An NHS cyber charter signature is a starting point, not a verdict

Read the claim before rating the supplier

Start an assurance note with the exact claim, its issuer, its date and its scope. Is the supplier declaring an intention, presenting a certificate, describing a product assessment or reporting a completed recovery exercise? These are different types of evidence. Combining them into a single green status hides the question leadership actually needs answered: which risks have been examined, by whom and how recently?

Care Circle suggests asking for an explanation in ordinary language before requesting a large document pack. A supplier should be able to identify the legal entity and service covered by its evidence. Where a claim covers only part of a group, or a specific product version, record that boundary. A mismatch warrants clarification; it does not by itself establish misconduct or an unsafe system.

Connect the evidence to the purchased service

An assurance statement about a supplier’s corporate network does not automatically explain the arrangement used to host a provider’s records. Examine the proposed service, hosting dependency, support route and privileged access. Ask which controls the provider must enable or maintain itself. That distinction is particularly important when a feature exists but has not been configured for every account.

A useful review includes one example from the provider’s own workflow, expressed without resident-identifiable data. Follow a new colleague receiving access, a leaver losing access and a manager requesting an export. Ask the supplier to show the relevant controls with safe test information. This turns a generic assurance conversation into an observable service decision without claiming that a demonstration is a full security audit.

Treat recovery evidence as evidence about an exercise

A recovery test should be understood in context. Ask when it occurred, what scenario it covered, what was restored, which dependencies were included and what failed. The key question is whether the proposed service resembles the tested arrangement. An exercise can be valuable while leaving some conditions untested. Record those limits rather than turning a single recovery time into a guaranteed future outcome.

Care Circle recommends retaining an appropriately limited summary of findings and actions, rather than demanding sensitive technical material that the provider cannot safely store or interpret. Relevant assurance can include an accountable explanation of remediation. Where uncertainty remains, a provider should seek suitably qualified advice and agree safe operational alternatives. The point is to improve the decision, not to collect documents for their own sake.

Know which standards apply and to whom

The NHS Standards Directory describes implementation of the Minimum Operational Data Standard as a contractual requirement for NHS England digital social care record assured solution suppliers. That is a specific assurance relationship. It should not be paraphrased as proof that every care product is assured or that a provider can already exchange every item with local health services.

Ask the supplier to explain the requirements relevant to its product and the evidence available for the current release. Keep product assurance, supplier security and the provider’s own operating controls separate in the decision record. Good evidence in one category can support confidence without settling the others. Managers should be able to explain what they relied on and what they agreed to verify after implementation.

Replace badge checking with proportionate follow-through

NHS England and DHSC’s January letter describes direct engagement intended to understand supply-chain risk and support proportionate remediation. It expressly says the programme is not an audit or a pass/fail exercise. For care leaders, the transferable management lesson is to focus attention on critical dependencies and outstanding actions rather than forcing every supplier through an identical evidence burden.

Create a review schedule linked to material change: a product update, new hosting arrangement, acquisition, serious incident or planned renewal. Agree who informs the provider and who evaluates the implications. Review whether previously identified actions were completed. A well-managed relationship can acknowledge uncertainty and still make progress; an attractive assurance pack that never changes can obscure risks that developed after the original purchase.

Renewal is a useful point to revisit the original decision. Ask whether the service being renewed is still the service described in the assurance evidence, and whether the provider has expanded its use since purchase. More locations, different staff roles or additional information can change the questions worth asking. Record what was checked and seek qualified support for technical uncertainty. Keep the renewal decision connected to operational needs rather than relying solely on the previous approval.