the next contact. That helps prevent separate teams issuing incompatible reassurance while the responsible manager is still trying to establish the position.

NHS England’s just-culture guidance, last edited on 29 October, connects cyber response with openness and learning. It includes leaders in social care and considers how working conditions and processes contribute to incidents. The guidance supports incident planning and review; it does not replace reporting obligations, organisational policy or appropriate HR and legal advice. ^[8]

For a provider, that brings a useful question into the rehearsal: can a colleague raise an access difficulty or suspected mistake promptly, knowing who will listen and what happens next? Give staff a dependable reporting route and use what they describe to examine the arrangement around them. That can expose a practical improvement before the next shift has to rely on it.

The NHS published its 2026/27 DSPT version 9 material on 2 October, with a 30 June 2027 deadline and separate category material including social care. Providers should identify the route applying to their organisation. The release does not establish a new universal CQC cyber duty, nor does publishing a self-assessment independently verify every recovery arrangement. ^[6]

Digital Care Hub describes an annual contractual DSPT requirement for NHS-funded services and strongly recommends completion across adult social care in England. Better Security, Better Care provides free support. Providers should check their own commissioning and information-sharing requirements, and use the available help to connect their answers with the arrangements staff actually use. ^[7]

Choose a proportionate exercise with the manager, a care colleague and the relevant IT support. Follow an interruption through access to essential information, communication and the return to the usual service. Keep personal information protected. A discussion can reveal unclear responsibility; any technical testing needs an agreed scope and competent oversight. Record separately what was discussed, demonstrated and left unverified.

Where external expertise is needed, define the gap before commissioning the work. Ask for explained findings, a tested handover and responsibility for carrying actions through. At the next provider review, the decision should be clear: which uncertainty must be resolved before the service relies on the arrangement, who can resolve it and when the result will be checked.