Security Wiki

NHS DSPT Audit – The Mandatory Assertions (2025–26 Edition)

Written by Craig Pepper | Oct 23, 2025 1:36:56 PM

 

1.3 — Accountability and Governance

Purpose:
To ensure that data security and protection have clear ownership at senior level. Leadership must actively oversee compliance, not delegate it entirely to IT or compliance staff.

Requirements:

  • A named Data Protection Officer (DPO) or Senior Information Risk Owner (SIRO)

  • Documented information governance structure and reporting lines

  • Regular reviews of data security performance at board or senior management level

Evidence Examples:

  • Governance meeting minutes

  • IG policy and organogram

  • Annual data security report signed by the SIRO

Best Practice Tips:

  • Include DSPT progress as a standing agenda item at leadership meetings

  • Use dashboards or KPIs for visibility

Related Standards: ISO 27001 A.5 (Leadership & Commitment), NCSC Cyber Governance Guidance

4.2 — Identity and Access Management

Purpose:
To ensure users have the correct access at all times and unauthorised access is prevented.

Requirements:

  • Documented Joiners, Movers, Leavers (JML) process

  • Multi-factor authentication (MFA) for all critical systems

  • Regular access reviews (at least quarterly)

Evidence Examples:

  • User access logs and audit trails

  • Policy defining least-privilege principles

  • MFA configuration reports

Best Practice Tips:

  • Automate account provisioning and removal

  • Implement role-based access control (RBAC)

Related Standards: ISO 27001 A.9, Cyber Essentials Plus (User Access Control)

4.4 — Privileged User Access

Purpose:
To restrict and monitor administrative access that could modify systems or data.

Requirements:

  • Dedicated admin accounts, separate from user accounts

  • Approval process for granting privileged access

  • Monitoring and review of privileged activity

Evidence Examples:

  • Privileged Access Register

  • PAM (Privileged Access Management) system logs

  • Change control or ticketing records

Best Practice Tips:

  • Use just-in-time access tools

  • Implement session recording for admin actions

Related Standards: ISO 27001 A.9.2, NCSC Principle 3 (Access Control)

6.1 — Incident and Near-Miss Reporting

Purpose:
To ensure incidents are captured, investigated, and used to drive improvement.

Requirements:

  • A confidential reporting mechanism accessible to all staff

  • Defined process for logging, categorising, and escalating incidents

  • Feedback loop to staff on outcomes and lessons learned

Evidence Examples:

  • Incident logs or service desk reports

  • Training materials encouraging reporting

  • Post-incident review documentation

Best Practice Tips:

  • Run awareness campaigns promoting “report, don’t hide”

  • Use near-miss data to prevent future breaches

Related Standards: ISO 27001 A.16, NHS Digital Incident Reporting Guidelines

6.3 — Vulnerability Management

Purpose:
To ensure known vulnerabilities are addressed promptly and effectively.

Requirements:

  • Formal patching and remediation policy

  • Monitoring of NHS Digital alerts (CareCERT)

  • Lessons learned from prior incidents applied

Evidence Examples:

  • Patch deployment schedules

  • Vulnerability scans before and after remediation

  • Change control documentation

Best Practice Tips:

  • Track vulnerabilities via a risk register

  • Prioritise critical patches within 14 days

Related Standards: ISO 27001 A.12.6, NCSC Vulnerability Management Guidance

7.2 — Continuity and Disaster Recovery Testing

Purpose:
To confirm the organisation can recover data and services following a disruption.

Requirements:

  • Business Continuity Plan (BCP) and Disaster Recovery (DR) Plan in place

  • Annual testing of recovery processes

  • Clear Recovery Time and Recovery Point Objectives (RTO/RPO)

Evidence Examples:

  • Test reports and outcomes

  • Lessons-learned logs

  • Board sign-off on plan updates

Best Practice Tips:

  • Test both IT and business recovery

  • Include communications and stakeholder updates in scenarios

Related Standards: ISO 27001 A.17, NHS DSPT Business Continuity Requirements

7.3 — Incident Response Capability

Purpose:
To ensure the organisation can detect, contain, and recover from cyber incidents rapidly.

Requirements:

  • Documented Incident Response Plan (IRP)

  • Trained incident response team

  • Access to monitoring and forensic data

Evidence Examples:

  • Tabletop exercise records

  • Escalation flowcharts

  • Incident playbooks

Best Practice Tips:

  • Conduct at least one live simulation annually

  • Define communication plans for patients, staff, and regulators

Related Standards: ISO 27035, NCSC Incident Management Guidelines

8.3 — Patch Management

Purpose:
To keep all systems supported and up to date.

Requirements:

  • Central patch management policy

  • Monthly patching cycle or as per vendor guidance

  • Records of verification and success rates

Evidence Examples:

  • Patch deployment logs

  • Reports from WSUS/SCCM/Intune or equivalent tools

  • Vulnerability scanner validation

Best Practice Tips:

  • Maintain asset inventory to track patch status

  • Automate patch reporting and exceptions

Related Standards: ISO 27001 A.12.6, Cyber Essentials Plus (Security Update Control)

8.4 — Vulnerability Management (Network Focus)

Purpose:
To identify and mitigate technical weaknesses before attackers exploit them.

Requirements:

  • Regular vulnerability scans of networks and systems

  • Documented remediation workflows

  • Executive reporting on remediation progress

Evidence Examples:

  • Scanner outputs and risk ratings

  • Remediation tracker logs

  • Penetration test results

Best Practice Tips:

  • Schedule quarterly internal scans and annual external penetration tests

  • Integrate results into SIEM or ticketing platforms

Related Standards: ISO 27001 A.12.6, NCSC 10 Steps – Vulnerability Management

9.3 — System Security

Purpose:
To protect critical systems and applications from exploitation.

Requirements:

  • Hardened configurations and secure builds

  • Patch compliance and monitoring

  • Regular security assessments

Evidence Examples:

  • Secure configuration checklists

  • Test results for clinical or operational systems

  • Penetration test reports

Best Practice Tips:

  • Apply CIS or NCSC hardening benchmarks

  • Implement configuration drift monitoring

Related Standards: ISO 27001 A.14, NCSC System Hardening Guidance

9.6 — Firewall Management

Purpose:
To ensure firewalls effectively protect the organisation from external threats.

Requirements:

  • Documented firewall policy

  • Change control for rule updates

  • Regular review of configurations and logs

Evidence Examples:

  • Firewall configuration review reports

  • Change-request tickets

  • Monitoring alerts or log summaries

Best Practice Tips:

  • Conduct quarterly rule-set reviews

  • Use intrusion-prevention and application-layer filtering

Related Standards: ISO 27001 A.13, NCSC Boundary Protection Guidance

10.1 — Supplier Assurance

Purpose:
To ensure all third-party suppliers meet data-security expectations.

Requirements:

  • Supplier register with contract details and risk ratings

  • Evidence of DSPT, CE+, or ISO 27001 compliance

  • Annual supplier assurance reviews

Evidence Examples:

  • Supplier assurance questionnaires

  • Signed data-processing agreements

  • Certificates of compliance

Best Practice Tips:

  • Tier suppliers by risk level

  • Include cyber clauses in all new contracts

Related Standards: ISO 27036, NCSC Supply Chain Security Guidance