Networks and connectivity standards
Introduction
This document sets out the NHS England Networks and Connectivity Standards. Each standard sets out the importance of meeting the standard, when to meet it, how to meet it and any relevant technical requirements.
These standards have been produced by the Frontline Productivity Networks and Connectivity programme in NHS England to support NHS organisations.
Where relevant supporting metrics for standards are included in Appendix A: Supporting Technical Measures.
Audience
These standards are for all NHS organisations in England. All standards should be considered applicable to all NHS organisation, site and network types.
When to meet the standards
These standards represent ongoing requirements that NHS organisations should self-assess against annually and whenever:
- making major changes to their network and connectivity estate
- organisational changes or mergers impact ownership and responsibility for sites or infrastructure
Adherence to these standards should also be a consideration of standard business continuity or risk reviews.
Where meeting the standard is not currently possible, organisations should create and maintain a plan that outlines:
- identified risks and impacts
- interim mitigation measures
- anticipated timeline for achieving the standard
Where a standard has a specific date, timeline or condition of when to meet it that differs from the above this will be highlighted within the 'When to meet the standard' heading of the standard.
Security of Network and Information Systems Regulations (NIS Regulations) alignment
The Security of Network and Information Systems Regulations (NIS Regulations) define that "An Operator of Essential Services (OES) must take appropriate and proportionate technical and organisational measures to manage risks to the security and resilience of network and information systems used to provide the essential service."
Healthcare providers (including NHS trusts and other organisation types) are designated as 'Operators of Essential Services' under Schedule 2 of the Regulations. As such the NHS organisations networking equipment detailed in these Network and Connectivity Standards fall under this regulation as they are network and information systems used to provide essential services.
DSPT alignment
These standards support NHS organisations' ability to meet relevant Data Security and Protection Toolkit (DSPT) requirements by strengthening the technical controls, processes and evidence expected under the CAF aligned assertions. Alignment to the DSPT assertions can be found within each standard under the 'Supports the following DSPT Assertions' heading.
A table of all standards and alignment to DSPT assertions can be found in Appendix B: Networks and Connectivity Standards DSPT assertation alignment.
While meeting these standards themselves does not fully satisfy any DSPT outcome in isolation, adopting them provides clear supporting evidence towards achieving organisational compliance. Full DSPT achievement still relies on broader organisational governance, policies, assurance activities and operational practices supplementing adherence to these technical standards.
Last edited: 6 August 2026 1:23 pm