Question to the Department for Business, Innovation, Science and Trade:

To ask the Secretary of State for Business, Innovation, Science and Trade, what national standards are being introduced to ensure the security of Internet-connected medical and industrial devices.

The Cyber Security Strategy for Health and Care to 2030 sets out a vision for a cyber resilient health and care sector, including focusing on the greatest risks and harms. Through the mandatory Data Security and Protection Toolkit (DSPT), DHSC set a cyber security standard for National Health Service organisations proportionate to their risk profile and in response to the cyber threat. Adherence to this standard, in addition to the standards and guidance that we publish around procurement of medical devices, will help organisations to ensure that their networks are secure and that risks with associated Internet-of-Things medical devices are suitably understood and mitigated. The strategy is available here.

More broadly, DCMS’s Product Security and Telecommunications Infrastructure Act 2022 and associated regulations establish mandatory baseline cyber security requirements for consumer connectable industrial products.