{"text_format":"2","workbook":"xlsx","n_sheets":3,"sheets":["25-26 requirements","Assertions","Change control"],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":0,"defined_names":2,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"25-26 requirements","index":0,"n_rows":142,"n_cols":21,"rows_kept":142,"cut":false,"hidden":false,"merged":[[136,0,140,0],[107,0,114,0],[115,0,117,0],[128,0,133,0],[134,0,135,0],[61,0,67,0],[90,0,91,0],[100,0,102,0],[103,0,104,0],[87,0,89,0],[68,0,72,0],[79,0,80,0],[92,0,99,0],[81,0,86,0],[9,0,11,0],[58,0,60,0],[12,0,24,0],[25,0,27,0],[38,0,39,0],[40,0,43,0],[44,0,46,0],[47,0,49,0]]}
["Assertion","Input Type","v7 24-25 Evidence ref","v8 25-26 Evidence ref","Change summary","V8 2024-25 (new) Evidence Text - IT Suppliers (Category 2)","V8 2024-25 (new) Tooltips - IT Suppliers (Category 2)","Required to meet standard (mandatory) -  IT Suppliers (Category 2)","Evidence text - Others (Category 3)","Tool tips - Others (Category 3)","Required to meet standard (mandatory) - Others (Category 3)","Evidence text - GP (Category 4)","Tool tips - GP (Category 4)","Required to meet standard (mandatory) - GP (Category 4)","Exempt for NHS Mail","Exempt for Cyber Essentials PLUS","Exempt for ISO27001","Exempt for PSN IA","Exempt if Audit","Approaching standards mandatory","Social Care Category"]
["The organisation has a framework in place to support Lawfulness, Fairness and Transparency","Text","1.1.1","1.1.1","None","State your organisation's Information Commissioner's Office (ICO) registration number.","You can check your registration status, date for renewal and what your ICO registration number is on the [Information Commissioner's Office website](https://ico.org.uk/esdwebpages/search)\n\nYou must provide your organisation's Information Commissioner's Office (ICO) registration number as evidence that you hold a current registration with the ICO and have paid the data protection fee. This is a legal requirement for all health and care organisations (controllers) who process personal information.","Yes","What is your organisation's Information Commissioner's Office (ICO) registration number?","Registration with the ICO is a legal requirement for every organisation that uses or shares personal information, unless they are exempt as a small charity.  If your organisation is not already registered, you should [register as a matter of urgency](https://ico.org.uk/for-organisations/data-protection-fee/).  \n\nYou can check whether you are registered and what your ICO registration number is on the [Information Commissioner's Office website](https://ico.org.uk/esdwebpages/search).","Yes","What is your organisation's Information Commissioner's Office (ICO) registration number?","Registration with the ICO is a legal requirement for every organisation that uses or shares personal information, unless they are exempt as a small charity.  If your organisation is not already registered, you should [register as a matter of urgency](https://ico.org.uk/for-organisations/data-protection-fee/).  \n\nYou can check whether you are registered and what your ICO registration number is on the [Information Commissioner's Office website](https://ico.org.uk/esdwebpages/search).","Yes",{"$nulls":5},"x","Policies and procedures"]
[null,"Document","1.1.2","1.1.2","Update tooltip for category 2","Your organisation has documented what personal data you hold, where it came from, who you share it with and what you do with it.","You should document your information assets and flows relevant to or supporting health and care services in a combined register, which should have been reviewed and approved by relevant group/person with delegated responsibility since 1st July 2025. You may previously have captured these in separate records of processing activities (ROPA) and information asset and data flows registers (IAR). \n\nDetails of who conducted the register review and approval, along with when it occurred, should be submitted in the comment box.\n\n[Further information on what should be included is available](https://www.dsptoolkit.nhs.uk/Help/88).","Yes","Does your organisation have an up to date list of the ways in which it holds and shares different types of personal and sensitive information?","To be compliant with data protection legislation you must keep a register of all of the information your organisation stores, shares and receives. The exact information you should include is explained in detail in the guidance below. \n \nThis list is called an Information Asset Register (IAR) and it should detail where and how the information is held and how you keep it safe. You should also have a list or lists of the types of personal data that are shared with others, for example needs assessments, prescriptions, payslips, care plans. This list is called a Record of Processing Activities (ROPA) and should detail how the data is shared and how your organisation keeps it safe. You can combine these into one document, but it is fine to have two separate documents.\n \nThe register should have been reviewed and approved by the management team at least once in the last twelve months.\n\n[Example templates for the ROPA and IAR are available from \nDigital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/how-to-document-your-data-processing/).","Yes","Does your organisation have an up to date list of the ways in which it holds and shares different types of personal and sensitive information?","To be compliant with data protection legislation you must keep a register of all of the information your organisation stores, shares and receives. The exact information you should include is explained in detail in the guidance below. \n\nThis list is called an Information Asset Register (IAR) and it should detail where and how the information is held and how you keep it safe. You should also have a list or lists of the types of personal data that are shared with others, for example needs assessments, prescriptions, payslips, care plans. This list is called a Record of Processing Activities (ROPA) and should detail how the data is shared and how your organisation keeps it safe. It is fine to have either two separate documents or a single document that combines both lists.\n\nThe register should have been reviewed and approved by the management team at least once in the last twelve months.\n\n[Example templates for the ROPA and IAR are available from \nDigital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/how-to-document-your-data-processing/).","Yes",{"$nulls":5},"x","Policies and procedures"]
[null,"Document","1.1.3","1.1.3","Update evidence item and tooltip for category 2,3 and 4","Privacy information (for example your Privacy Notice and Rights for individuals) is published and available to the public.","You must display transparency information so that people understand how their data is used and shared. If possible, provide a web link or another publicly available document, and detail how printed materials are made available to people if relevant (for example, patient information leaflets provided to patients upon admission to the service). Is should be available in a range of formats for different audiences. \n\n[Guidance on privacy notices is available at the Information Commissioner's Office website](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/the-right-to-be-informed/what-privacy-information-should-we-provide/).","Yes","Does your organisation have a privacy notice?","If you use and share personal data then you must tell people what you are doing with it.  This includes why you need the data, what you'll do with it, who you're going to share it with and individual's rights under data protection legislation for example, the right to access their information.\n \nThis should be set out in writing in 'a privacy notice'. You should provide this information in a clear, open and honest way using language which is easy to read and understand,  and in a range of formats for different audiences. \n\nYour privacy notice should cover all data you process for example the data relating to the people you support and their relatives, staff, volunteers, members of the public.  You may have more than one privacy notice, for example one for staff and another one for the people you support.\n \n[An example privacy notice is available from Digital Care Hub](https://www.digitalcarehub.co.uk/resource/privacy-notice-template/).","Yes","Does your organisation have a privacy notice?","If you use and share personal data then you must tell people what you are doing with it.  This includes why you need the data, what you'll do with it, who you're going to share it with and individual's rights under data protection legislation for example, the right to access their information.\n \nThis should be set out in writing in 'a privacy notice'. You should provide this information in a clear, open and honest way using language which is easy to read and understand,  and in a range of formats for different audiences. \n\nYour privacy notice should cover all data you process for example the data relating to the people you support and their relatives, staff, volunteers, members of the public.  You may have more than one privacy notice, for example one for staff and another one for the people you support.\n \nAn example privacy notice is available from [British Medical Association](https://www.bma.org.uk/advice-and-support/ethics/confidentiality-and-health-records/gdpr-privacy-notices-for-gp-practices).","Yes",{"$nulls":5},"x","Policies and procedures"]
[null,"Document","1.1.4","1.1.4","Update tooltip for category 2","Your business has identified, documented and classified its hardware and software assets and assigned ownership of protection responsibilities.","The Information Asset Register should have been reviewed and approved since 1st July 2024  by the SIRO or equivalent, details of this should be recorded in the comments. \n\n[Further information is available from the National Cyber Security Centre](https://www.ncsc.gov.uk/guidance/asset-management)\n\nYou should demonstrate this in one of the following ways:\n- upload the document\n- provide a screenshot, if it’s in a system\n- provide a link to the document\n- state where it’s stored","Yes"]
[null,"Text","1.1.5","1.1.5","Update evidence item for category 3 and 4","List the names and job titles of your organisation's key staff with responsibility for data protection and data security.","Organisations will require, at minimum, a Data Protection Officer (DPO), a Senior Information Risk Officer (SIRO), a Caldicott Guardian, a Head of IT and a Cyber Security Lead. Along with listing names and job titles, you should be able to explain how these specialised roles are situated in your organisational structure.","Yes","Your organisation's approach to security is owned and directed by senior responsible individuals, with regular discussions driven by individuals who have overall accountability for security.","Whilst data security and data protection is everybody's business, there must be a named person within your organisation who takes overall senior responsibility for data security and protection issues. Their responsibility is to provide senior level leadership and guidance.\n \nIn the text box, name the person or people within your organisation with overall responsibility for data security and protection, along with their roles. Then, for each person, describe how this responsibility has been formally assigned to them. For instance, this responsibility could form part of their job description, or be noted in the minutes of a management meeting, or be in an email from the appropriate director in your organisation. Your organisation may also have additional specialised roles, for example a [Data Protection Officer](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/#:~:text=The%20DPO%20must%20be%20independent,a%20single%20DPO%20between%20them.) or a [Caldicott Guardian](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1013756/Caldicott_Guardian_guidance_v1.0_27.08.21.pdf).\n\n[You can read more about data security and protection responsibilities and specialised roles on the Digital Care Hub](https://www.digitalcarehub.co.uk/resource/data-security-and-protection-responsibilities/).","Yes","Your organisation's approach to security is owned and directed by senior responsible individuals, with regular discussions driven by individuals who have overall accountability for security.","Whilst data security and data protection is everybody's business,  there must be a named person within your organisation who takes overall senior responsibility for data security and protection issues. Their responsibility is to provide senior level leadership and guidance.\n \nIn the text box, name the person or people within your organisation with overall responsibility for data security and protection, along with their roles. Then, for each person, describe how this responsibility has been formally assigned to them. For instance, this responsibility could form part of their job description, or be noted in the minutes of a management meeting, or be in an email from the appropriate director in your organisation. Your organisation may also have additional specialised roles, for example a [Data Protection Officer](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/#:~:text=The%20DPO%20must%20be%20independent,a%20single%20DPO%20between%20them.) or a [Caldicott Guardian](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1013756/Caldicott_Guardian_guidance_v1.0_27.08.21.pdf)\n\n\n[You can read more about data security and protection responsibilities and specialised roles on the Digital Care Hub](https://www.digitalcarehub.co.uk/resource/data-security-and-protection-responsibilities/)..","Yes",{"$nulls":5},"x","Staffing and roles"]
[null,"Yes/No","1.1.6","1.1.6","None","Your organisation has reviewed how it asks for and records consent to share personal data.","Health and/or care organisations may require patient consent under data protection legislation for activities such as patient mailing lists. More commonly, patient consent is required under the common law duty of confidentiality. This would apply in situations when a patient's data is used in ways they would not reasonably expect, for example, when used for research purposes. Consent is also required when sharing confidential patient information with a third party, such as a carer or family member. Please provide details of all your organisation's activities in the comments. \n\nConsent should be covered in general data protection and confidentiality policies or a separate consent policy in line with  [Information Commissioner's Office guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/).  You should ensure that you clearly differentiate between consent under data protection legislation and consent under the common law duty of confidentiality.\n\nIf an organisation is not using consent to process health and/or care data, it should tick Yes and state in the comments that the organisation does not use consent to process health and/or care data.","Yes","Your organisation has reviewed how it asks for and records, consent to share personal data.","Generally, consent under data protection law is not appropriate in health and care settings, but there are some circumstances where it may be necessary, such as for mailing lists. Further guidance on consent under data protection legislation is available on the [ICO website](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/).\n\nConsent under the common law duty of confidentiality, however, is more frequently applicable. For example, an individual must provide their consent to share information with their carer. Provide details on your processes for gaining this consent in the comments.",null,"Your organisation has reviewed how it asks for and records, consent to share personal data.","Generally, consent under data protection law is not appropriate in health and care settings, but there are some circumstances where it may be necessary, such as for mailing lists. Further guidance on consent under data protection legislation is available on the [ICO website](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/).\n\nConsent under the common law duty of confidentiality, however, is more frequently applicable. For example, an individual must provide their consent to share information with their carer. Provide details on your processes for gaining this consent in the comments.",{"$nulls":7},"Policies and procedures"]
[null,"Yes/No","1.1.7",null,"Removed"]
[null,"Text","1.1.8",null,"Removed"]
["Individuals' rights are respected and supported","Yes/No","1.2.2","1.2.2","None","Your organisation has processes in place to deliver individuals rights including to handle an individual's objection to the processing of their personal data.","Further guidance is available on the [ICO website](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/).","Yes"]
[null,"Yes/No","1.2.3","1.2.3","None","Your organisation has a process to recognise and respond to individuals' requests to access their personal data.","Use the comments box to provide evidence of the number of Subject Access Requests your organisation has received and show that they have been responded to within the required timescale. You must note if any requests were answered late.","Yes"]
[null,"Yes/No","1.2.4","1.2.4","None","Your organisation is compliant with the national data opt-out policy.","Please provide a link to your published [compliance statement](https://digital.nhs.uk/services/national-data-opt-out-programme/compliance-with-the-national-data-opt-out) in the comments box, which might be within a privacy notice or a published data release register.\n\nIf your organisation is not in scope for the National Data Opt Out, then tick and write \"Not applicable\" in the comments box.","Yes","Is your organisation compliant with the national data opt-out policy?","The national data opt-out gives everyone the ability to stop health and social care organisations from sharing their confidential information for research and planning purposes, with some exceptions such as where there is a legal mandate/direction or an overriding public interest for example to help manage the covid-19 pandemic. \n \nAs a provider, you should help the people who use your services to understand that they can opt out of their data being used for other purposes. You should check that your policies, procedures, and privacy notice cover the opt out. \n \nFrom July 2022, it is a legal requirement for all health and social care CQC registered organisations to be compliant with the national data opt out. \n\nMore detailed guidance that gives advice about compliance with the national data opt-out policy is available from [NHS England](https://digital.nhs.uk/services/national-data-opt-out-programme/compliance-with-the-national-data-opt-out) and [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/national-data-opt-out/).","Yes","Is your organisation compliant with the national data opt-out policy?","The national data opt-out gives everyone the ability to stop health and social care organisations from sharing their confidential information for research and planning purposes, with some exceptions such as where there is a legal mandate/direction or an overriding public interest for example to help manage the covid-19 pandemic. \n \nAs a provider, you should help the people who use your services to understand that they can opt out of their data being used for other purposes. You should check that your policies, procedures, and privacy notice cover the opt out. \n \nFrom July 2022, it is a legal requirement for all health and social care CQC registered organisations to be compliant with the national data opt out. \n\nMore detailed guidance that gives advice about compliance with the national data opt-out policy is available from [NHS England](https://digital.nhs.uk/services/national-data-opt-out-programme/compliance-with-the-national-data-opt-out) and [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/national-data-opt-out/).","Yes",{"$nulls":6},"Policies and procedures"]
["Accountability and Governance in place for data protection and data security","Yes/No","1.3.1","1.3.1","Update evidence item for category 3 and 4","There are board-approved data security and protection policies in place that follow relevant guidance.","You should have policies and staff guidance in place communicating your organisation's principles and procedures for data protection. These should be updated every three years at the minimum, and locally maintain evidence of when each update was made.","Yes","Does your organisation have up to date policies in place for data protection and for data and cyber security, aligned with good practice guidance and (where applicable) national policies?","You should have policies and staff guidance in place communicating your organisation's principles and procedures for data protection. \n \n- data protection\n- data quality\n- record keeping\n- data security\n- where relevant, network security \n \nThese should be updated every three years at the minimum, and locally maintain evidence of when each update was made.\n\nPolicy templates are available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/data-security-and-protection-toolkit/template-policies/).","Yes","Does your organisation have up to date policies in place for data protection and for data and cyber security, aligned with good practice guidance and (where applicable) national policies?","You should have policies and staff guidance in place communicating your organisation's principles and procedures for data protection. \n \n- data protection\n- data quality\n- record keeping\n- data security\n- where relevant, network security \n \nThese should be updated every three years at the minimum, and locally maintain evidence of when each update was made.\n\nPolicy templates are available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/data-security-and-protection-toolkit/template-policies/).","Yes",{"$nulls":5},"x","Policies and procedures"]
[null,"Yes/No","1.3.2","1.3.2","Update tooltip for category 2","Your organisation monitors your own compliance with data protection policies and regularly reviews the effectiveness of data handling and security controls.","You should regularly check that your policy-based procedures are fit for purpose, and that your staff understand them. \n\nYou should locally maintain evidence that; spot checks have been carried out on an annual basis at minimum, one has been done since 1st July 2024, details of any actions arising from the spot checks are recorded including who is responsible for taking them forward.\n\nThe checks can be done as part of other audits you carry out and can include [staff awareness questions](https://www.dsptoolkit.nhs.uk/Help/21) through the Data Security Awareness training or local materials.","Yes","Does your organisation monitor your own compliance with data protection policies and regularly review the effectiveness of data handling and security controls?","Your organisation should carry out spot checks that staff are doing what it says in your data protection, staff confidentiality and related policies. These should be undertaken at least every year. They could be part of other audits that you carry out. \n \nYou should keep a record that spot checks have been carried out, including details of any actions, who has approved the actions, and who is taking them forward if applicable. \n\n[There is an example audit checklist that you can download from Digital Care Hub](https://www.digitalcarehub.co.uk/resource/data-security-audit-checklist/).","Yes","Does your organisation monitor your own compliance with data protection policies and regularly review the effectiveness of data handling and security controls?","Your organisation should carry out spot checks that staff are doing what it says in your data protection, staff confidentiality and related policies. These should be undertaken at least every year. They could be part of other audits that you carry out. \n \nYou should keep a record that spot checks have been carried out, including details of any actions, who has approved the actions, and who is taking them forward if applicable. \n\n[There is an example audit checklist that you can download from Digital Care Hub](https://www.digitalcarehub.co.uk/resource/data-security-audit-checklist/).","Yes",{"$nulls":6},"Policies and procedures"]
[null,"Yes/No","1.3.3","1.3.3","None","SIRO responsibility for data security has been assigned.","There is a board-level individual who has overall accountability for the security of networks and information systems and drives regular discussion at board-level. The SIRO responsibility is included in their job description/role and responsibilities document.\n","Yes"]
[null,"Yes/No","1.3.4","1.3.4","None","There are clear documented lines of responsibility and accountability to named individuals for data security and data protection.","Lines of responsibility should be evidenced in an agreed document, such as an Information Governance framework, which sets out key staff members' responsibilities and accountabilities.","Yes"]
[null,"Text","1.3.5","1.3.5","None","Your organisation operates and maintains a data security and protection risk register (including risks from supply chain) which links to the corporate risk framework providing senior visibility.","Describe your organisation's approach to information risk management. This should include details of the senior staff member with responsibility for managing information risks, who coordinates procedures put in place to mitigate them. It should be reviewed regularly.\n\nFurther guidance is available from the [National Cyber Security Centre.](https://www.ncsc.gov.uk/collection/risk-management-collection).","Yes",{"$nulls":8},"x"]
[null,"Text","1.3.6","1.3.6","Update tooltip for category 3 and 4","List your organisation's top three data security and protection risks.","This should be fed from the organisations data security risk management framework.\n\nRecord at a heading level.","Yes","What are the top three data and cyber security risks in your organisation and how does your organisation plan to reduce those risks?","All organisations have risks and should be able to identify what they are. Thinking about your responses to all of the questions in the toolkit, consider which three areas carry the most risk for your organisation.\n\nProvide a brief headline for each risk and say what your organisation plans to do to reduce that risk. Your risk conclusions should be communicated to accountable senior individuals.",null,"What are the top three data and cyber security risks in your organisation and how does it plan to reduce those risks?","All organisations have risks and should be able to identify what they are. Thinking about your responses to all of the questions in the toolkit, consider which three areas carry the most risk for your organisation. \n\nProvide a brief headline for each risk and say what your organisation plans to do to reduce that risk. Your risk conclusions should be communicated to accountable senior individuals.",{"$nulls":4},"x",null,null,"Data security"]
[null,"Yes/No","1.3.7","1.3.7","None","Your organisation has implemented appropriate technical and organisational measures to integrate data protection into your processing activities.","Your data protection procedures should be approved by the Board or equivalent.\n\nThe procedures should, at a minimum, ensure that the UK GDPR principles and\nappropriate measures to protect personal data are built into your organisation's processing activities and business practices by default. They should be enforced all the way through the lifecycle of your projects and processes, from beginning to end. ","Yes","Does your organisation's data protection policy describe how you keep personal data safe and secure?","Your policy should describe how your organisation identifies and accounts for privacy and data protection issues before commencing a new project or process. This is called 'data protection by design'. This might be a new data sharing initiative, for example, becoming part of a shared care record, setting up a new care record system, or using personal data for a new purpose such as research.  \n \nYour policy should also explain how your organisation only collects, uses and shares the minimum amount of data necessary for the purpose; how you ensure that data is only available to those who need it; how you store data only for as long as is needed; and how you let people know what you are doing with their data. This is called 'data protection by default'.\n\nThere is guidance on data protection by design and by default on the [ICO's website](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-by-design-and-default/). The Data Protection Policy template that is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/data-protection-policy-template/) covers this subject.","Yes",{"$nulls":8},"x","Policies and procedures"]
[null,"Yes/No","1.3.8","1.3.8","None","Your organisation understands when you must conduct a Data Protection Impact Assessment and has processes in place, which links to your existing risk management and project management, to action this.","The organisation should have an approved DPIA Procedure or equivalent.\nThe procedure should follow the [Information commissioner's office guidance](https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/).","Yes","Does your organisation's data protection policy describe how you identify and minimise risks to personal data when introducing, or changing, a process or starting a new project involving personal data?","Your policy should describe the process that your organisation has in place to make sure that it systematically identifies and minimises the data protection risks of any new project or plan that involves processing personal data. For example, when you introduce a new care recording system; if you install CCTV; if you use new remote care or monitoring technology; if you share data for research or marketing purposes.\n\nThis type of risk assessment is called a Data Protection Impact Assessment (DPIA). Your organisation should consider whether it needs to carry out a DPIA at the early stages of any new project if it plans to process personal data. A DPIA should follow relevant guidance from the [Information Commissioner's Office (ICO)](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/). The Data Protection Policy template that is available from [Digital Care Hub] (https://www.digitalcarehub.co.uk/resource/data-protection-policy-template/) covers this subject.","Yes","Does your organisation's data protection policy describe how you identify and minimise risks to personal data when introducing, or changing, a process or starting a new project involving personal data?","Your policy should describe the process that your organisation has in place to make sure that it systematically identifies and minimises the data protection risks of any new project or plan that involves processing personal data. For example, when you introduce a new care recording system; if you install CCTV; if you use new remote care or monitoring technology; if you share data for research or marketing purposes.\n\nThis type of risk assessment is called a Data Protection Impact Assessment (DPIA). Your organisation should consider whether it needs to carry out a DPIA at the early stages of any new project if it plans to process personal data. A DPIA should follow relevant guidance from the [Information Commissioner's Office (ICO)](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/).",{"$nulls":6},"x","Policies and procedures"]
[null,null,"1.3.9",null,"Removed"]
[null,"Yes/No","1.3.11","1.3.11","None",null,null,null,"If staff, directors, trustees and volunteers use their own devices (e.g. phones) for work purposes, does your organisation have a bring your own device policy and is there evidence of how this policy is enforced?","The devices referred in this question include laptops, tablets, mobile phones, CDs, USB sticks etc. This applies to use of devices whether the person is on duty or not e.g. if they access your system(s) when not on shift. Please explain how this policy is enforced in the comments box. \n\nIf nobody uses their own devices, then tick and write \"Not applicable\" in the comments box.\n\nA template Bring Your Own Device (BYOD) policy, and examples of how this policy might be enforced, is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/smart-phone-policy-template-byod/).","Yes",{"$nulls":8},"x","IT Systems and devices"]
[null,"Text","1.3.12","1.3.12","None",null,null,null,"How does your organisation make sure that paper records are safe when taken out of the building?","Paper records may be taken out of your organisation's building(s), for example for hospital appointments or visits to people's homes. Leaving documents in cars, for instance, can be risky. How does your organisation make sure paper records are kept safe when 'on the move'?\n\nIf you do not have any paper records or do not take them off site, write \"Not applicable\" in the text box.","Yes",{"$nulls":8},"x","Data security"]
[null,"Text","1.3.13","1.3.13","None",null,null,null,"Briefly describe the physical controls your buildings have that prevent unauthorised access to personal data.","Physical controls that support data protection include lockable doors, windows and cupboards, clear desk procedure, security badges, key coded locks to access secure areas etc. \nProvide details at high level and, if you use more than one building, summarise how compliance is assured across your organisation's sites.","Yes","Briefly describe the physical controls your buildings have that prevent unauthorised access to personal data.","Physical controls that support data protection include lockable doors, windows and cupboards, clear desk procedure, security badges, key coded locks to access secure areas etc. \nProvide details at high level and, if you use more than one building, summarise how compliance is assured across your organisation's sites.","Yes",null,null,null,"x",null,"x","Data security"]
[null,"Text","1.3.14","1.3.14","None",null,null,null,"What does your organisation have in place to minimise the risks if mobile phones are lost, stolen, hacked or used inappropriately?","Smartphones are especially vulnerable to being lost or stolen. What has been put in place by your organisation to protect them to prevent unauthorised access? E.g. is there a PIN or fingerprint or facial scan? Is there an app set up to track the location of a lost/ stolen smartphone, and 'wipe' its contents remotely? You may need to ask your IT supplier to assist with answering this question.\n\nIf your organisation does not use any mobile phones, write \"Not applicable\" in the text box. Guidance is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/protect-mobile-devices-and-tablets/).","Yes",{"$nulls":9},"IT Systems and devices"]
["Records are maintained appropriately","Yes/No","1.4.1","1.4.1","None","The organisation has a records management policy including a records retention schedule.","You should have a records management policy which sets out responsibilities and covers the whole record lifecycle. This should include secure storage, tracking, transfer and disposal. \n\nThe retention schedule is based on business need with reference to statutory requirements and the [NHS Records Management Code of Practice](https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/).","Yes","Does your organisation have a timetable which sets out how long you retain records for?","Your organisation should have a retention timetable in place for all the different types of records that it holds, including finance, staffing and care records. The timetable, or schedule as it is sometimes called, should be based on [the Records Management Code of Practice 2021](https://transform.england.nhs.uk/information-governance/guidance/records-management-code/).","Yes","Does your organisation have a timetable which sets out how long you retain records for?","Your organisation should have a retention timetable in place for all the different types of records that it holds, including finance, staffing and care records. The timetable, or schedule as it is sometimes called, should be based on [the Records Management Code of Practice 2021](https://transform.england.nhs.uk/information-governance/guidance/records-management-code/).","Yes",{"$nulls":5},"x","Policies and procedures"]
[null,"Text","1.4.2","1.4.2","None",null,null,null,"If your organisation uses third parties to destroy records or equipment that hold personal data, is there a written contract in place that has been reviewed in the last twelve months? This contract should meet the requirements set out in data protection regulations.","It is important that when there is no longer a valid reason to keep personal data that it is disposed of securely. This applies to paper documents, electronic records and equipment, such as old computers and laptops, mobile phones, CDs and memory sticks.\n\nIf your organisation uses a contractor to destroy any records or equipment, such as a document shredding company or IT recycling organisation, then the contract(s) or other written confirmation with third parties must include the requirement to have appropriate security measures and the facility to allow audit by your organisation.  Further information about the destruction of records is in chapter 5 of the [Records Management Code of Practice](https://transform.england.nhs.uk/information-governance/guidance/records-management-code/).\n\nIf you do not use third parties to destroy records or equipment, then write \"Not applicable\" in the text box. Advice on contracts for secure disposal of personal data is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/advice-on-contracts-for-secure-disposal-of-personal-data/).","Yes",{"$nulls":8},"x","Policies and procedures"]
[null,"Text","1.4.3","1.4.3","None",null,null,null,"If your organisation destroys any records or equipment that hold personal data, how does it make sure that this is done securely?","It is important that when there is no longer a valid reason to keep personal data that it is disposed of securely. This applies to paper documents, electronic records and equipment, such as old computers and laptops, mobile phones, CDs and memory sticks. If anyone in your organisation destroys any records or equipment themselves, such as shredding documents, briefly describe how the organisation makes sure that this is done securely. \n\nIf you do not destroy records or equipment yourselves, or only use a third party to do so, write \"Not applicable\" in the text box.\n\n[Digital Care Hub](https://www.digitalcarehub.co.uk/resource/record-keeping-policy-template/) has a Record Keeping policy that has details on the safe destruction of personal data.","Yes","If your organisation destroys any records or equipment that hold personal data, how does it make sure that this is done securely?","It is important that when there is no longer a valid reason to keep personal data that it is disposed of securely. This applies to paper documents, electronic records and equipment, such as old computers and laptops, mobile phones, CDs and memory sticks. If anyone in your organisation destroys any records or equipment themselves, such as shredding documents, briefly describe how the organisation makes sure that this is done securely. \n\nIf you do not destroy records or equipment yourselves, or only use a third party to do so, write \"Not applicable\" in the text box.\n\n[Digital Care Hub](https://www.digitalcarehub.co.uk/resource/record-keeping-policy-template/) has a Record Keeping policy that has details on the safe destruction of personal data.",{"$nulls":6},"x","Policies and procedures"]
["Staff are supported in understanding their obligations under the National Data Guardian's Data Security Standards","Yes/No","2.1.1","2.1.1","Update - Removed for category 2",null,null,null,"Does your organisation have an induction process that covers data security and protection, and cyber security?","All new staff, directors, trustees and volunteers who have access to personal data, should have an induction that covers data security and protection as well as cyber security. It is good practice to keep records of who has been inducted and to review the induction process on a regular basis to ensure it is effective and up to date. \n \nDigital Care Hub provides a free [Data Security and Protection elearning training course](https://www.digitalcarehub.co.uk/elearning/) that organisations can use as part of their staff induction.","Yes","Does your organisation have an induction process that covers data security and protection, and cyber security?","All new staff, directors, trustees and volunteers who have access to personal data, should have an induction that covers data security and protection as well as cyber security. It is good practice to keep records of who has been inducted and to review the induction process on a regular basis to ensure it is effective and up to date. \n \nDigital Care Hub provides a free [Data Security and Protection elearning training course](https://www.digitalcarehub.co.uk/elearning/) that organisations can use as part of their staff induction.","Yes",null,null,"x","x",null,"x","Staffing and roles"]
["Staff contracts set out responsibilities for data security","Yes/No","2.2.1","2.2.1","None","All employment contracts contain data security requirements.","Please provide any explanatory text in the comments box.\n\nThe text of the contract should go beyond confidentiality agreements and include, for example, requirements to follow the relevant IT security policies and procedures.","Yes","Do all employment contracts, and volunteer agreements, contain data security requirements?","Clauses in contracts or agreements should reference data security (confidentiality, integrity and availability). Many contracts commonly focus on just confidentiality.\n\nYour organisation's staff employment contracts, and volunteer and trustee agreements if you have them, should be reviewed to see if they need to be updated to include a clause on data security.\n\nThere is an example staff contract clause available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/staff-confidentiality-contract-clause-template/).","Yes","Do all employment contracts, and volunteer agreements, contain data security requirements?","Clauses in contracts or agreements should reference data security (confidentiality, integrity and availability). Many contracts commonly focus on just confidentiality. \n\nYour organisation's staff employment contracts, and volunteer and trustee agreements if you have them, should be reviewed to see if they need to be updated to include a clause on data security.","Yes",null,null,"x",null,null,"x","Staffing and roles"]
["Staff have appropriate understanding of information governance and cyber security, with an effective range of approaches taken to training and awareness","Document","3.1.1","3.1.1","None","Training and awareness activities form part of organisational mandatory training requirements, with a training and awareness needs analysis (covering all staff roles) that is formally endorsed and resourced by senior leadership.","You should upload your Training Needs Analysis (TNA) document including details of how you have determined the appropriate training and awareness needs of different staff groups and who has endorsed the document. \n\nThe TNA should show the details of the different teaching and communication techniques in use, each showing the intended audience.\n\nYou should also upload a document setting out details of how you make information available in appropriate ways for all staff groups, e.g. intranet pages, posters, briefings at staff meetings etc. This can form part of the overall TNA document.\n\nSupport and guidance on TNA is available at: https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/data-security-and-protection-toolkit-assessment-guides/guide-3---staff-training/training-needs-analysis-and-delivery-3.1.1-to-3.1.3\n\nIf your organisation is an IT supplier, this should cover staff involved in services provided in the role of supplier to health and care organisations.","Yes","Has a training needs analysis covering data security and protection, and cyber security, been completed in the last twelve months?","A training needs analysis is a process which helps identify the data security and protection, and cyber security, training and development needs across your organisation. Your organisation's training needs analysis should identify the level of training or awareness raising required by your staff, directors, trustees and volunteers if you have them.\n \nIt should be reviewed and/or approved annually by the person(s) with overall responsibility for data security and protection within your organisation and a copy should be uploaded or the location of the plan recorded. \n \nAn example training needs analysis is available to download from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/training-needs-analysis/).","Yes",{"$nulls":5},"x",null,null,null,"Staffing and roles"]
[null,"Text","3.1.2","3.1.2","None","Your organisation's defined training and awareness activities are implemented for and followed by all staff.","You should provide details of:\n\nInitial and refresher activities and expected intervals, for all staff roles, and how you ensure all staff receive them. \n\nThe proportion of staff completing their role-appropriate training \nor awareness in the last interval period.\n\nSupport and guidance is available at:https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/data-security-and-protection-toolkit-assessment-guides/guide-3---staff-training/training-needs-analysis-and-delivery-3.1.1-to-3.1.3.\n\nIf your organisation is an IT supplier, this should be followed by all staff involved in services provided in the role of supplier to health and care organisations.","Yes"]
[null,"Text","3.1.3","3.1.3","None","Provide details of how you evaluate your training and awareness activities.","This could include:\n\nPeriodic evaluations of staff groups showing they have appropriate knowledge and behaviours for their role. \n\nProportion of incidents that have inadequate staff awareness as a contributing factor. \n\nMetrics showing effectiveness of security campaigns (e.g. surveys / increased reporting of particular focus areas after a campaign). \n\nEvidence showing that your published information is accessed and used by staff. \n\nThe findings and actions taken from any evaluations.\n\nSupport and guidance on evaluation is available at:https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/data-security-and-protection-toolkit-assessment-guides/guide-3---staff-training/training-needs-analysis-and-delivery-3.1.1-to-3.1.3","Yes"]
["Your organisation engages proactively and widely to improve information governance and cyber security, and has an open and just culture for information incidents.","Yes/No","3.2.1","3.2.1","Update tooltip for category 3 and 4","Information governance and cyber security matters are prioritised by the board or equivalent senior leaders.","This could include:\n\nEvidence of the board supporting and funding awareness initiatives.\n\nEvidence that the SIRO, Caldicott Guardian and other senior leaders engage across the organisation, such as through attending meetings, promotion of and participation in security campaigns, etc.","Yes","Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?","All people in your organisation with access to personal data must complete appropriate data security and protection, and cyber security, training every year. Your organisation's training needs analysis should identify the level of training or awareness raising that people need, and you should use a range of training and awareness methods to reach all staff effectively.\n\nThere is an understanding that due to illness, maternity/paternity leave, attrition or other reasons it might not be possible for 100% of people to receive training every year. Therefore, the target is 95% of people with access to personal data. For clarity, it is the last twelve months prior to the date of publication. \n\nDigital Care Hub provides a free [Data Security and Protection eLearning training course](https://www.digitalcarehub.co.uk/elearning/) that meets this requirement for staff working in adult social care.","Yes","Have at least 95% of staff, directors, trustees and volunteers in your organisation completed training on data security and protection, and cyber security, in the last twelve months?","All people in your organisation with access to personal data must complete appropriate data security and protection, and cyber security, training every year. Your organisation's training needs analysis should identify the level of training or awareness raising that people need, and you should use a range of training and awareness methods to reach all staff effectively.\n\nThere is an understanding that due to illness, maternity/paternity leave, attrition or other reasons it might not be possible for 100% of people to receive training every year. Therefore, the target is 95% of people with access to personal data. For clarity, it is the last twelve months prior to the date of publication. \n\n","Yes",{"$nulls":6},"Staffing and roles"]
[null,"Text","3.2.2","3.2.2","None","Actions are taken openly and consistently in response to information governance and cyber security concerns.","This could include:\n\nDetails of the approach that is taken when an information incident or near miss occurs, demonstrating a 'just culture'.\n\nDetails of incident follow-ups showing recognition, e.g. positive news stories on prevention of wider incidents. \n\nEvidence of handling concerns and other feedback made by members of the public, such as through Patient Advice and Liaison Services. \n\nSupport and guidance on Just Culture is available at: https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/data-security-and-protection-toolkit-assessment-guides/guide-3---staff-training/culture"]
[null,"Text","3.2.3","3.2.3","None","Your information governance and cyber security programme is informed by wide and representative engagement with staff.","This could include:\n\nDetails of representative membership on your information governance and cyber security steering group(s). \n\nEvidence of initiatives with wide staff involvement, such as information assets and flows registers."]
["Staff with specialist roles receive data security and protection training suitable to their role","Text","3.3.1","3.3.1","None",null,null,null,"Provide details of any specialist data security and protection training undertaken.","Details of any additional training as identified by your Data Security Training Needs analysis. Such as staff with roles as Caldicott Guardian, in Informatics (IT and Information areas), Medical Records, Clinical Coding & Information Governance (including privacy / confidentiality & data protection).",{"$nulls":10},"Staffing and roles"]
["Leaders and board members receive suitable data protection and security training","Yes/No","3.4.1","3.4.1","None",null,null,null,"Have the people with responsibility for data security and protection received training suitable for their role?","It is likely that the person or people within your organisation who are responsible for data security and protection will need additional and more in depth training than the majority of your staff. Your organisation's training needs analysis should identify any additional training required by people with increased data security and protection responsibilities or specialist roles, for example a Data Protection Officer (DPO).","Yes",{"$nulls":9},"Staffing and roles"]
["The organisation maintains a current record of staff and their roles","Yes/No","4.1.1","4.1.1","None","Your organisation understands who has access to personal and confidential data through your systems, including any systems which do not support individual logins.","Each system may use its own user list(s) or use federated access. There may be systems where there is no alternative to have individual logins but there are alternative methods of maintaining user lists. Where this occurs, it is understood, and risk assessed by the organisation.","Yes","Does your organisation have an up to date record of staff, and volunteers if you have them, and their roles?","Your organisation must have a list of all staff, and volunteers if you have them, and their current role. This list should be kept up to date, including any change of role, new starters and removal of leavers. This might be linked to your existing payroll or rostering system.","Yes","Does your organisation have an up to date record of people and their roles?","Your organisation must have a list of all staff, and volunteers if you have them, and their current role. This list should be kept up to date, including any change of role, new starters and removal of leavers. This might be linked to your existing payroll or rostering system.","Yes",{"$nulls":5},"x","Staffing and roles"]
[null,"Yes/No","4.1.2","4.1.2","Update tooltip for category 2","Users in your organisation are only given the minimum access to sensitive information or systems necessary for their role.","This is to support least privileged access and could be demonstrated through an access control policy or Role-based access control.\n \nThe policy and/or RBAC have been reviewed since 1 July 2024."]
["The organisation assures good management and maintenance of identity and access control for it's networks and information systems","Date","4.2.1","4.2.1","None","When was the last audit of user accounts with access to the organisation's systems held?","An audit of staff accounts from your organisation, to make sure there aren't any inappropriate access permissions.\n\nE.g. Request and compare the organisation's leavers list from HR, to its Active Directory (AD) user list to determine if there are any leavers that still have access to the organisation's systems.\n\nRecord the date when the last user audit was held. This should be completed annually as a minimum.\n\nIf your organisation is an IT supplier, this is all staff accounts involved in services provided in the role of supplier to health and care organisations.","Yes",{"$nulls":8},"x"]
[null,"Document","4.2.2","4.2.2","None","Provide a summary of data security incidents in the last 12 months caused by a mismatch between user role and system accesses granted.","This can be an incident either where the staff member's rights to data were too high or too low.  Do not name individuals.\n\nThe summary should also include details of whether remediating actions have been implemented.\n\nIf your organisation is an IT supplier, this is all incidents involved in services provided in the role of supplier to health and care organisations.",null,"Provide a summary of data security incidents in the last 12 months caused by a mismatch between user role and system accesses granted.","This can be an incident either where the staff member's rights to data were too high or too low.  Do not name individuals.",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","4.2.3","4.2.3","None","Logs are retained for a sufficient period, managed securely, reviewed regularly and can be searched to identify malicious activity.","Organisational policy should set out the rules defining log retention and review. The average time to detect a cyber attack is over three months and it is not uncommon for incidents to take significantly longer to detect. The most important logs for identifying malicious activity should be held for six months as a minimum. \n\nOrganisations should consider the ability to trace an incident end to end e.g. network address translation logs can help organisations trace traffic back to the original source address. Please refer to [National Cyber Security Centre guidance.](https://www.ncsc.gov.uk/files/NCSC_SOC_Feeds.pdf)","Yes",{"$nulls":7},"x","x"]
[null,"Yes/No","4.2.4","4.2.4","None","Unnecessary user accounts are removed or disabled.","Former employees', guest and other unnecessary accounts are routinely and promptly removed or disabled from internal workstations, Active Directory domains and other user directories.  Privileged user access is also removed when no longer required or appropriate. This should be included in polices covering access control.","Yes","Does your organisation have a reliable way of removing or amending people's access to IT systems when they leave or change roles?","When people change roles or leave your organisation, there needs to be a reliable way to amend or remove their access to your IT system(s). This could be by periodic audit to make sure that people's access rights are at the right level. It is important that leavers who had access to personal data have their access rights revoked in line with your policies and procedures. This includes access to shared email addresses.\n\nIf your organisation does not use any IT systems, then tick and write \"Not applicable\" in the comments box.","Yes","Does your organisation have a reliable way of removing or amending people's access to IT systems when they leave or change roles?","When people change roles or leave your organisation, there needs to be a reliable way to amend or remove their access to your IT system(s). This could be by periodic audit to make sure that people's access rights are at the right level. It is important that leavers who had access to personal data have their access rights revoked in line with your policies and procedures. This includes access to shared email addresses.","Yes",null,"x",null,null,null,"x","IT Systems and devices"]
["All staff understand that their activities on IT systems will be monitored and recorded for security purposes","Yes/No","4.3.1","4.3.1","Update tooltip for category 2.","All system administrators have signed an agreement which holds them accountable to the highest standards of use.","The identities of all individuals with privileged access to systems involved in services provided to health and care should be known and managed.\n\nYour organisation holds documented evidence that systems administrators have been made aware of their increased responsibilities and have signed an enhanced acceptable use policy statement.\n","Yes","Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?","The people within your organisation who are IT system administrators may have access to more information than other staff. Therefore, they need to be held accountable in a formal way to higher standards of confidentiality than others. \n\nThis requirement applies to IT system administrators working in external companies who support your organisation's IT systems. This formal agreement could be part of a job description or a contract with your IT support company and/or systems supplier/s. \n\nIf your organisation does not use any IT systems, then 'tick' and write \"Not applicable\" in the comments box.","Yes","Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?","The people within your organisation who are IT system administrators may have access to more information than other staff. Therefore, they need to be held accountable in a formal way to higher standards of confidentiality than others.\n\nThis requirement applies to IT system administrators working in external companies who support your organisation's IT systems This formal agreement could be part of a job description or a contract with your IT support company and/or systems supplier/s.\n\nIf your organisation does not use any IT systems, then 'tick' and write \"Not applicable\" in the comments box.","Yes",null,null,"x",null,null,null,"IT Systems and devices"]
[null,"Text","4.3.2","4.3.2","None","Users, systems and (where appropriate) devices are identified and authenticated prior to being permitted access to information or systems.","Please provide details of your strategy/policy/procedure for authentication, ensuring that the strength of authentication mechanisms are proportionate to the criticality of the systems / information they protect. \n\nFor critical systems you should consider if device authentication is required.","Yes",{"$nulls":8},"x"]
[null,"Yes/No","4.3.3",null,"Removed",{"$nulls":15},"IT Systems and devices"]
["You closely manage privileged user access to networks and information systems supporting the essential service","Yes/No","4.4.1","4.4.1","Update tooltip for category 3 and 4","The organisation ensures that logs, including privileged account use, are kept securely and only accessible to appropriate personnel. They are stored in a read only format, tamper proof and managed according to the organisation information life cycle policy with disposal as appropriate.","Organisational policy should set out the rules defining log retention, the approach to storage of logs, including details on maintaining the integrity of the logs and offline backup for disaster recovery purposes.\n\nThe average time to detect a cyber attack is over three months and it is not uncommon for incidents to take significantly longer to detect. The most important logs for identifying malicious activity should be held for six months as a minimum.\n\n[Guidance from NCSC](https://www.ncsc.gov.uk/guidance/security-operations-centre-soc-buyers-guide) on maintaining security of logs is available. \n\nNote: you are not expected to purchase a CSOC.","Yes","The person with responsibility for IT confirms that IT administrator activities are logged and those logs are only accessible to appropriate personnel.","IT Support staff typically have high level access to systems. The identities of these people should be known and managed, and their activities on your systems should be logged and only available to appropriate personnel.\n\nIf your organisation does not use any IT systems, then 'tick' and write \"Not applicable\" in the comments box.",null,"The person with responsibility for IT confirms that IT administrator activities are logged and those logs are only accessible to appropriate personnel.","IT Support staff typically have high level access to systems. The identities of these people should be known and managed, and their activities on your systems should be logged and only available to appropriate personnel.\n\nIf your organisation does not use any IT systems, then 'tick' and write \"Not applicable\" in the comments box.",{"$nulls":7},"IT Systems and devices"]
[null,"Yes/No","4.4.2","4.4.2","None","The organisation does not allow users with wide ranging or extensive system privilege to use their highly privileged accounts for high-risk functions, in particular email and web browsing.","Explain how the organisation prohibits privileged users from using their privileged accounts for high risk activities and how this is enforced in the comments section.","Yes"]
[null,"Yes/No","4.4.3","4.4.3","None","The organisation only allows privileged access to be initiated from devices owned and managed or assured by your organisation.","Where there are any exceptions to this i.e. privileged user access rights have been granted on a non corporate device - please explain the controls in place to formally record and mitigate this risk"]
["You ensure your passwords are suitable for the information you are protecting","Yes/No","4.5.1","4.5.1","None","Your organisation has a password policy giving staff advice on managing their passwords.","The password policy must cover:\n(a) How to avoid choosing obvious passwords (such as those based on easily-discoverable information).\n(b) Not to choose common passwords (use of technical means, such as using a password blocklist, is recommended).\n(c) No password reuse.\n(d) Where and how they may record passwords to store and retrieve them securely.\n(e) If password management software is allowed, and if so, which.\n(f) Which passwords they really must memorise and not record anywhere.\n(g) Assessing risks to ensure systems use appropriate authentication measures e.g. high-strength passwords enforced technically for all users of internet-facing authentication services.","Yes",{"$nulls":7},"x","x"]
[null,"Yes/No","4.5.2","4.5.2","None","Technical controls enforce password policy and mitigate against password-guessing attacks.","Examples of technical controls are [provided by the National Cyber Security Centre.](https://www.ncsc.gov.uk/collection/passwords).","Yes",{"$nulls":7},"x"]
[null,"Yes/No","4.5.3","4.5.3","Update evidence item and tooltip for category 2","Multi-factor authentication is enforced on all remotely accessible user accounts and privileged accounts on all systems, with exceptions only as approved by your board or equivalent senior management.","You should particularly consider all systems that can be accessed from the internet – such as email and any cloud-based or online systems – and either ensure that all user accounts are protected with MFA, or detail any exceptions in the text box response.\n","Yes","Multi-factor authentication is used on all remotely accessible and privileged user accounts user accounts on all systems, with exceptions only as approved by your board or equivalent senior management.\n","Multi-factor authentication (MFA) is one of the most effective ways to protect data and accounts from unauthorised access.\n\nYou should consider all systems that can be accessed from the internet – such as email, clinical care systems, and any cloud-based or online systems – and either ensure that all user accounts are protected with MFA, or detail any exceptions in the text box response.\n\nGuidance on implementing Multi-factor authentication is [available](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/implement-multi-factor-authentication-mfa/).","Yes","Multi-factor authentication is used on all remotely accessible user accounts on all systems, with exceptions only as approved by a relevant board or senior management.","Multi-factor authentication (MFA) is one of the most effective ways to protect data and accounts from unauthorised access.\n \nWhere systems do not support MFA, or where there are significant operational reasons outweighing the risk of not having MFA, then exceptions can be made and should be detailed in the text box response.\n \nExceptions for ICB-commissioned digital services should be decided by the ICB board or senior management.  Exceptions for practice-commissioned digital services may be decided by the practice management.\n\nAll exceptions should be detailed in the text box response.\n\nGuidance on implementing Multi-factor authentication is [available](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/implement-multi-factor-authentication-mfa/).","Yes",{"$nulls":6},"IT Systems and devices"]
[null,"Text","4.5.4","4.5.4","None","Passwords for highly privileged system accounts, social media accounts and infrastructure components shall be changed from default values and should have high strength.","Your policy / procedure should direct that passwords for system accounts, social media accounts and infrastructure components are changed from their default values and replaced with secure passwords in line with the organisation's password policy.","Yes","How does your organisation make sure that staff, directors, trustees and volunteers use good password practice?","If your organisation has any IT systems or computers, it should provide advice for setting and managing passwords. Each person should have their own password/s to access the computer, laptop or tablet that they are using and for other systems. These passwords should be 'strong' i.e. hard to guess. This could be enforced through technical controls i.e. your system(s) require a minimum number of characters or a mixture of letters and numbers in a password. \n\nIf your organisation does not use any IT systems, computers or other devices, write \"Not applicable\" in the text box. \n\nInformation about good password practice is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/use-strong-passwords/).","Yes",{"$nulls":8},"x","IT Systems and devices"]
[null,"Yes/No","4.5.5","4.5.5","None","Your organisation, or your supply chain with access to your systems, grant limited privileged access and third party access only for a limited time period, or is planning to do so.","Explain your organisation's approach for granting third party and privileged access to its infrastructure - this should be pre-approved, time limited to the length of time required to carry out the activity and be monitored and subjected to logging. This should be included in the relevant policy such as privileged access management policy/procedure and/or third party/supplier access policy/procedure.",null,null,"",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No",null,"4.5.6","New - evidence item for category 2","Software provided to health and care supports identity federation or multi-factor authentication to industry standards, or you have an approved, realistic and resourced plan to achieve this not later than 30 Jun 2027.","Identity federation (such as with the NHS Care Identity Service, NHSmail, Entra ID or similar services) is preferred.  Where a software product maintains its own identity and authentication mechanism, a range of authentication factors should be supported.  Examples of factors are described in the explanatory guidance to the [NHS England multi-factor authentication policy](https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/multi-factor-authentication-mfa-policy/).\n\nIf you do not provide any software to health and care, or if all the software you provide is for use cases that do not require any authentication, tick 'Yes' and explain in the comments.","Yes"]
["Process reviews are held at least once per year where data security is put at risk following data security incidents","Yes/No","5.1.1","5.1.1","None","Root cause analysis is conducted routinely as a key part of your lessons learned activities following a data security or protection incident, with findings acted upon.","Explain how the organisation identifies the root cause of data security and protection incidents, how it uses this to design and implement mitigating controls to either prevent similar incidents from occurring in the future or to be in a position to better manage them if they do occur. This should be undertaken with a multi-disciplinary team.\n\nProvide details where process review findings have informed the immediate future technical protection and remediated any systemic vulnerabilities of the system or service, to ensure identified issues cannot arise in the same way again.  ","Yes","If your organisation has had a data breach or a near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?","Confirm that your organisation has reviewed any processes that have caused a breach or a near miss, or which force people to use unauthorised workarounds that could compromise your organisation's data and cyber security. Workarounds could be things such as using unauthorised devices such as home computers or personal memory sticks or forwarding emails to personal email addresses. It is good practice to review processes annually even if a breach or near miss has not taken place.\n\nIf no breaches or near misses in the last 12 months then please tick and write \"Not applicable\" in the comments box.","Yes","If your organisation has had a data breach or a near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?","Confirm that your organisation has reviewed any processes that have caused a breach or a near miss, or which force people to use unauthorised workarounds that could compromise your organisation's data and cyber security. Workarounds could be things such as using unauthorised devices such as home computers or personal memory sticks or forwarding emails to personal email addresses. It is good practice to review processes annually even if a breach or near miss has not taken place.\n\nIf no breaches or near misses in the last 12 months then please tick and write \"Not applicable\" in the comments box.","Yes",null,null,"x",null,null,null,"Data security"]
["Action is taken to address problem processes as a result of feedback at meetings or in year","Yes/No","5.2.1","5.2.1","None","Actions to address problem processes are being monitored, and assurance is given to the board or equivalent senior team.","Explain how the organisation manages and reports on operational process improvements, including if any findings or outstanding actions have been escalated to the Board during the last twelve months.",null,"Are the actions to address problem processes, being monitored and assurance given to the senior team?","Explain the governance around escalation of any issues and findings to the board, or equivalent, such as through reports and briefing notes, during the last twelve months.",null,"Are the actions to address problem processes, being monitored and assurance given to the senior team?","Explain the governance around escalation of any issues to management through reports and briefing notes during the last twelve months.",{"$nulls":7},"Data security"]
["A confidential system for reporting data security and protection breaches and near misses is in place and actively used","Yes/No","6.1.1","6.1.1","None","Data security and protection incidents are reported appropriately and by a full range of staff groups.","You should confirm that a functioning data security and protection breach reporting and management mechanism is in place including use of the DSP Toolkit incident reporting tool for health and care incidents or for  IT suppliers, this should cover incidents in services provided in the role of supplier to health and care organisations.\n\nYou should include in the comments the number of incidents and near misses reported per staff group in your organisation, as a proportion of the number of people in each group. ","Yes","Does your organisation have a system in place to report data breaches?","All staff, and volunteers if you have them, are responsible for noticing and reporting data breaches and it is vital that you have a robust reporting system in your organisation. There is an incident reporting tool within this toolkit which should be used to report health and care incidents to Information Commissioner's Office ICO. \n\nIf you are not sure whether or not to inform the Information Commissioner's Office of a breach, the toolkit's incident reporting tool and guide can help you to decide.\n\nDigital Care Hub has [Staff Guidance on Data Breaches](https://www.digitalcarehub.co.uk/resource/staff-guidance-on-data-breaches/).","Yes","Does your organisation have a system in place to report data breaches?","All staff, and volunteers if you have them, are responsible for noticing and reporting data breaches and it is vital that you have a robust reporting system in your organisation. There is an incident reporting tool within this toolkit which should be used to report health and care incidents to Information Commissioner's Office ICO. \n\nIf you are not sure whether or not to inform the Information Commissioner's Office of a breach, the toolkit's incident reporting tool and guide can help you to decide.\n\nDigital Care Hub has [Staff Guidance on Data Breaches](https://www.digitalcarehub.co.uk/resource/staff-guidance-on-data-breaches/).","Yes",null,null,"x","x",null,"x","Data security"]
[null,"Yes/No","6.1.2","6.1.2","None","The board or equivalent have been informed of the action plan for all data security and protection breaches reported to the ICO and/or the DHSC in the last twelve months.","Use the comments field to outline a summary of:\n- the process in place to provide the Board with an oversight of an action plan that outlines clear steps for mitigating risk and/or service improvement for all data security and personal data breaches, including responsibility and timescales for completing the work. \n\n- how the organisation escalates and manages any actions not completed within the timescales.\n","Yes","If your organisation has had a data breach, were the management team notified, and did they approve the actions planned to minimise the risk of a recurrence?","In the event of a data breach the management team of your organisation, or nominated person, should be notified of the breach and any associated action plans or lessons learnt. \n\nIf no breaches in the last 12 months then please tick and write \"Not applicable\" in the comments box.","Yes","If your organisation has had a data breach, were the management team notified, and did they approve the actions planned to minimise the risk of a recurrence?","In the event of a data breach the management team of your organisation, or nominated person, should be notified of the breach and any associated action plans or lessons learnt.\n\nIf no breaches have occurred in the last 12 months then please tick and write \"Not applicable\" in the comments box.",null,null,null,"x","x",null,"x","Data security"]
[null,"Yes/No","6.1.3","6.1.3","None","Individuals affected by a breach where there is high risk to their right's and freedoms are appropriately informed.","In [accordance with guidance](https://www.nhsx.nhs.uk/information-governance/guidance/personal-data-breaches/). \n\nIf no breaches then please tick and state \"No breaches\".","Yes","If your organisation has had a data breach, were all individuals who were affected informed?","If your organisation has had a data breach that is likely to result in a high risk of adversely affecting individuals' rights and freedoms - e.g. damage to reputation, financial loss, unfair discrimination, or other significant loss - you must inform the individual(s) affected as soon as possible.\n \nIf your organisation has had no such breaches in the last 12 months then please tick and write \"Not applicable\" in the comments box. \n\nMore information is available from the [Information Commissioner's Office](https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/).","Yes","If your organisation has had a data breach, were all individuals who were affected informed?","If your organisation has had a data breach that is likely to result in a high risk of adversely affecting individuals' rights and freedoms - e.g. damage to reputation, financial loss, unfair discrimination, or other significant loss - you must inform the individual(s) affected as soon as possible. \n\nIf your organisation has had no such breaches in the last 12 months then please tick and write \"Not applicable\" in the comments box. \n\nMore information is available from the [Information Commissioner's Office](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/).","Yes",{"$nulls":5},"x","Data security"]
["All user devices are subject to anti-virus protections while email services benefit from spam filtering and protection deployed at the corporate gateway","Yes/No","6.2.1","6.2.1","None","Antivirus/anti-malware software has been installed on all computers that are connected to, or are capable of connecting to the Internet.","This applies to servers, desktop and laptop computers, as well as tablets and mobile devices running desktop operating systems (such as Windows, but not ChromeOS, Android or iOS). Please include the name of your anti-virus product in the comments.","Yes","Do all the computers and other devices used across your organisation have antivirus/antimalware software which is kept up to date?","This applies to all servers, desktop computers, laptop computers, and tablets. Note that antivirus software and antimalware software are the same thing - they both perform the same functions. You may need to ask your IT supplier to assist with answering this question. \n\nIf your organisation does not use any computers or other devices, then tick and write \"Not applicable\" in the comments box.\n\nFurther information is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/have-up-to-date-antivirus-software/).","Yes","Do all the computers and other devices used across your organisation have antivirus/antimalware software which is kept up to date?","This applies to all servers, desktop computers, laptop computers, and tablets. Note that antivirus software and antimalware software are the same thing - they both perform the same functions. You may need to ask your IT supplier to assist with answering this question. \n\nIf your organisation does not use any computers or other devices, then tick and write \"Not applicable\" in the comments box.\n\nFurther information is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/have-up-to-date-antivirus-software/).","Yes",null,"x","x",null,null,"x","IT Systems and devices"]
[null,"Yes/No","6.2.3","6.2.3","None","Antivirus/anti-malware is kept continually up to date.","Provide an explanation of how this is achieved. This could be through automatic update, central deployment, MDE etc.\n\nThis should be documented in your antivirus policy/procedure. ","Yes",{"$nulls":7},"x"]
[null,"Yes/No","6.2.4","6.2.4","None","Antivirus/anti-malware software scans files automatically upon access.","This includes when files are downloaded and opened, and when they are accessed from a network folder.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","6.2.5","6.2.5","None","Connections to malicious websites on the Internet are prevented.","This applies to all corporate devices.  It may be achieved by one or more of the following: using a web proxy, antivirus/anti-malware, browser tools, Protective DNS services, blocklists or other mechanisms. Your organisation should maintain technical documentation that sets out the controls in place.","Yes",{"$nulls":7},"x"]
[null,"Text","6.2.6","6.2.6","None","Number of phishing emails reported by staff per month.","From your service desk system or service the number of reported phishing mails.\n\nYour organisation should maintain a process for staff to escalate potentially malicious phishing emails to the relevant team (IT/IT security). Staff (and temps/contractors) are made aware of this process through information security training or another mechanism.",null,"Number of phishing emails reported by staff per month.","From your service desk system or service the number of reported phishing mails.",{"$nulls":4},"x",{"$nulls":5},"IT Systems and devices"]
[null,"Yes/No","6.2.8","6.2.8","None","You have implemented on your email, Domain-based Message Authentication Reporting and Conformance (DMARC), Domain Keys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your organisation's domains to make email spoofing difficult.","This applies to email systems.","Yes",{"$nulls":6},"x"]
[null,"Yes/No","6.2.9","6.2.9","None","You have implemented spam and malware filtering, and enforce DMARC on inbound email.","This applies to email systems \n\nYou should use the comments field to provide the name of the email filtering product/solution which your organisation uses to prevent potentially malicious emails(including phishing) from reaching the end users' email accounts.","Yes",{"$nulls":6},"x"]
["Known vulnerabilities are acted on based on advice from NHS England, and lessons are learned from previous incidents and near misses","Text","6.3.1","6.3.1","None","If you have had a data security incident, was it caused by a known vulnerability?","Provide details of incidents over the reporting period (a year). Known vulnerabilities are those listed on the [Cyber alerts portal](https://digital.nhs.uk/cyber-alerts).  If no incidents have occurred, state: \"None\".","Yes","If you have had a data security incident, was it caused by a known vulnerability?","Provide details of incidents over the reporting period (a year). If no incidents have occurred state \"None\".",{"$nulls":10},"Data security"]
[null,"Yes/No","6.3.2","6.3.2","Update - Removed for category 2",null,null,null,"Have staff, directors, trustees and volunteers been advised that use of public Wi-Fi for work purposes is unsafe?","Use of public Wi-Fi (e.g. Wi-Fi freely available at cafes and train stations etc) or unsecured Wi-Fi (Wi-Fi where no password is required to access it) could be unsafe and lead to unauthorised access of personal data. Staff, directors, trustees and volunteers if you have them, should be advised of this. \n\nIf nobody uses mobile devices for work purposes out of your building/offices, then tick and write \"Not applicable\" in the comments box.","Yes",{"$nulls":9},"IT Systems and devices"]
[null,"Text","6.3.3","6.3.3","Update evidence item and tooltip for category 2","The organisation has a proportionate monitoring solution to detect security events on systems and services.","Since 1st July 2025, all systems monitoring requirements have been assessed and technology solutions and processes have been implemented to detect cyber security events.  \n\nA risk based approach to monitoring for all systems should be in place ensuring that the organisation's most critical services and assets are in scope of its monitoring solutions. At a minimum this should include infrastructure used for (or supporting) the development, hosting, operation or support of software provided to health and care.  Where any gaps have been identified, mitigations have been put in place.\n","Yes"]
[null,"Yes/No","6.3.4","6.3.4","None","All new digital services that are attractive to cyber criminals (such as for fraud) are implementing transactional monitoring techniques from the outset.","Includes an assessment of which new (implemented in the last 12 months) services are susceptible to fraud and confirmation that transactional-level monitoring has been implemented to assist in the identification of potential instances of fraudulent activity. This should be referenced in systems/services requirements documentation. \n\nIf none, please 'tick' and explain in the comments section.","Yes"]
[null,"Text","6.3.5","6.3.5","None","Have you had any repeat data security incidents within the organisation during the past twelve months?","A repeat incident is defined as an exploitation of the same vulnerability on the same systems or different ones, that occurs within three calendar months of a previous occurrence.\n\nProvide details of how you undertake a review of incidents and consider lessons learned to identify the root cause of incidents and implement mitigations to prevent similar incidents from occurring.",{"$nulls":4},"Have you had any repeat data security incidents within the organisation during the past twelve months?","A repeat incident is defined as an exploitation of the same vulnerability on the same systems or different ones, that occurs within three calendar months of a previous occurrence. Provide details.",{"$nulls":7},"Data security"]
["Organisations have a defined, planned and communicated response to Data security incidents that impact sensitive information or key operational services","Document","7.1.1","7.1.1","Update evidence item and tooltip for category 3 and new evidence item for category 4","Your organisation understands the health and care services it provides or supports.\n","Provide one or more documents which identify: i. What your organisation's key operational services are, ii. What technologies and services their operational services rely on to remain available and secure, iii. What other dependencies the operational services have (power, cooling, data, people etc.), iv. The impact of loss of availability of the service.\n\nDocumentation should have been reviewed in the last twelve months.","Yes","You have an asset register detailing your organisation's hardware, software and data, which is kept up to date.","This is a list of the devices and computer software your organisation uses which has been reviewed in the last twelve months. \n\nYou can build on the information you recorded as part of 1.1.2.\n\nAn example asset register is available at: [Asset register]( https://www.digitalcarehub.co.uk/resource/information-asset-register-template/)","Yes","You have an asset register detailing your organisation's hardware, software and data, which is kept up to date.","This is a list of the devices and computer software your organisation uses which has been reviewed in the last twelve months. \n\nYou can bulid on the information you recored as part of 1.1.2.\n\nAn example asset register is available at: [Asset register]( https://www.digitalcarehub.co.uk/resource/information-asset-register-template/)","Yes",{"$nulls":6},"IT Systems and devices"]
[null,"Yes/No","7.1.2","7.1.2","Update tooltip for category 2, 3 and 4","Your organisation has well defined processes in place to ensure the continuity of services in the event of a data security incident, failure or compromise.","This may include the preservation of manual processes for essential services.\n\nThe organisation has Business Continuity arrangements in place, with Business Continuity Plans (BCPs) that outline how the organisation would respond and continue to provide its key services in the event of a data security incident, failure or compromise. BCPs are clear as regards people, resource and information requirements for service continuity purposes.\n\nYour plan should include communications with other organisations and your data protection obligations.  Your plan should be understood by relevant staff and other stakeholders, including your health and care customers where relevant to the services you provide.","Yes","Does your organisation have a business continuity plan that covers data and cyber security?","Your organisation's business continuity plan should cover data and cyber security - for example what would you do to ensure continuity of service if: you had a power cut; the phone line/internet went down; you were hacked; a computer broke down; the office became unavailable (for example through fire). \n\nYour plan should include communications with other organisations and your data protection obligations.  Your plan should be understood by relevant staff and other stakeholders. \n\nAn example business continuity plan is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/creating-and-testing-a-business-continuity-plan-for-data-and-cyber-security/).","Yes","Does your organisation have a business continuity plan that covers data and cyber security?","Your organisation's business continuity plan should cover data and cyber security - for example what would you do to ensure continuity of service if: you had a power cut; the phone line/internet went down; you were hacked; a computer broke down; the office became unavailable (for example through fire).\n\nYour plan should include communications with other organisations and your data protection obligations.  Your plan should be understood by relevant staff and other stakeholders. \n","Yes",null,null,"x",null,null,null,"Data security"]
[null,"Yes/No","7.1.3","7.1.3","None","You understand the resources and information that will likely be needed to carry out any required response activities, and arrangements are in place to make these resources available.","",null,"You understand the resources and information that will be needed if there is a data security incident and arrangements are in place to make these resources available.","",{"$nulls":6},"x",null,null,null,"Data security"]
[null,"Text","7.1.4","7.1.4","None","You use your security awareness, e.g. threat intelligence sources, to make temporary security changes in response to new threats, e.g. a widespread outbreak of very damaging malware.","Provide evidence of threat intelligence reports/outputs which are pro-actively used to mitigate potential threats."]
[null,"Yes/No",null,"7.1.5","New - evidence item for category 2, 3 and 4","You have a robust plan for communicating incidents to customers in a timely manner.\n","Regulatory requirements for your own organisation and for your customers should be considered.  At a minimum, all incidents affecting the development and/or hosting of software provided to health and care should be communicated to customers within 24 hours.","Yes","Your asset register prioritises assets according to their organisational importance, and includes dependencies (such as power, cooling, data, people etc.) that support the assets.",null,null,"Your asset register prioritises assets according to their organisational importance, and includes dependencies (such as power, cooling, data, people etc.) that support the assets.",{"$nulls":8},"IT Systems and devices"]
[null,"Yes/No",null,"7.1.6","New - evidence item for category 3 and 4",null,null,null,"Assets (hardware, software and data) are owned and managed throughout their lifecycle.","You should have an asset management process which ensures that: \n\n- obsolete devices are identified and managed\n- suitable controls are applied wherever assets are reused, transferred or disposed of",null,"Assets (hardware, software and data) are owned and managed throughout their lifecycle.","\"You should have an asset management process which ensures that: \n\n- obsolete devices are identified and managed\n- suitable controls are applied wherever assets are reused, transferred or disposed of\"",{"$nulls":7},"IT Systems and devices"]
["There is an effective test of the continuity plan and disaster recovery plan for data security incidents","Text","7.2.1","7.2.1","Update tooltip for category 2","Explain how your data security incident response and management plan has been tested to ensure all parties understand their roles and responsibilities as part of the plan.","This should be since 1st July 2025 with active board and business representation. Exercise scenarios should be based on incidents experienced by your and other organisations, or are composed using threat intelligence.","Yes","How does your organisation test the data and cyber security aspects of its business continuity plan?","Describe how your organisation tests these aspects of its plan and what the outcome of the exercise was the last time you did this. This should be in the last twelve months.\n\nGuidance for testing your business continuity plan for the data and cyber security aspects is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/creating-and-testing-a-business-continuity-plan-for-data-and-cyber-security/).","Yes",{"$nulls":5},"x",null,null,null,"Data security"]
[null,"Document","7.2.2","7.2.2","None","From the business continuity exercise, explain what issues and actions were documented, with names of actionees listed against each item.","Each action should have an owner and timescale and evidence that the issues and actions recorded were implemented within the defined timescales. ","Yes","From the business continuity exercise, explain what issues and actions were documented, with names of actionees listed against each item.","Each action should have an owner and timescale.",{"$nulls":6},"x",null,null,null,"Data security"]
["You have the capability to enact your incident response plan, including effective limitation of impact on your essential service. During an incident, you have access to timely information on which to base your response decisions","Text","7.3.1","7.3.1","None","On discovery of an incident, mitigating measures shall be assessed and applied at the earliest opportunity, drawing on expert advice where necessary.","Your data security incident response plan should include how technical (in-house or third party) resources would be deployed during an incident, being aware of how to leverage support from health and social care bodies such as NHS England or a cyber incident response company.","Yes","How does your organisation make sure that there are working backups of all important data and information?","It is important to make sure that backups are being done regularly, that they are successful and that they include the right files and systems. Briefly explain how your organisation's back up systems work and how you have tested them.\n\nYou may need to ask your IT supplier to assist with answering this question. If your organisation does not use any computers or IT systems, write \"Not applicable\" in the text box.\n\nFor advice about backups, see [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/back-up-your-data/).","Yes",{"$nulls":8},"x","IT Systems and devices"]
[null,"Yes/No","7.3.2","7.3.2","None","All emergency contacts are kept securely, in hardcopy and are up-to-date.","The organisation should store its emergency contacts (phone number as well as email) in hard copy for use during a data security incident, where the organisation's systems may be unavailable. his should be accessible to staff with responsibilities for incident response. ","Yes","All emergency contacts are kept securely, in hardcopy and are up-to-date.","Contacts are those needed to enact the business continuity plan that covers data and cyber security. The contacts include phone number as well as email.","Yes","All emergency contacts are kept securely, in hardcopy and are up-to-date.","Contacts are those needed to enact the business continuity plan that covers data and cyber security. The contacts include phone number as well as email.","Yes",{"$nulls":5},"x","IT Systems and devices"]
[null,"Yes/No","7.3.3","7.3.3","None","Draft press materials for data security incidents are ready.","The organisation has drafted and approved, at the Board level, press material that could form part of statements that could be released in the event of a data security incident and the organisation has suitable procedures for agreeing statements and materials in the event of an incident that can't be prepared for pre-emptively.",{"$nulls":9},"x"]
[null,"Yes/No","7.3.4","7.3.4","Update tooltip for category 2, 3 and 4","Suitable backups of all important data and information needed to recover the essential service are made, tested, documented and routinely reviewed.","The organisation has a backup policy/procedure which includes details on how often the organisation backs up its most important data, and how long these backups are stored for. The procedure should also include the steps that would be taken if the organisation has to restore from backups, including the systems that would need to be restored and in what order.\n\nAt a minimum, the scope of backups should include infrastructure used for (or supporting) the development, hosting, operation or support of software provided to health and care.","Yes","Are backups routinely tested to make sure that data and information can be restored?","It is important that your organisation's backups are tested at least annually to make sure data and information can be restored (in the event of equipment breakdown for example). You may need to ask your IT supplier to assist with answering this question. \n\nYour plan to restore from backup should include which systems need to be recovered, and in what order.\n\nIf your organisation does not use any computers or IT systems, then tick and write \"Not applicable\" in the comments box.","Yes","How does your organisation make sure that there are working backups of all important data and information?","It is important to make sure that backups are being done regularly, that they are successful and that they include the right files and systems. Briefly explain how your organisation's backup systems work, how you protect them from unauthorised access, and how you have tested them.\n\nYour plan to restore from backup should include which systems need to be recovered, and in what order.\n\nYou may need to ask your IT supplier to assist with answering this question.","Yes",{"$nulls":6},"IT Systems and devices"]
[null,"Text","7.3.5","7.3.5","None","Your organisation tests its backups regularly to ensure it can restore from a backup.","Backups are  tested on a regular basis (at least annually). The backups referred to in this evidence item are to facilitate full system restores, not ad-hoc file restoration requests.","Yes",{"$nulls":7},"x","x"]
[null,"Yes/No","7.3.6","7.3.6","Update evidence item for category 2 and 3","Your organisation's backups are kept separate from your network ('offline'), and secured from unauthorised access","Cloud synching services, such as OneDrive, SharePoint or Google Drive, should not be used as your only backup and stored backup should not be permanently connected to your network. \n\nFurther guidance is available from the [National Cyber Security Centre](https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world)\n\nWith at least one separate backup offline at any given time, an incident cannot affect all backups simultaneously and hence reducing the likelihood that an organisation will be unable to effectively recover its key services.","Yes","Are your backups kept separate from your network ('offline'), and secured from unauthorised access?","Cloud synching services, such as OneDrive, SharePoint or Google Drive, should not be used as your only backup and stored backup should not be permanently connected to your network. \n\nFurther guidance is available from the [National Cyber Security Centre](https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world).",{"$nulls":10},"IT Systems and devices"]
["All software and hardware has been surveyed to understand if it is supported and up to date","Document","8.1.1","8.1.1","None","Provide evidence of how the organisation tracks and records all software assets and their configuration.","The organisation should have a documented process for managing software assets and their configuration so that vulnerabilities can be identified, managed and remediated. This includes having a list of software assets to be managed centrally with version numbers included and a mechanism for updating this asset register to reflect the changes in the organisation's application landscape.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","8.1.2","8.1.2","None","The organisation tracks and records all end user devices and removable media assets.","The organisation has an effective IT asset management process, maintaining an up to date list of all IT assets (including end user devices and removable media), to reduce the risk of IT assets, and the data held on them, from being lost without Management becoming aware.","Yes","Does the organisation track and record all end user devices and removable media assets?","e.g. You hold an up to date list of all your end user devices and removable media.",{"$nulls":7},"x",null,null,"IT Systems and devices"]
[null,"Yes/No","8.1.4","8.1.4","Update - now applicable for category 4","The organisation ensures that software that is no longer within support or receiving security updates is uninstalled.  Where this is impractical, the endpoint should be isolated and have limited connectivity to the network.","Covers software running on computers that are connected to the internet.",null,"Are all the IT systems and the software used in your organisation still supported by the manufacturer or the risks are understood and managed?","Systems and software that are no longer supported by the manufacturer can be unsafe as they are no longer being updated to protect against viruses for example. You may need to ask your IT supplier to assist with answering this question. \n\nExamples of unsupported software include: Windows XP, Windows Vista, Windows 7, Windows 8.1, Java or Windows Server 2008.  Windows 11 is supported and is the most up to date version of Windows. This question also applies to software systems such as rostering, care planning or electronic medicine administration record (MAR) charts for example. \n\nIf your organisation does not use any IT systems or software, then tick and write \"Not applicable\" in the comments box. For guidance (including information on how to check which software versions you have), see [Digital  Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/install-the-latest-software-updates/).","Yes","Are all the IT systems and the software used in your organisation still supported by the manufacturer or the risks are understood and managed?","Systems and software that are no longer supported by the manufacturer can be unsafe as they are no longer being updated to protect against viruses for example. You may need to ask your IT supplier to assist with answering this question. \n\nExamples of unsupported software include: Windows XP, Windows Vista, Windows 7, Windows 8.1, Java or Windows Server 2008.  Windows 11 is supported and is the most up to date version of Windows. This question also applies to software systems such as rostering, care planning or electronic medicine administration record (MAR) charts for example. \n\nIf your organisation does not use any IT systems or software, then tick and write \"Not applicable\" in the comments box. For guidance (including information on how to check which software versions you have), see [Digital  Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/install-the-latest-software-updates/).",{"$nulls":4},"x",null,null,"IT Systems and devices"]
["Unsupported software and hardware is categorised and documented, and data security risks are identified and managed","Document","8.2.1","8.2.1","Update - now applies for category 4 and also updated tooltip for category 2","List any unsupported software prioritised according to business risk, with remediation plan against each item.","Unsupported software is software which is no longer receiving security updates for example Windows XP, Java 6 or Windows Server 2003. Unsupported software is less secure and so poses a larger risk to your organisation. The unsupported software list will comprise of the results of the software survey where the software is not supported/updated.","Yes","If your answer to 8.1.4 (on IT systems and software being supported by the manufacturer) was that software risks are being managed, please provide a document that summarises the risk of continuing to use each unsupported item, the reasons for doing so and a summary of the action your organisation is taking to minimise the risk.","This is a conscious decision to accept and manage the associated risks of unsupported systems. This document should indicate that your board or management team have formally considered the risks of continuing to use unsupported items and have concluded that the risks are acceptable. \n\nIf your answer to the previous question was yes, write \"Not applicable\" in \"Enter text describing document location\".","Yes","If your answer to 8.1.4 (on IT systems and software being supported by the manufacturer) was that software risks are being managed, please provide a document that summarises the risk of continuing to use each unsupported item, the reasons for doing so and a summary of the action your organisation is taking to minimise the risk.","This is a conscious decision to accept and manage the associated risks of unsupported systems. This document should indicate that your board or management team have formally considered the risks of continuing to use unsupported items and have concluded that the risks are acceptable.\n\nIf your answer to the previous question was yes, write \"Not applicable\" in \"Enter text describing document location\".",{"$nulls":4},"x",null,null,"IT Systems and devices"]
[null,"Yes/No","8.2.2","8.2.2","None","The SIRO confirms that the overall risks of using unsupported systems are being managed and the scale of unsupported software is reported to your board along with the plans to address.","The SIRO has been briefed on the unsupported systems and has made a conscious decision to accept and manage the associated risks. A report has been provided to the board in the last 12 months.\n \nWhere out of support software cannot be uninstalled, replaced or otherwise remediated for a valid business reason, there is a mechanism in place for the SIRO to consider and make a conscious decision whether to accept and manage the associated risks. \n \nYou should have evidence that a report has been provided to the Board on the overall risks that the organisation is carrying on unsupported systems in the last 12 months. \n \nIf your organisation has no unsupported systems, please tick and state \"No unsupported systems\" as a comment.","Yes"]
["Supported systems are kept up-to-date with the latest security patches","Document","8.3.1","8.3.1","Update evidence item for category 4","How do your systems receive updates and how often?","This is your patch management procedure and/or strategy/policy, that enables security patches to be applied at the operating system, database, application and infrastructure levels. You may need your IT supplier/s to assist with this.","Yes",null,null,null,"How do you make sure that the latest software updates are downloaded and installed promptly?","This is your strategy for system updates. You may need your IT supplier/s to assist with this.","Yes"]
[null,"Text","8.3.2","8.3.2","None","How often, in days, is automatic patching typically being pushed out to remote endpoints?","Remote endpoints being those devices or computers that are not on the core network (such as home or mobile workers). Provide the usual number of days between one wave of remote patching and the next.","Yes","How often, in days, is automatic patching typically being pushed out to remote endpoints?","Remote endpoints being those devices or computers that are not on the core network (such as home or mobile workers). Provide the usual number of days between one wave of remote patching and the next.",{"$nulls":7},"x",null,null,"IT Systems and devices"]
[null,"Yes/No","8.3.3","8.3.3","None","There is a documented approach to applying security updates (patches) agreed by the SIRO.","Provide details in the comments box. This applies to any device (managed internally or by a third party) that has the ability to connect to the Internet including servers,  desktop and laptop computers, as well as tablets and mobile devices. Example routes to the Internet include (but are not limited to) HSCN, N3/Transition network, VPNs, or cloud computing services.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","8.3.4","8.3.4","None","Where a security patch has been classed as critical or high-risk vulnerability it is applied within 14 days, or the risk has been assessed, documented, accepted, reviewed regularly and signed off by the SIRO with an auditor agreeing a robust risk management process has been applied.","Provide summary details in the comments box. Documentation should be held locally for all security patches. This applies to any device (managed internally or by a third party) that has the ability to connect to the Internet including servers,  desktop and laptop computers, as well as tablets and mobile devices.  Example routes to the Internet include (but are not limited to) HSCN, N3/Transition network, VPNs, or cloud computing services. Devices that are unable to be patched should be captured under 8.1.3. Devices that are standalone or air-gapped should be captured under 9.5.9.","Yes",{"$nulls":7},"x"]
[null,"Text","8.3.5","8.3.5","Update evidence item for category 3","Where a security patch has been classed as critical or high-risk vulnerability has not been applied, explain the technical remediation and risk management that has been undertaken.","Provide details for each patch not applied. This applies to any device (managed internally or by a third party) that has the ability to connect to the Internet including servers,  desktop and laptop computers, as well as tablets and mobile devices. Example routes to the Internet include (but are not limited to) HSCN, N3/Transition network, VPNs, or cloud computing services.","Yes","How does your organisation make sure that the latest software updates are downloaded and installed promptly?","It is important that your organisation's IT system(s) and devices have the latest software and application updates installed. Most software can be set to apply automatic updates when they become available from the manufacturer. You may need to ask your IT supplier to assist with answering this question. \n\nIf your organisation does not use any IT systems, devices or software, write \"Not applicable\" in the text box. \n\nFurther information is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/install-the-latest-software-updates/).","Yes",{"$nulls":8},"x","IT Systems and devices"]
[null,"Yes/No","8.3.6","8.3.6","None","Your organisation is actively using and managing an Advanced Threat Protection capability and regularly reviewing alerts from Microsoft defender for endpoint.","Confirm that your organisation has the technology and processes in place to actively manage an ATP capability such as Microsoft Defender for Endpoint. If alternative solution in place provide details in the comments field.","Yes"]
[null,"Document","8.3.7","8.3.7","None","95% of your organisation's server estate and 98% of your desktop estate are on supported versions of operating systems. Where this is not possible, there is a SIRO approved plan to achieve 95% of your server estate and 98% of your desktop estate on supported versions of operating systems.","Please upload a screenshot/s from Microsoft Defender for Endpoint (MDE) / equivalent demonstrating the percentage of servers and desktops on supported versions of operating systems. \nPlease provide details in the comments on the SIRO approved plan.","Yes"]
[null,"Yes/No","8.3.8","8.3.8","Update - Now applies for category 3 and 4","Your organisation is registered for and actively using the NCSC early warning service.","The [NCSC early warning service](https://www.ncsc.gov.uk/information/early-warning-service) helps organisations investigate cyber attacks on their network by notifying them of malicious activity that has been detected in information feeds.","Yes","Your organisation is registered for and actively using the NCSC early warning service.","The [NCSC early warning service](https://www.ncsc.gov.uk/information/early-warning-service) helps organisations investigate cyber attacks on their network by notifying them of malicious activity that has been detected in information feeds.",null,"Your organisation is registered for and actively using the NCSC early warning service.","The [NCSC early warning service](https://www.ncsc.gov.uk/information/early-warning-service) helps organisations investigate cyber attacks on their network by notifying them of malicious activity that has been detected in information feeds.",{"$nulls":7},"Data security"]
["You manage known vulnerabilities in your network and information systems to prevent disruption of the essential service","Text","8.4.1","8.4.1","None","Your organisation's infrastructure is protected from common cyber-attacks through secure configuration and patching?","Explain at summary level, the measures the organisation uses to protect its IT infrastructure from threats and common cyber-attacks. Where it is not possible to apply these measures, explain any mitigations (such as logical separation).","Yes","Is all your infrastructure protected from common cyber-attacks through secure configuration and patching?","Explain at a summary level.  Where it is not possible to apply these measures, explain any mitigations (such as logical separation).",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","8.4.2","8.4.2","None","All infrastructure is running operating systems and software packages that are patched regularly, and as a minimum in vendor support. Where this is not possible, the device should be isolated and have limited connectivity to the network, and the risk assessed, documented, accepted, regularly reviewed and signed off by the SIRO.","The organisation has the processes and technology to patch its IT infrastructure on a continuous basis. This reduces the risk of a security vulnerability being exploited by a potential threat actor, resulting in a data security and protection incident. \n \nThis covers software running on devices that are connected to or capable of connecting to the Internet.","Yes","All infrastructure is running operating systems and software packages that are patched regularly, and as a minimum in vendor support.","Covers software running on computers that are connected to or capable of connecting to the Internet.",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","8.4.3","8.4.3","Update evidence item for category 3 and new evidence item for category 4","You maintain a current understanding of the exposure of your hardware and software to publicly-known vulnerabilities.\n","The organisation has a vulnerability management process that outlines how the organisation identifies and effectively manages vulnerabilities through to remediation. This may include using [NHS England's VMS and / or Bitsight service.](https://digital.nhs.uk/cyber).","Yes","You identify and understand security vulnerabilities in your systems, such as through regular vulnerability testing.\n","",null,"You identify and understand security vulnerabilities in your systems, such as through regular vulnerability testing.",{"$nulls":8},"IT Systems and devices"]
["All networking components have had their default passwords changed","Yes/No","9.1.1","9.1.1","None","The Head of IT, or equivalent role, confirms all networking components have had their default passwords changed to a high strength password.","Confirm you have a process whereby network components have their administrative passwords changed from the vendor supplied default passwords to help prevent a threat actor from being able to gain administrative access to the devices.","Yes","Does your organisation make sure that the passwords of all networking components, such as a Wi-Fi router, have been changed from their original passwords?","Networking components include routers, switches, hubs and firewalls at all of your organisation's locations. Your organisation may just have a Wi-Fi router. This does not apply to Wi-Fi routers for people working from home. You may need to ask your IT supplier to assist with answering this question. \n\nIf your organisation does not have a network or internet access, then tick and write \"Not applicable\" in the comments box.","Yes","Does your organisation make sure that the passwords of all networking components, such as a Wi-Fi router, have been changed from their original passwords?","Networking components include routers, switches, hubs and firewalls at all of your organisation's locations. Your organisation may just have a Wi-Fi router. This does not apply to Wi-Fi routers for people working from home. You may need to ask your IT supplier to assist with answering this question. \n\nIf your organisation does not have a network or internet access, then tick and write \"Not applicable\" in the comments box.","Yes",null,"x",{"$nulls":4},"IT Systems and devices"]
[null,"Yes/No","9.1.2",null,"Removed",{"$nulls":10},"x"]
["A penetration test has been scoped and undertaken","Yes/No","9.2.1","9.2.1","Update tooltip for category 2","The annual IT penetration testing is scoped in negotiation between the SIRO, business and testing team including a vulnerability scan and checking that all networking components have had their default passwords changed to a high strength password.","Use the comments field to state the date and outline the scope of the organisation's penetration test and redact any elements of the scope that are sensitive.\n\nThis should be since 1st July 2024.","Yes","The annual IT penetration testing is scoped in negotiation between the Board/person with delegated responsibility for data security, business and testing team including a vulnerability scan and checking that all networking components have had their default passwords changed to a high strength password.","Use the comments field to state the date and outline the scope of the organisation's penetration test and redact any elements of the scope that are sensitive.\n\nThis should be in the last twelve months.",null,"The annual IT penetration testing is scoped in negotiation between the Board/person with delegated responsibility for data security, business and testing team including a vulnerability scan and checking that all networking components have had their default passwords changed to a high strength password.\n","Use the comments field to outline the scope of the organisation's penetration test and redact any elements of the scope that are sensitive.",null,null,"x",null,"x",null,null,"IT Systems and devices"]
[null,"Document","9.2.3","9.2.3","None","The SIRO or equivalent senior role has reviewed the results of latest penetration testing, with an action plan for its findings.","Provide the penetration test action plan with confirmation of SIRO review.","Yes","The person responsible for IT has reviewed the results of latest penetration testing, with an action plan for its findings.","Provide the action plan (with confirmation of review by the person with delegated responsibility for data security).",{"$nulls":5},"x",null,"x",null,null,"IT Systems and devices"]
["Systems which handle sensitive information or key operational services shall be protected from exploitation of known vulnerabilities","Yes/No","9.3.1","9.3.1","None","All web applications are protected and not susceptible to common security vulnerabilities, such as described in the top ten Open Web Application Security Project (OWASP) vulnerabilities.","Confirm that the organisation has a secure software development lifecycle (SSDLC) or equivalent software and code security approach in place, aligned to industry [good practice such as OWASP](https://owasp.org/www-project-top-ten/), to reduce the risk of code vulnerabilities or web application vulnerabilities being exploited. \n\nIf no web applications, 'tick' yes and explain in the comments.\n\n","Yes","All web applications are protected and not susceptible to common security vulnerabilities, such as described in the top ten Open Web Application Security Project (OWASP) vulnerabilities.","Confirm that the organisation has a secure software development lifecycle (SSDLC) or equivalent software and code security approach in place, aligned to industry [good practice such as OWASP](https://owasp.org/www-project-top-ten/), to reduce the risk of code vulnerabilities or web application vulnerabilities being exploited. \n\nIf no web applications, 'tick' yes and explain in the comments.",{"$nulls":7},"x",null,null,"IT Systems and devices"]
[null,"Yes/No","9.3.3","9.3.3","None","The organisation has a technology solution or service that prevents users from accessing potentially malicious websites, reducing the risk of the organisation's infrastructure being infected with malware.\n\n","The organisation uses the [UK Public Sector DNS service](https://www.ncsc.gov.uk/information/pdns), or equivalent protective DNS service, to resolve Internet DNS queries. ","Yes"]
[null,"Yes/No","9.3.4","9.3.4","None","The organisation ensures that changes to its authoritative DNS entries can only be made by strongly authenticated and authorised administrators.","Only authorised individuals are able to make changes to the organisation's authoritative DNS entries to prevent domain addresses being pointed toward potentially malicious IP addresses.","Yes","The organisation ensures that changes to its authoritative DNS entries can only be made by strongly authenticated and authorised administrators.","",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","9.3.5","9.3.5","None","The organisation understands and records all IP ranges in use across the organisation.","This should be reviewed regularly, the reviews can manual or automatic.\n\nAny amendments to relevant IP addresses should be [maintained in the IP Address Management](https://digital.nhs.uk/services/health-and-social-care-network/hscn-technical-guidance/hscn-ip-address-management).","Yes","The organisation understands and records all IP ranges in use across the organisation.","This should be reviewed regularly, the reviews can manual or automatic.",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","9.3.6","9.3.6","None","The organisation protects its data in transit (including email) using appropriate technical controls, such as encryption.","TLS, where used, should be well-configured TLS 1.2 or better.","Yes","The organisation protects its data in transit (including email) using appropriate technical controls, such as encryption.","TLS, where used, should be well-configured TLS 1.2 or better.",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","9.3.7",null,"Removed"]
[null,"Document","9.3.8",null,"Removed",{"$nulls":15},"IT Systems and devices"]
[null,"Document","9.3.9","9.3.9","None","What is the organisation's data security assurance process for medical devices connected to the network.","This should be a policy / process document or full explanation covering how the organisation assures data security during the full life cycle of the medical device.\n\nIf your organisation does not operate any medical devices connected to the network, then select Enter text describing the document's location and write \"Not applicable\" in the text box.\n\n[Further guidance is available](https://digital.nhs.uk/cyber-and-data-security/guidance-and-assurance/guidance-for-procuring-and-deploying-connected-medical-devices)","Yes"]
["You have demonstrable confidence in the effectiveness of the security of your technology, people, and processes relevant to essential services","Text","9.4.1","9.4.1","None","You validate that the security measures in place to protect the networks and information systems are effective, and remain effective for the lifetime over which they are needed.","Please provide an explanation of the assurance activities in place to protect the networks and information systems and how you regularly review fitness for purpose and effectiveness over the lifetime of the technology/contract. The validation should be completed annually, linked to policy and produce a plan of work for the coming year. ",{"$nulls":9},"x"]
[null,"Text","9.4.4","9.4.4","None","Security deficiencies uncovered by assurance activities are assessed, prioritised and remedied when necessary in a timely and effective way.","The organisation holds details of actions resulting from security tests, with records of how these were managed through to remediation in line with the organisation's security assurance policy/procedure. policy. Where there is a valid business reason that the action could not be implemented, this should be risk accepted by an appropriate individual in the organisation.","Yes","Security deficiencies uncovered by assurance activities are assessed, prioritised and remedied when necessary in a timely and effective way.","",{"$nulls":6},"x",null,null,null,"IT Systems and devices"]
[null,"Yes/No","9.4.5","9.4.5","None","Your organisation has completed an independent audit of your Data Security and Protection Toolkit and has reported the results to the Board, with due regard made to the findings","The audit should cover the mandatory audit-scope set out in the ['Strengthening Assurance Independent Assessment Guide'](https://www.dsptoolkit.nhs.uk/Help/Independent-Assessment-Guides).\n\nIf your organisation is complex or multi-national, the audit results may be reported to an appropriately senior committee.\n\nThis evidence item is ‘read only’ and will be marked complete once you have provided audit details using the Provide Audit details menu.","Yes",{"$nulls":10},"x"]
["You securely configure the network and information systems that support the delivery of essential services","Yes/No","9.5.1","9.5.1","None","All devices in your organisation have technical controls that manage the installation of software on the device.","Use the comments field to describe what technical controls are implemented that govern what software can be used to help prevent insecure or malicious software being installed on business devices or deployed in the network or IT systems i.e. by deploying application allow listing technology and/or restricting local administrative access rights. \n\nPlease give details of any exceptions.\n\n[Advice and guidance is available](https://www.ncsc.gov.uk/collection/device-security-guidance)\n\n","Yes","All devices in your organisation have technical controls that manage the installation of software on the device","Describe how this is managed across your devices with detail of any exceptions.\n\n",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","9.5.2","9.5.2","None","Confirm all data are encrypted at rest on all mobile devices and removable media and you have the ability to remotely wipe and/or revoke access from an end user device."," ","Yes","Are all laptops and tablets or removable devices that hold or allow access to personal data, encrypted?","Mobile computers like laptops and tablets and removable devices like memory sticks/cards/CDs are vulnerable as they can be lost or stolen. To make these devices especially difficult to get into, they can be encrypted (this protects information by converting it into unreadable code that cannot be deciphered easily by unauthorised people). Devices can be further protected, for example, by preventing the use of removable devices like memory sticks. This is called computer port control. You may need to ask your IT supplier to assist with answering this question.\n\nIf your organisation does not use any mobile devices, or equivalent security arrangements are in place, then tick and write \"Not applicable\" in the comments box. \n\nFor advice on securing mobile devices, see [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/protect-mobile-devices-and-tablets/).","Yes","Are all laptops and tablets or removable devices that hold or allow access to personal data, encrypted?","Mobile computers like laptops and tablets and removable devices like memory sticks/cards/CDs are vulnerable as they can be lost or stolen. To make these devices especially difficult to get into, they can be encrypted (this protects information by converting it into unreadable code that cannot be deciphered easily by unauthorised people). Devices can be further protected, for example, by preventing the use of removable devices like memory sticks. This is called computer port control. You may need to ask your IT supplier to assist with answering this question.\n\nIf your organisation does not use any mobile devices, or equivalent security arrangements are in place, then tick and write \"Not applicable\" in the comments box.","Yes",{"$nulls":6},"IT Systems and devices"]
[null,"Text","9.5.3","9.5.3","None","You closely and effectively manage changes in your environment, ensuring that network and system configurations are secure and documented.","Provide details of your organisation's change management process that prevents changes to its IT environment from being implemented without being approved by the appropriate individuals and security implications being considered.","Yes","You closely and effectively manage changes in your environment, ensuring that network and system configurations are secure and documented.","",{"$nulls":10},"IT Systems and devices"]
[null,"Yes/No","9.5.5","9.5.5","None","End user devices are built from a consistent and approved base image.","The standard builds are documented and reviewed on a regular basis. This applies to the organisation's desktop computers, laptop computers and tablets.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.5.6","9.5.6","None","End user device security settings are managed and deployed centrally.","Applies to the organisation's desktop computers, laptop computers and tablets. This could be achieved using Group policy, mobile device management or similar mechanisms.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.5.7","9.5.7","None","AutoRun is disabled.","This applies to servers, desktop and laptop computers. AutoRun relates to automatic execution of files without user interaction, and should not be confused with AutoPlay (which requires user interaction).","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.5.8","9.5.8","None","All remote access is authenticated.","Strong (ideally multifactor) authentication is required for remote access. This includes web applications, remote access to corporate networks and supplier access, as well as supplier-hosted and 'software-as-a-service' applications.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.5.9","9.5.9","None","You have a plan for protecting devices that are natively unable to connect to the Internet, and the risk has been assessed, documented, accepted, reviewed regularly and signed off by the SIRO.","This applies to any device (managed internally or by a third party) that does not have a route to/from the Internet, such as air-gapped networks or stand-alone devices. Such as an MRI Scanner. \n\nThe organisation has documented an approach for managing the security risks associated with connected devices and has visibility of the device types along with images/builds/versions/operating systems in use.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.5.10","9.5.10","None","Your organisation meets the secure email standard.","Emails sent to and from health and social care organisations must meet the secure email standard (DCB1596) so that everyone can be sure that sensitive and confidential information is kept secure.\n\n[Further details on the standard](https://digital.nhs.uk/services/nhsmail/the-secure-email-standard) is available on the NHS Digital website.",{"$nulls":7},"x"]
[null,"Yes/No",null,"9.5.11","New evidence item for category 2","Software provided to health and care is developed in accordance with the government  Software Security Code of Practice.","Your evidence should ideally include an assessment against the Code of Practice principles and claims using the [NCSC template](https://www.gov.uk/government/publications/software-security-code-of-practice).\n\nIf you do not provide any software to health and care, tick 'Yes' and explain in the comments.","Yes"]
["The organisation is protected by a well managed firewall","Yes/No","9.6.1","9.6.1","None","One or more firewalls (or similar network device) have been installed on all the boundaries of the organisation's internal network(s).","This may include NHS England's Secure Boundary cloud-based firewall or equivalent. ","Yes","One or more firewalls (or similar network device) have been installed on all the boundaries of the organisation's internal network(s).","A firewall is hardware or software which uses a defined rule set to constrain network traffic to prevent unauthorised access to (or from) a network.",{"$nulls":5},"x","x",null,null,null,"IT Systems and devices"]
[null,"Yes/No","9.6.2","9.6.2","None","The administrative interface used to manage the boundary firewall has been configured such that; it is not accessible from the Internet, it requires second factor authentication or is access limited to a specific address.","The organisation's perimeter firewall management console / administrative functionality is not accessible via the internet, preventing threat actors from manipulating the organisation's firewall rulesets or configuration for malicious purposes. If there is a business reason for this administrative console to be connected to the internet, the connection should be secured with multi-factor authentication (MFA) with logging/monitoring and roll-back capability.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.6.3","9.6.3","None","The organisation has checked and verified that firewall rules ensure that all unauthenticated inbound connections are blocked by default.","All protocols (such as HTTP/S, SMB, NetBIOS, Telnet, TFTP, RPC, rlogin, rsh, rexec etc.) are blocked by default.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.6.4","9.6.4","None","All inbound firewall rules (other than default deny) are documented with business justification and approval by the change management process.","Confirm documentation of approval is available. This must be accurate and up to date.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.6.5","9.6.5","None","Firewall rulesets are reviewed on a regular basis. Rulesets are removed/disabled when they are no longer required. ","Please use the comments field to explain the process of removal and be ready to demonstrate to an onsite assessment.","Yes",{"$nulls":7},"x"]
[null,"Yes/No","9.6.6","9.6.6","None","All of your organisation's desktop and laptop computers have personal firewalls (or equivalent) enabled and configured to block unapproved connections by default.","Please use the comments field to provide details of how you have implemented this and describe the confirmation process.","Yes",{"$nulls":7},"x"]
["The organisation can name its suppliers, the products and services they deliver and the contract durations","Document","10.1.1","10.1.1","Update tooltip for category 2","The organisation has an up to date list of its suppliers, which enables it to identify suppliers that could potentially pose a data security or data protection risk to the organisation. The list includes which suppliers process personal data or provide IT services on which critical services rely, details on the product and services they deliver, contact details and contract duration.","Provide a list containing suppliers that handle personal information, systems/services and contract start and end dates. The list must have been reviewed since 1 July 2024.","Yes",{"$nulls":8},"x"]
[null,"Yes/No","10.1.2","10.1.2","None","Contracts with all third parties that handle personal information are compliant with ICO guidance.","A review of all contracts has been undertaken to ensure that they comply with the requirements set out in Article 28 of the GDPR.\n\nIf you have no such suppliers, then 'tick' and write \"Not applicable\" in the comments box.",null,"Does your organisation have a list of its suppliers that handle personal information, the products and services they deliver, and their contact details?","Your organisation should have a list or lists of the external suppliers that handle personal information such as IT or care planning systems suppliers, IT support, accountancy, DBS checks, HR and payroll services, showing the system or services provided.\n\nIf you have no such suppliers, then 'tick' and write \"Not applicable\" in the comments box.\n\nA template example is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/template-suppliers-list/).","Yes","Does your organisation have a list of its suppliers that handle personal information, the products and services they deliver, and their contact details?","Your organisation should have a list or lists of the external suppliers that handle personal information such as IT or care planning systems suppliers, IT support, accountancy, DBS checks, HR and payroll services, showing the system or services provided.\n\nIf you have no such suppliers, then 'tick' and write \"Not applicable\" in the comments box.\n\nA template example is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/resource/template-suppliers-list/).","Yes",{"$nulls":5},"x","Policies and procedures"]
["Basic due diligence has been undertaken against each supplier that handles personal information ","Yes/No","10.2.1","10.2.1","None","Your organisation ensures that any supplier of IT systems that could impact on the delivery of care, or process personal identifiable data, has the appropriate certification.","This enables the organisation to confirm that the supplier has the appropriate information security accreditations/certifications, prior to signing the contract. The NHS Improvement 2017/18 Data Security Protection Requirements: guidance states that these could include; ISO 27001:2013, Cyber Essentials, Cyber Essentials Plus, or meets the Digital Marketplace requirements. \n\nFor more information see the [2017/18 Data Security Protection Requirements guidance](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/675420/17-18_statement_of_requirements_Branded_template_final_22_11_18-1.pdf).","Yes","Do your organisation's IT system suppliers have cyber security certification?","Your organisation should ensure that any supplier of IT systems has cyber security certification. For example, external certification such as Cyber Essentials, or ISO27001, or by being listed on Digital marketplace, or by completing this Toolkit. An IT systems supplier would include suppliers of systems such as rostering, care planning or electronic medicine administration record (MAR) charts for example.\n\nIf your organisation does not use any IT systems, then tick and write \"Not applicable\" in the comments box.\n\nGuidance is available from [Digital Care Hub](https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/manage-your-suppliers/).","Yes","Do your organisation's IT system suppliers have cyber security certification?","Your organisation should ensure that any supplier of IT systems has cyber security certification. For example, external certification such as Cyber Essentials, or ISO27001, or by being listed on Digital marketplace, or by completing this Toolkit. An IT systems supplier would include suppliers of systems such as rostering, care planning or electronic medicine administration record (MAR) charts for example.\n\nIf your organisation does not use any IT systems, then tick and write \"Not applicable\" in the comments box.","Yes",{"$nulls":6},"IT Systems and devices"]
[null,"Yes/No","10.2.2","10.2.2","Update tooltip for category 3 and 4",null,null,null,"Contracts with all third parties that handle personal information are compliant with ICO guidance.","A review of all contracts has been undertaken to ensure that they comply with the requirements set out in Article 28 of the GDPR and have completed a Data Security and Protection Toolkit. \n\nIf you have no such suppliers, then 'tick' and write \"Not applicable\" in the comments box.",null,"Contracts with all third parties that handle personal information are compliant with ICO guidance.","A review of all contracts has been undertaken to ensure that they comply with the requirements set out in Article 28 of the GDPR and have completed a Data Security and Protection Toolkit. \n\nIf you have no such suppliers, then 'tick' and write \"Not applicable\" in the comments box.",{"$nulls":7},"Policies and procedures"]
[null,"text","10.2.3","10.2.3","None","Percentage of suppliers with data security contract clauses in place.","The percentage snapshot of current suppliers handling personal data that currently have security clauses.\n\nThe organisation may need to update its supplier model contract to include data security and protection clauses/requirements.",{"$nulls":9},"x"]
[null,"Yes/No","10.2.4","10.2.4","None","Where services are outsourced (for example by use of cloud infrastructure or services), the organisation understands and accurately records which security related responsibilities remain with the organisation and which are the supplier's responsibility.","The organisation formally documents the roles and responsibilities of both parties to achieve clarity as regards accountability for data security and data protection risks.","Yes",{"$nulls":8},"x"]
[null,"Yes/No","10.2.5","10.2.5","Update - Removed for category 3","All suppliers that process or have access to health or care personal confidential information have completed a Data Security and Protection Toolkit, or equivalent.","Provide confirmation that all suppliers have successfully completed a Data Security and Protection Toolkit or the organisation has assured itself separately that they reach a similar or higher data security standard.",{"$nulls":13},"Policies and procedures"]
["All disputes between the organisation and its suppliers have been recorded and any risks posed to data security have been documented","Document","10.3.1","10.3.1","None","List of data security incidents - past or present - with current suppliers who handle personal information.","All current ongoing incidents are listed and all historical incidents (up to 2 calendar rolling years). Redact any sensitive information.",null,"List of data security incidents - past or present - with current suppliers who handle personal information.","All current ongoing incidents are listed and all historical incidents (up to 2 calendar rolling years). Redact any sensitive information.",{"$nulls":10},"Data security"]

{"sheet":"Assertions","index":1,"n_rows":37,"n_cols":6,"rows_kept":37,"cut":false,"hidden":false,"merged":[]}
["v7 Ref","v7 Assertion","Change v7 to v8",null,"v8Ref","v8 Assertion"]
[1.1000000000000001,"The organisation has a framework in place to support Lawfulness, Fairness and Transparency","None",null,1.1000000000000001,"The organisation has a framework in place to support Lawfulness, Fairness and Transparency"]
[1.2,"Individuals' rights are respected and supported","None",null,1.2,"Individuals' rights are respected and supported"]
[1.3,"Accountability and Governance in place for data protection and data security","None",null,1.3,"Accountability and Governance in place for data protection and data security"]
[1.4,"Records are maintained appropriately","None",null,1.4,"Records are maintained appropriately"]
[2.1,"Staff are supported in understanding their obligations under the National Data Guardian's Data Security Standards","None",null,2.1,"Staff are supported in understanding their obligations under the National Data Guardian's Data Security Standards"]
[2.2000000000000002,"Staff contracts set out responsibilities for data security","None",null,2.2000000000000002,"Staff contracts set out responsibilities for data security"]
[3.1,"Staff have appropriate understanding of information governance and cyber security, with an effective range of approaches taken to training and awareness","None",null,3.1,"Staff have appropriate understanding of information governance and cyber security, with an effective range of approaches taken to training and awareness"]
[3.2,"Your organisation engages proactively and widely to improve data security, and has an open and just culture for data security incidents.","None",null,3.2,"Your organisation engages proactively and widely to improve data security, and has an open and just culture for data security incidents."]
[3.3,"Staff with specialist roles receive data security and protection training suitable to their role","None",null,3.3,"Staff with specialist roles receive data security and protection training suitable to their role"]
[3.4,"Leaders and board members receive suitable data protection and security training","None",null,3.4,"Leaders and board members receive suitable data protection and security training"]
[4.0999999999999996,"The organisation maintains a current record of staff and their roles","None",null,4.0999999999999996,"The organisation maintains a current record of staff and their roles"]
[4.2,"The organisation assures good management and maintenance of identity and access control for it's networks and information systems","None",null,4.2,"The organisation assures good management and maintenance of identity and access control for it's networks and information systems"]
[4.3,"All staff understand that their activities on IT systems will be monitored and recorded for security purposes","None",null,4.3,"All staff understand that their activities on IT systems will be monitored and recorded for security purposes"]
[4.4000000000000004,"You closely manage privileged user access to networks and information systems supporting the essential service","None",null,4.4000000000000004,"You closely manage privileged user access to networks and information systems supporting the essential service"]
[4.5,"You ensure your passwords are suitable for the information you are protecting","None",null,4.5,"You ensure your passwords are suitable for the information you are protecting"]
[5.0999999999999996,"Process reviews are held at least once per year where data security is put at risk following data security incidents","None",null,5.0999999999999996,"Process reviews are held at least once per year where data security is put at risk following data security incidents"]
[5.2,"Action is taken to address problem processes as a result of feedback at meetings or in year","None",null,5.2,"Action is taken to address problem processes as a result of feedback at meetings or in year"]
[6.1,"A confidential system for reporting data security and protection breaches and near misses is in place and actively used","None",null,6.1,"A confidential system for reporting data security and protection breaches and near misses is in place and actively used"]
[6.2,"All user devices are subject to anti-virus protections while email services benefit from spam filtering and protection deployed at the corporate gateway","None",null,6.2,"All user devices are subject to anti-virus protections while email services benefit from spam filtering and protection deployed at the corporate gateway"]
[6.3,"Known vulnerabilities are acted on based on advice from NHS Digital, and lessons are learned from previous incidents and near misses","None",null,6.3,"Known vulnerabilities are acted on based on advice from NHS Digital, and lessons are learned from previous incidents and near misses"]
[7.1,"Organisations have a defined, planned and communicated response to Data security incidents that impact sensitive information or key operational services","None",null,7.1,"Organisations have a defined, planned and communicated response to Data security incidents that impact sensitive information or key operational services"]
[7.2,"There is an effective test of the continuity plan and disaster recovery plan for data security incidents","None",null,7.2,"There is an effective test of the continuity plan and disaster recovery plan for data security incidents"]
[7.3,"You have the capability to enact your incident response plan, including effective limitation of impact on your essential service. During an incident, you have access to timely information on which to base your response decisions","None",null,7.3,"You have the capability to enact your incident response plan, including effective limitation of impact on your essential service. During an incident, you have access to timely information on which to base your response decisions"]
[8.1,"All software and hardware has been surveyed to understand if it is supported and up to date","None",null,8.1,"All software and hardware has been surveyed to understand if it is supported and up to date"]
[8.1999999999999993,"Unsupported software and hardware is categorised and documented, and data security risks are identified and managed","None",null,8.1999999999999993,"Unsupported software and hardware is categorised and documented, and data security risks are identified and managed"]
[8.3000000000000007,"Supported systems are kept up-to-date with the latest security patches","None",null,8.3000000000000007,"Supported systems are kept up-to-date with the latest security patches"]
[8.4,"You manage known vulnerabilities in your network and information systems to prevent disruption of the essential service","None",null,8.4,"You manage known vulnerabilities in your network and information systems to prevent disruption of the essential service"]
[9.1,"All networking components have had their default passwords changed","None",null,9.1,"All networking components have had their default passwords changed"]
[9.1999999999999993,"A penetration test has been scoped and undertaken","None",null,9.1999999999999993,"A penetration test has been scoped and undertaken"]
[9.3000000000000007,"Systems which handle sensitive information or key operational services shall be protected from exploitation of known vulnerabilities","None",null,9.3000000000000007,"Systems which handle sensitive information or key operational services shall be protected from exploitation of known vulnerabilities"]
[9.4,"You have demonstrable confidence in the effectiveness of the security of your technology, people, and processes relevant to essential services","None",null,9.4,"You have demonstrable confidence in the effectiveness of the security of your technology, people, and processes relevant to essential services"]
[9.5,"You securely configure the network and information systems that support the delivery of essential services","None",null,9.5,"You securely configure the network and information systems that support the delivery of essential services"]
[9.6,"The organisation is protected by a well managed firewall","None",null,9.6,"The organisation is protected by a well managed firewall"]
[10.1,"The organisation can name its suppliers, the products and services they deliver and the contract durations","None",null,10.1,"The organisation can name its suppliers, the products and services they deliver and the contract durations"]
[10.199999999999999,"Basic due diligence has been undertaken against each supplier that handles personal information ","None",null,10.199999999999999,"Basic due diligence has been undertaken against each supplier that handles personal information "]
[10.3,"All disputes between the organisation and its suppliers have been recorded and any risks posed to data security have been documented","None",null,10.3,"All disputes between the organisation and its suppliers have been recorded and any risks posed to data security have been documented"]

{"sheet":"Change control","index":2,"n_rows":5,"n_cols":3,"rows_kept":5,"cut":false,"hidden":false,"merged":[]}
["Version","Date"]
[1,"2025-04-21","First draft"]
[1.1000000000000001,"2025-04-24","Dates updated to currnet year \nRemoving requirements with duplication or not relevant for IT Suppliers and details for OES Independent providers.\n1.1.7 Data Quality\n1.1.8 Clinical Coding\n2.1.1 Training\n4.3.3 Monitoring\n4.5.3 MFA\n6.3.2 - Responding to a Cyber Alert\n9.1.2 - Default passwords\n9.3.7 NCSC Web Check\n9.3.8 Connected Medicals Devices"]
[1.2,"2025-06-28","Category 3 and 4 updates\nNew evidence item catergory 3 - 1.3.9, 7.1.5, 7.1.6, 8.3.8\nNew evidence item for catergory 4 - 1.3.9, 7.1.1, 7.1.5, 7.1.6, 8.1.4, 8.2.1, 8.3.8, 8.4.3\nUpdated evidence items for category 3 - 1.1.5, 1.3.1, 7.1.1, 7.3.6, 8.3.5, 8.4.3\nUpdated evidence items for category 4 - 1.1.5, 1.3.1, 7.3.6, 8.3.1, 8.3.5, 8.4.3 \nUpdated tooltips for category 3 - 1.1.3, 1.3.6, 3.2.1, 4.4.1, 7.1.1, 7.1.2, 7.3.4\nUpdated tooltips for category 4 - 1.1.3, 1.3.6, 3.2.1, 4.4.1, 7.1.2, 7.3.4\nRemoved evident items for category 3 - 4.3.3, 9.3.8, 10.2.5\nRemoved evidence items for category 4 - 4.3.3, 9.3.8\nEvidence item made mandatory for category 3 - 4.3.1\n"]
[null,"2025-06-28","Category 2 updates\nNew evidence item - 4.5.6, 7.1.5, 9.5.11\nUpdated evidence item - 1.1.3, 7.3.6\nUpdate tooltips - 1.1.2, 1.1.3, 4.3.1, 6.3.3, 7.1.2, 7.2.1, 7.3.4, "]