CyberCrowd are experienced specialists in helping various organisations complete the self-assessment process to fulfil the NHS’s Data Security and Protection Toolkit requirements (DSPT).

The Data Security and Protection Toolkit (DSPT) is a self-assessment tool that allows businesses to compare their results against the ten data security guidelines set out by the National Data Guardian. Any organisation that has access to NHS patient records or NHS mail must complete the DSPT in order to show an appropriate degree of compliance.

The main goal of the DSPT is that organisations should demonstrate that they can be trusted with the confidentiality and security of personal information. It also supports organisations to meet the requirements of new legislation including the likes of the General Data Protection Regulation (GDPR) and Network and Information Systems (NIS) Directive.

CyberCrowd is able to assist an organisation with the DSPT accreditation by:
  • Identifying any gaps in their organisational landscape
  • Providing guidance on how to overcome such gaps
  • Assessing the technical controls currently deployed
  • Providing policies, processes and registration required by the DSPT framework

The DSPT standard is renewed annually and it is essential that all organisations renew the standard to ensure they maintain access to NHS systems and digital information.

The 10 data security guidelines for DSPT are:
People
01
Ensure
All staff ensure that personal confidential data in all forms is process correctly
02
Understand
All staff understand their responsibilities under the National Data Guardian's Data Security Standards and their accountability.
03
Complete
All staff complete appropriate data security training.
Process
04
Access
Confidential data is only accessible to staff who need it for their current role and is managed correctly.
05
Review
Processes are reviewed at least annually to make sure they are fit for purpose
06
Action
Cyber attacks against services are identified and resisted. The correct action is and taken immediately following a data breach.
07
Test
A continuity plan is in place and tested to respond to threats to data security.
Technology
08
Support
No unsupported operating systems, software or internet browsers are being used.
09
Protection
A strategy is in place for protecting IT systems from cyber threats and is reviewed regularly.
10
Data
IT suppliers are held accountable via contracts for protecting the personal confidential data they process