Advanced Computer Software Group: £3.07M ICO Fine

What happened

Advanced Computer Software Group is an NHS software supplier whose systems were compromised in a ransomware attack in August 2022, affecting NHS 111 and other critical health services. The ICO investigation found that Advanced had procured a vulnerability scanning tool but had not been using it, and that its internal patching records were inaccurate, showing patching activities that had not been performed to the claimed standard. The company presented itself as meeting recognised security standards. The ICO's finding was that claimed compliance, unsupported by contemporaneous evidence of controls actually operating, is treated as no compliance at all. The provisional fine of £6 million was reduced to £3.07 million to reflect remediation steps taken after the attack. The Annex A 8.15 immutable logging requirement introduced in the ISO 27001:2022 revision exists precisely to prevent this scenario: a blockchain-timestamped log of vulnerability scans and patch activities, created at the time of each event, would be unmodifiable proof that the scanning was actually occurring.