Cyber and resilience
1. Two papers were reviewed covering the NHS England Resilience Programme and the Cyber Accelerator. The committee noted significant overlap between the two, with insufficient alignment between the teams. Strategic and policy decisions will be consolidated within the Cyber Accelerator; the Resilience Programme has been refocused on its original scope — mission critical systems and completing minimum controls for each. A mapping grid will be produced to enable progress monitoring.
2. The committee has three substantive concerns which require attention:
2.1 First, the Cyber Accelerator Programme spans a wide range of actions but lacks clarity on prioritisation. The team has been asked to reframe the programme using an urgent/important matrix and present a clear plan for those items satisfying both criteria.
2.2 Second, progress on the Board’s request for a national business continuity exercise following a severe cyber-attack is slow. The Committee felt that we must test and plan for major failure scenarios as they relate to cyber, with a focus on business operations and decision‑making resilience rather than technical restoration.
2.3 Third, and most significantly, the Voluntary Redundancy (VR) programme represents a material and currently unmitigated risk. Scarce specialist capacity is being drawn away from critical cyber and resilience work, and this constraint is not yet resolved. The committee felt that the approach to VR may be a symptom of a wider root cause that we have a system which needs to be digital but doesn’t know how we grow and nurture the technology workforce and make it much more part of the DNA of the organisation.
Delivering digital change
3. The team presented a well-structured paper on programmes that could be accelerated to deliver benefits from the ten-year plan earlier for patients and colleagues. The committee welcomes this direction but has a number of concerns that need to be addressed before material investment is committed:
3.1 Business ownership and mandate: Executive involvement in developing the acceleration plan has been limited. The committee’s view is that no significant technology investment should proceed without a clear business owner who is accountable for the resulting operational and business change required to realise identified benefits.
3.2 Deliverability: No technical or operational deliverability assessment has been undertaken yet. Scarce skills and the resource implications of the VR programme are likely to be a material constraint on execution.
3.3 Programme coherence: There is no clear articulation of how accelerated components (e.g. Wayfinder) connect to the Modern Service Framework pathway redesign approach.
3.4 Single Patient Record: Current plans show benefits realising in 2030, which is inconsistent with publicly stated ambitions and needs to be reconciled.
3.5 Neighbourhood technology: Detailed requirements work has not begun, as there is as yet no clear vision to design against.
4. The team has been encouraged to develop detailed acceleration plans so that dependencies and resource constraints can be identified and addressed.
Overall assessment
5. The teams are making genuine progress and the committee is supportive of the direction of travel. However, the absence of permanent executive leadership and the ongoing impact of the VR programme are material constraints that, if not addressed, will limit delivery.