From 3d4c1c364b5ca91f2d05048ae62706e3ca498349 Mon Sep 17 00:00:00 2001 From: james-bradley-nhs Date: Wed, 29 Jul 2026 09:18:04 +0100 Subject: [PATCH] mesh-2922: add security.md --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..1f7b878 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security + +We take security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems or private data managed by our systems, please do not hesitate to contact us using the method outlined below. + +## Table of contents + +- [Security](#security) + - [Responsible Disclosure](#responsible-disclosure) + - [Scope](#scope) + - [Response Process/Expectations](response-process-and-expectations) + - [Report a cyber security incident](report-a-cyber-security-incident) + +## Responsible Disclosure + +To learn more about responsible disclosure of security incidents you can read our [Security vulnerability disclosure policy](https://digital.nhs.uk/cyber-and-data-security/security-vulnerability-disclosure). This policy covers things like the scope and response SLAs + +## Report a cyber security incident + +Request immediate support for a cyber security issue - call [0300 303 5222](tel:0300 303 5222) (monitored 24/7). + +Report an urgent cyber security issue by [logging a ServiceNow ticket](https://nhsdigitallive.service-now.com/csm?id=sc_cat_item&sys_id=0122c5351b280110892d4046b04bcb16&referrer=recent_items) and attaching all relevant details. + +If you have found a vulnerability in an NHS system, [report it via our Vulnerability Disclosure Programme](https://digital.nhs.uk/cyber-and-data-security/security-vulnerability-disclosure). + +For general cyber operations queries email [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net). \ No newline at end of file