NHS England reminded technology suppliers on Friday to close internet-facing Remote Desktop Protocol endpoints after a wave of Cyber Essentials Plus reassessments found legacy admin portals still reachable from the public internet.
How the audits surfaced risk
Certification bodies conducting renewals for vendors on the NHS Shared Business Services framework reported repeated failures on external vulnerability scans: RDP listeners on default ports, missing multi-factor authentication, and split-tunnel VPN configurations that bypassed jump hosts. None of the findings amounted to confirmed patient-data breaches in notices reviewed by InfoHandle, but assessors escalated patterns to NHS Digital's commercial security team because the same suppliers hold access to electronic staff records and estates maintenance systems.
Cyber Essentials Plus already requires external testing; the difference this autumn is volume. More trusts are mandating Plus rather than basic certification as the Cyber Security and Resilience Bill progresses through Parliament, expanding oversight of managed service providers. Suppliers who previously treated certification as a checkbox now face retests every three months tied to contract renewals.
Why RDP keeps appearing
Remote desktop remains a favourite entry point for ransomware crews because it offers interactive control without phishing a clinician. NHS suppliers often stood up quick RDP gateways during the pandemic for software installs and never retired them when zero-trust projects stalled. National Cyber Security Centre guidance continues to recommend bastion hosts, MFA and network-level authentication; exposed RDP violates all three when shortcuts linger.
What vendors must do now
NHS England's note asks suppliers to submit remediation evidence within 14 days or risk suspension from onboarding new trusts. Steps include removing direct RDP exposure, enforcing privileged access workstations, and logging sessions to SIEM platforms that trusts can audit. Smaller subcontractors without dedicated security staff are directed to NCSC's early-warning service and free migration guides for remote access.
For hospital IT teams, the reminder is to verify third-party connectivity maps before winter pressure peaks. A compromised estates vendor can pivot into clinical networks even when patient-facing systems are segmented. Friday's advisory does not name firms, but procurement leads should expect questions on RDP during October stand-ups.
Managed service providers
Many NHS suppliers rely on MSPs for overnight patching; assessors found some MSP jump boxes exposed because change windows were deferred. NHS England's letter asks both the MSP and the trust contract owner to attest remediation, shifting liability up the chain. The Cyber Security and Resilience Bill would extend incident reporting duties to MSPs serving essential services, making Friday's reminder a preview of statutory obligations.
Trusts are also scanning for TeamViewer and AnyDesk sessions that bypass corporate VPN, another pattern assessors flagged in September renewals.