From 818be7b34bb759855ad5883c5cdcc6613c7464c2 Mon Sep 17 00:00:00 2001 From: james-bradley-nhs Date: Thu, 30 Jul 2026 14:00:02 +0100 Subject: [PATCH] mesh-2922: security.md --- SECURITY.md | 59 +++++++++++++++++++++-------------------------------- 1 file changed, 23 insertions(+), 36 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index fb74718..84c4131 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,38 +1,25 @@ # Security -NHS Digital takes security and the protection of private data extremely -seriously. If you believe you have found a vulnerability or other issue which -has compromised or could compromise the security of any of our systems and/or -private data managed by our systems, please do not hesitate to contact us using -the methods outlined below. - -## Reporting a vulnerability -**PLEASE NOTE: Email and HackerOne are our preferred methods of receiving -reports.** - -### Email -If you wish to notify us of a vulnerability via email, please include detailed -information on the nature of the vulnerability and any steps required to -reproduce it. - -You can reach us at: -* cybersecurity@nhs.net -* api.management@nhs.net - -### HackerOne -If you are registered with HackerOne and have been admitted to the NHS -Programme, you can report directly to us at: https://hackerone.com/nhs - -### NCSC -You can send your report to the National Cyber Security Centre, who will assess -your report and pass it on to NHS Digital if necessary. - -You can report vulnerabilities here: -https://www.ncsc.gov.uk/information/vulnerability-reporting - -### OpenBugBounty -We also accept bug reports via OpenBugBounty: https://www.openbugbounty.org/ - -## General Security Enquiries -If you have general enquiries regarding our cyber security, please reach out -to us at cybersecurity@nhs.net +We take security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems or private data managed by our systems, please do not hesitate to contact us using the method outlined below. + +## Table of contents + +- [Security](#security) + - [Responsible Disclosure](#responsible-disclosure) + - [Scope](#scope) + - [Response Process/Expectations](response-process-and-expectations) + - [Report a cyber security incident](report-a-cyber-security-incident) + +## Responsible Disclosure + +To learn more about responsible disclosure of security incidents you can read our [Security vulnerability disclosure policy](https://digital.nhs.uk/cyber-and-data-security/security-vulnerability-disclosure). This policy covers things like the scope and response SLAs + +## Report a cyber security incident + +Request immediate support for a cyber security issue - call [0300 303 5222](tel:0300 303 5222) (monitored 24/7). + +Report an urgent cyber security issue by [logging a ServiceNow ticket](https://nhsdigitallive.service-now.com/csm?id=sc_cat_item&sys_id=0122c5351b280110892d4046b04bcb16&referrer=recent_items) and attaching all relevant details. + +If you have found a vulnerability in an NHS system, [report it via our Vulnerability Disclosure Programme](https://digital.nhs.uk/cyber-and-data-security/security-vulnerability-disclosure). + +For general cyber operations queries email [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net).