Security management
The third knowledge-transfer element covers security management, including the security information a receiving organisation needs to operate the system.
What the public record carries
Not stated in the public record beyond the element title, and the introduction's note that this element, which spans organisations, adds material on the handover exchange. The text of 5.3.4 is not public.
Basis. The public contents name the element and the introduction says it carries extra communication sub-clauses. The text is not public.
Why it matters in a health estate
Security is the element where the buyer most often receives a questionnaire answer instead of evidence. A statement that the supplier is certified tells the buyer about the supplier's management system, not about the configuration of the system it now operates. What has to cross the boundary is the configuration, the patching route, the vulnerability disclosure route, the logging the buyer can see and the incident process that joins the two organisations.
What to do now
List the security facts the receiving organisation needs to operate the system and test that each one arrived. Include the configuration baseline, the patching responsibility, the disclosure route, the log access and the joint incident process.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Configuration baseline | The configuration the system was accepted with, and who can change it |
| Patching route | Who patches what, on what cadence, and how the buyer is told |
| Disclosure route | How a vulnerability reaches the supplier and what the buyer hears back |
| Incident process | The joint process, its contacts and the last test of it |
What a reviewer will ask
An auditor will ask for the configuration and the patching record of the system in use, not the supplier's certificate.
Common gaps
- A supplier certificate is accepted as evidence of the system's configuration
- The buyer cannot see the logs it would need to investigate an incident
- No one knows who patches a component until a vulnerability is announced
- The joint incident process has never been tested
Before the draft publishes
Ask for the configuration baseline and the patching record. Their absence is the finding.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The CISO and the supplier's security lead, because this element carries security evidence and obligations across the boundary.