Cyber security in general practice is shared. Your ICB runs the IT, suppliers secure their products, and your practice keeps everyday habits safe.
- Whose job
- Shared: your practice, the ICB and suppliers
- Who usually leads
- Your named data and cyber security lead
- How often
- All the time. Checked yearly through the DSPT.
Who does what
Your ICB provides core GP IT, including security updates and anti-virus. Practices must name someone responsible for IT, including data and cyber security, and must have a Data Protection Officer.1 Suppliers are responsible for the security of their own products, and you check that when you buy.
Five ways in
Most attacks come through a handful of doors. Open each one to see the lock, and who holds the key.
Cyber Essentials
A government-backed certificate that shows an organisation has five basic protections in place: firewalls, secure settings, security updates, controlled user access, and malware protection.2
Cyber Essentials
A self-assessment, independently checked.
Cyber Essentials Plus
The same five protections, plus hands-on technical testing to show they work. The one to ask suppliers for.2
If something goes wrong
Tell your ICB GP IT service straight away, and report it through the DSPT. For urgent help, the NHS data security centre has a 24-hour line: 0300 303 5222.3 See data breaches for the rest of the steps.
References
- NHS England updates GP IT operating model requirements. HTN, May 2026
- Cyber Essentials overview. National Cyber Security Centre
- DSPT help: incident reporting. NHS England
Sources on this page last checked 6 November 2026.