Delivering efficient, next-generation cyber security consultancy.

 As a large and diverse organisation, spread across 150 UK locations, Cygnet Health Care’s IT footprint is both large and complex, supported by a dedicated in-house IT team to allow Cygnet to efficiently manage their network. 

 Working in healthcare, Cygnet has always understood the importance of prioritising the security of patient data amongst other sensitive data. In 2018, Cygnet wanted to engage with a specialist cyber security provider to assess and review their cyber security controls and current security posture. 

Specifically, Cygnet sought to stay ahead of the security battle with a comprehensive assessment to understand what was needed to remain secure, given the increased complexity of threats and the size of their estate, which had grown through acquisition. 

The identified programme of improvements and ongoing security assessments would ensure Cygnet was employing best practice security processes, with an ongoing programme of assessment to identify and address any new cyber security risks faced. 

The first phase was to baseline Cygnet’s current security posture, to review and understand existing security processes, technologies and controls.

To do this, CyberOne conducted a range of security assessments and consultancy projects to provide both a holistic and objective grading of the current state of Cygnet’s security controls, with additional penetration tests and vulnerability scans to uncover any critical security exposures in Cygnet’s network. 

From this baseline, CyberOne were able to provide a graded programme of improvement, which broadly fell into three core activities:

1. Programme of identified improvements across Cygnet’s people, processes and technologies, prioritised by risk based on CyberOne’s review and identified recommendations.

2. An on-going programme of penetration testing/vulnerability scans to validate improvements, identify any new known vulnerabilities and drive a continual programme of testing, improvement and review to ensure the highest levels of security governance are maintained. 

3. Elevate Cyber Essentials certification to Cyber Essentials PLUS - While Cyber Essentials certification provides a good baseline, Cyber Essentials PLUS provides a higher security bar and will become a requirement for NHS suppliers to achieve the highest level of certification.