Internet first policy

Internet first is driven by government policies to improve digital service effectiveness and efficiency from the use of both internet and public cloud.  

This was taken up at a departmental level by the Department of Health and Social Care. A Digital Health and Care system: Digital First in Primary Care proposed internet access to enable a channel shift to things like self-management and online consultations.  

The Government Transformation Strategy 2017, “Extended the digital agenda from the citizen to maximising the benefit of collaboration and flexibility across departments and government bodies.”  

The Government Digital Services Technology Leaders Network reviewed the positioning of centralised private networks in January 2017 and confirmed that, for the vast majority of public services, the internet is OK. They also said that new services should be made available on the internet. 

In October 2018 the Secretary of State’s (SoS) paper ‘The future of healthcare: our vision for digital, data and technology in health and care’, demanded a ‘radical new approach’. He later stated that the NHS should come off ‘expensive private networks,’ and that digital services should be accessible over the internet by March 2021. 

The internet first’ approach MUST be considered if:

• you have digital services that needs to be accessible outside of your internal network
• you have digital services that are dependent on a national private network

If you have digital services that fall into these categories, then you should work with your supplier to update them to become internet accessible. 

When asked to identify their internet-facing services, organisations often provide one of the following:

• a list of web or API services. This is understandable, given that this is how we (as users) interact with these services.
• a list of protocols and ports in use. These can easily be taken from known and baselined configuration settings (such as firewall rules).

However, it's likely that other machines (or processes) will use internet-facing services. A service's users are probably not limited to staff or customers. System integrators, third party suppliers, managed service providers, home workers, process orchestration tools could be considered 'users' of a service.

So, we've defined an internet-facing service as 'any service accessed by anyone via any number of ports, protocols or services over the internet'.