2.1 The government agrees with the Committee’s recommendation. Target implementation date: April 2021 2.2 NHS Digital’s commitment to improving cyber security across the health and care system is unwavering. They are addressing the inherent cyber risks that legacy systems create across the estate, continuing to drive the national cyber security programme. This includes ensuring all organisations are reporting their cyber security position through the Data Security and Protection Toolkit and through direct engagement with Trusts to address the most significant cyber risks within the estate. 2.3 Since WannaCry, NHS Digital has created the Data Security Centre, the dedicated cyber security operations unit for health and social care. The Data Security Centre has introduced a range of centrally provided capabilities and services that have significantly improved resilience across the health and care system. 2.4 These include: a national cyber security operating centre, threat intelligence, vulnerability scanning and proactive cyber security assessments for trusts to help them understand and address their cyber risks. These services are supporting NHS organisations to protect their data, identify and respond to cyber threats and meet the standards set out in the Data Security and Protection Toolkit. As a result, the ability of NHS organisations to manage cyber risks has greatly improved since WannaCry. 2.5 Whilst significant progress has been made, cyber security will always remain a significant and enduring risk for the NHS given its size and complexity, the evolving threat landscape and the increasing sophistication of cyber-attacks. Therefore, NHS Digital will continue to work to strengthen the health and care system’s cyber defences in order to protect patient data and reduce the risk and impact of future attacks. 2.6 NHS Digital will provide a full update to the Committee in Spring 2021.