{"text_format":"2","workbook":"xlsx","n_sheets":3,"sheets":["Cover_sheet","Functions","Information_Assets"],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Cover_sheet","index":0,"n_rows":8,"n_cols":2,"rows_kept":8,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Practical templates for scoping essential functions"]
[null,"The templates in this document have been created to help CAF-aligned DSPT organisations think about and scope their essential functions. \n"]
[null,"The Functions sheet shows an example where an organisation starts by categorising its functions, assesses whether or not those functions support its essential services, and then lists the information assets and systems which support those functions.\n"]
[null,"The Information_Assets sheet shows an example where an organisation starts with its existing information assets register (based on the NHSE IAFR template), then evaluates what essential functions are being supported by the assets or systems, and whether or not they should be included in the scope of the organisation's CAF-aligned DSPT.\n"]
[null,"These templates are given as examples only."]
[null,"Organisations do not have to use these templates when scoping their essential functions. Organisations also do not have to adhere to the same systems of categorisation of their functions. Organisations are encouraged to take an approach that best suits their environment."]
[null,"The templates in this document have only been partially filled out. Organisations should ensure that all information assets and systems are accounted for in their own scoping exercises, and that they assess which ones fall within the scope of their CAF-aligned DSPT assessment using the official guidance - https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/2024-25-caf-aligned-dspt-guidance/overview/scoping-essential-functions\n"]

{"sheet":"Functions","index":1,"n_rows":28,"n_cols":8,"rows_kept":28,"cut":false,"hidden":false,"merged":[[19,0,22,0],[24,0,26,0],[1,0,3,0],[4,0,12,0],[4,1,5,1],[4,2,5,2],[10,1,12,1],[13,0,18,0],[14,1,16,1],[14,2,16,2]]}
["Function category","Function description","Essential function [Yes/No]","Information, system or network name","Corresponding IAFR asset reference [if applicable]","Does the information, system, or network contain personal data? [Yes/No]","Could a failure or attack have a spread or cascade effect across other services? [Yes/No]","Should the information, system or network be included in the scope for the DSPT? [Yes/No]"]
["Business support","Commercial","Yes","Contracts management system"]
[null,"Communications","Yes","Website"]
[null,"Complaints management","Yes","Complaints management record system","PAL004","Yes","Yes","Yes"]
["Healthcare services/specialisms  ","Access to patient records","Yes","Electronic patient record system"]
[null,null,null,"Shared care record system","NUR002","Yes","Yes","Yes"]
[null,"Accident and emergency","Yes","Triage system"]
[null,"Maternity services","Yes","Digital maternity record system"]
[null,"Pathology","Yes","Laboratory Information Management System"]
[null,"Pharmacy","Yes","Pharmacy management software"]
[null,"Radiology","Yes","X-ray machines"]
[null,null,"Yes","Ultrasound machines"]
[null,null,"Yes","MRI"]
["Information technology","Data centre","Yes","Cloud data centre"]
[null,"Hardware","Yes","Desktops"]
[null,null,null,"Electrocrdiogram machines"]
[null,null,null,"Routers"]
[null,"Networks","Yes","HSCN"]
[null,"Software","Yes","Virtual desktop environment"]
["Infrastructure","Catering","Yes","Food inventory system"]
[null,"Cleaning","Yes","Cleaning checklist system"]
[null,"Entertainment","No","Entertainment system","ENT001","No","Yes","Yes"]
[null,"Sterilisation","Yes","External sterilisation and decontamination service provided by Supplier X"]
["Retail ","Tracking products purchased","No","Retail system","RT101","No","No","No"]
["Staffing     ","Staff renumeration","Yes","Payroll system","FIN003","Yes","Yes","Yes"]
[null,"Staff training ","Yes","Staff training files","LD001","Yes","Yes","Yes"]
[null,"Arranging staffing and cover","Yes","Rostering system"]
["[Additional function categories to be added here]","[Additional function descriptions to be added here]","[Yes/No]","[Additional information, systems or networks names to be added here]"]

{"sheet":"Information_Assets","index":2,"n_rows":15,"n_cols":30,"rows_kept":15,"cut":false,"hidden":false,"merged":[[0,1,0,6],[1,25,2,29]]}
[null,"Information Asset Register - an information asset is a collection of information grouped by type, which has value to your organisation"]
[{"$nulls":25},"DSPT SCOPING ASSESSMENT"]
[]
["Asset number","Asset name","Asset Description","Has a data protection impact assessment (DPIA) been completed for this asset, or the processing this asset relates to?","Which organisation is responsible for the asset (Controller)?","Do you jointly manage the asset with another organisation?","Do you instruct another organisation to collect or use this data (Processor)? ","Is the information in paper or electronic format or both?","What personal data is used?","What sensitive (including special category data) is used?","What is your legal basis for holding personal data?","What is your legal basis for holding sensitive (including special category) data?","For health and care data only, how is the Common Law Duty of Confidentiality met?","Where is the asset held geographically?","Where is the asset stored?","How long will the data be retained for?","What is the impact if the asset is lost or compromised?","What security measures are in place for the asset?","How frequently is updated information added?","For electronic systems only, how frequently is the asset backed up?","Who is the Information Asset Owner?","Who is the Information Asset Administrator?","Which team is responsible for the asset?","Date asset last reviewed (DD/MM/YY)","Proposed review date (DD/MM/YY)","What function(s) does the asset / system support?","Does the asset / system support your essential service(s)? [yes/no]","Does the asset / system contain personal data? [see column I]","Could a failure or attack have a spread or cascade effect across other services?","Should the asset / system be included in the scope for the DSPT?"]
[{"$nulls":5},"(Yes - and add organisation name;No)","(Yes - add organisation name; No)","(Paper;\nElectronic;\nBoth)",null,"(Health and care; Biometric; Genetic; Sexual life or orientation; Racial or ethnic origin; Political opinions; Religious beliefs; Trade union membership; None)","(Consent; Contract; Legal obligation; Public task; Legitimate interest; Other - please state; Not applicable - corporate data only)","(Employment; Legal claims; Substantial public interest; Provision or management of health and care services; Public health; Archiving, Historical or Scientific interest; Other - please state; Not applicable - no special category data)","(Implied consent (for individual care); Explicit consent; Section 251 support - add reference number; Legal requirement - add details; Substantial public interest; Not applicable - no health and care data)  ","(In the UK; Outside UK - please specify)",null,null,"(Low; Medium; High or Critical)","(Role based access controls (RBAC), Encryption at rest; Password protection; Secured cabinet; Other - please state)","(Real-time; Daily; Weekly; Monthly; Never; Other - please state)","(Real-time; Hourly; Daily, Weekly; Monthly; Other - please state)"]
["[This should uniquely identify the asset]","[This should allow you to easily identify what information the entry on this register refers to. An example might be staff training files, care planning data, diagnostic imaging data, contracts]","[Brief description of the asset and why it is needed]","[A data protection impact assessment (DPIA) will ensure that you consider and mitigate potential data protection risks to an acceptable level before processing data that identifies individuals (personal data)]","[This is the organisation(s) that will decide why and how the data is being used and shared]","[This may occur where organisations are using the data for the same purpose, where you share a dataset with another organisation, or where you have designed a new collection with another organisation.\n\nIf you have answered yes, please add the organisation name and add details to the Contact details tab]","[An organisation listed here is likely to be told:\n-what data to collect\nwho to collect data from\n-how the collection is legal\n-the purpose for the collection\n-who to share the data with\n-how long to keep the data]\n","[Select from dropdown list]","[Demographic - contact details, gender, date of birth etc; Financial; Employment; Images; IP address; NHS number; Multiple - please state all that apply; Other - please state; None - corporate data only\n\nPlease enter all that apply]","[Data protection laws mean that some data is considered particularly sensitive. This is called special category data. Data that relates to criminal offences is also considered particularly sensitive. \n\nPlease enter all that apply]","[Public task is mostly likely to be relevant for the provision of NHS and social care services regulated by the Care Quality Commission. \n\nHowever, for some information assets a different legal basis may be appropriate - see https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ for more information. For example, you might rely on consent for cookies on a website; a contract for apps where users accept Terms and Conditions; and legitimate interests may be relevant for private organisations]","[The most common legal bases for health and care have been listed here.\n\n-Employment - for example, to check a person’s eligibility to work in the NHS or a local authority \n\n-Legal claims or judicial acts - the information is required to exercise, enforce or defend a legal right or claim, for example a person bringing litigation against a health or care organisation \n\n-Substantial public interest - the information is needed to comply with your legal obligations to provide information where there is a substantial public interest, with a basis in law - for example, setting up a system to share safeguarding information \n\n-Provision or management of health and care services - information is needed to comply with your legal obligations to provide or manage health or social care services - providing health and care to a person, or ensuring health and care systems function to enable care to be provided \n\n-Public health - information is needed to comply with your legal obligations for public health, using and sharing information is necessary to deal with threats to public health, or to take action in response to a public health emergency (such as a vaccination programme) \n\n-Archiving, historical or scientific interest - where this is in the public interest - for example, a clinical trial for a new drug, with relevant safeguards in place for the use of the participant’s health and care information. [See Health Research Authority guidance on legal basis for processing data for research. Processing must be in the public interest to rely on this legal basis]\n\n-None - the use of special category data is not proposed]","[-Implied consent is for individual care or local clinical or care audits\n\n-Explicit consent is a very clear and a positive indication of consent. Explicit consent is sought when identifiable patient data is needed to be used for purposes other than individual care, such as for planning services\n\n-Section 251 (of the National Health Service Act 2006) support - this means you have support from the Secretary of State for Health and Care or the Health Research Authority following an application to the Confidentiality Advisory Group (CAG). CAG must be satisfied that it isn’t possible or practical to seek consent\n\n-Legal requirement includes where NHS England has directed an organisation to share the data using its legal powers\n\n-Substantial public interest is, for example, to prevent or detect a serious crime or to prevent serious harm to another person. The justification to disclose must be balanced against the public interest in maintaining public confidence in health and care services. An example would be setting up a system to notify relevant organisations of safeguarding concerns\n\n-Not applicable - we are not proposing to use health and care data]","[This is likely to be in the UK if it is paper records held at one of your sites. If you have a supplier who stores paper records for you, they will be able to confirm. IT or software suppliers will be able confirm.]","[e.g. location of filing cabinets or data servers on your estate, rooms or areas in the premises, cloud servers.\n\nFor electronic records, your IT team or software supplier will be able to confirm.]","[Refer to Records Management Code of Practice (https://transform.england.nhs.uk/information-governance/guidance/records-management-code/records-management-code-of-practice-2021/) for guidance. \n\nTypes of records not referenced within the Code must only be kept for as long as they are needed.]","[Low impact - a lost or compromised asset may have a slight impact on day to day activities\nMedium impact - lost or compromised asset will have a larger impact but a workaround may still available\nHigh impact - with this asset lost or compromised the organisation would struggle to perform day to day activities\nCritical impact - without this asset the organisation cannot operate]","[You need to have measures in place to ensure that the data is safe and it won’t be used, either on purpose or accidentally, in ways that are unlawful. The measures needed will be dependent upon, and proportionate to, the data which is being used.\n\nPlease enter all that apply]","[Select real-time if you update the asset as soon as data comes through. Or indicate if you perform a batch update once you receive 20 new records, for example.]","[Your IT team or provider, or software supplier should be able to confirm this.]","[Provide role below and add full details to Contact details tab.\n\nThe Information Asset Owner is likely to be a very senior member of staff, for example a director. They are responsible and accountable for the asset.]","[If applicable, provide role below and add full details to Contact details tab.\n\nThe Information Asset Administrator manages the asset on a daily basis, for example a Head of Service. Some smaller organisations may not have an Information Asset Administrator as management may be taken on by the Information Asset Owner.]","[See examples below]","[This must be done annually at the very minimum but best practice is to update this register following any changes.]","[This must be done annually at the very minimum]","State the function(s) supported by the asset / system.\n\nIf your answer in column AA is \"Yes\", then it is an essential function.\n","Where relevant, this will include consideration of: \n- any essential services for operators of essential services designated under the Network and Information System (NIS) Regulations \n- any statutory purposes for statutory organisations\n- the purposes for which your organisation is constituted ","If the asset / system contains personal data, it would be in scope for your DSPT submission.","If an attack or failure of the asset / system could spread or have a cascade effect across other essential functions, it would be in scope for your DSPT submission.","If the answer is \"Yes\" in any one of columns AA, AB or AC, then the asset / system should be included in the scope of your DSPT submission. \n\nCalculation based on criteria set out in guidance document https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/2024-25-caf-aligned-dspt-guidance/overview/scoping-essential-functions"]
["LD001","Staff training files","Certificates and logs of staff training courses, needed to manage and evidence statutory training requirements","No","Dental Practice A","No","No","Both","Demographic, employment","None","Public task","Not applicable - no special category data","Not applicable - no identifiable health and care data","In the UK","Certificates stored in top drawer of filing cabinets, Room 2. Logs stored on H:\\Staff\\Training\\Logs","10 years","Medium","RBAC, encryption at rest, secured cabinet","Monthly","Daily","Training Manager","Training Coordinator","Learning and Development","2022-11-23","2023-11-23","Staff training","Yes","Yes","Yes","Yes"]
["NUR002","Shared care records","Shared care records needed to provide individual care","Yes","Health Organisation A","Yes - Care Organisation B","Yes - IT System Supplier B","Electronic","Demographic, NHS number","Health and care, Sexual life or orientation, Racial or ethnic origin","Public task","Provision or management of health and care services","Implied consent","In the UK","Care planning system","8 years","Medium","RBAC, encryption at rest","Real-time","Real-time","Head Nurse","Deputy Head Nurse","Nursing","2022-10-15","2023-10-15","Access to patient records","Yes","Yes","Yes","Yes"]
["FIN003","Staff pay data","Payslips and logs relating to staff pay","No","Care Organisation A","No","Yes - Payroll Provider A","Electronic","Demographic, financial","None","Legal obligation","Not applicable - no special category data","Not applicable - no identifiable health and care data","In the UK","Payroll system","10 years","Medium","RBAC, password protection","Monthly","Real-time","Head of Finance","Finance Manager","Finance","2022-10-31","2023-10-31","Staff remuneration","Yes","Yes","Yes","Yes"]
["PAL004","Complaint management records","Record of complaints and descriptions, letters","No","Care Organisation A","No","No","Both","Demographic","Health and care","Public task","Provision or management of health and care services","Implied consent","In the UK","Letters stored in filing cabinets, Room 3. Complaint logs stored on H:\\Patients\\Complaints\\Logs","10 years","High","RBAC, secured cabinet","Real-time","Real-time","PALS Manager","PALS Officer","PALS","2022-09-13","2023-09-13","Complaints management","Yes","Yes","Yes","Yes"]
["RD005","Breast cancer research records","Dataset with health details of participants to support research into breast cancer","Yes","Health Organisation A","No","No","Electronic","Demographic, NHS Number","Health and care","Public task","Archiving, historical or scientific interest","Explicit consent","In the UK","H:\\research\\project23","No longer than 20 years","High","RBAC, encryption at rest, password protected","Never","Real-time","Director of Clinical Research","Clinical Research Fellow","Breast Cancer Clinical Research","2022-11-27","2023-11-27","Access to patient records","Yes","Yes","Yes","Yes"]
["FM006","Facilities management contracts","Contracts for all facilities management services for the estate","No","Local Authority A","No","No","Both","Demographic (estates staff)","None","Public task","Not applicable - no special category data","Not applicable - no identifiable health and care data","In the UK","P:\\Estates\\Contracts","6 years from end of contract","Medium","Password protection","Real-time","Daily","Facilities Director","Head of Estates Management","Maintenance","2022-12-01","2023-12-01","Commercial","Yes","No","No","Yes"]
["RT101","Retail system","Logs retail sales in shop on premises","No","Health Organisation A","No","No","Electronic","None - corporate data only","None","Not applicable - corporate data only","Not applicable - no special category data","Not applicable - no identifiable health and care data","In the UK","In Till system","6 Years  ","Low","RBAC, encryption at rest, password protected","Real-time","Daily","Facilities Director","Head of Estates Management","Retail","2024-10-16","2025-10-16","Tracking products purchased","No","No","No","No"]
["ENT001","Entertainment system","Provides TV to Childrens ward","No","Health Organisation A","No","No","Electronic","None - corporate data only","None","Not applicable - corporate data only","Not applicable - no special category data","Not applicable - no identifiable health and care data","In the UK","Entertainment system","6 years","Low","RBAC, encryption at rest","Monthly","Daily","Facilities Director","Head of Estates Management","Maintenance","2024-10-16","2025-10-16","Entertainment","No","No","Yes","Yes"]
["[insert asset number]","[insert asset name]","[insert asset description]","[Yes / No]","[insert organisation]","[Yes / No]","[Yes / No]","[Paper / Electronic / Both]","[insert description of personal data used]","[insert description of sensitive information used]","[insert legal basis for holding personal data]","[insert legal basis for holding special category data]","[insert detail for how Common Law Duty of Confidentiality is met]","[insert location]","[insert location]","[insert timeframe]","[Low / Medium / High]","[insert security measure]","[insert frequency]","[insert frequency]","[insert owner]","[insert administrator]","[insert responsible team]","[DD/MM/YYYY]","[DD/MM/YYYY]","[insert function]","[Yes / No]","[Yes / No]","[Yes / No]","[Yes / No]"]