NHS DSPT

You have effective organisational information assurance management led at board level and articulated clearly in corresponding policies.

Your organisation has established roles and responsibilities for the security and governance of information, systems and networks at all levels, with clear and well-understood channels for communicating and escalating risks.

You have senior level accountability for the security and governance of information, systems and networks, and delegate decision making authority appropriately and effectively. Risks to information, systems and networks related to the operation of your essential function(s) are considered in the context of other organisational risks.

Your organisation has effective internal processes for managing risks to the security, resilience and governance of information, systems and networks related to the operation of your essential function(s), and communicating associated activities. This includes a process for data protection impact assessments (DPIAs).

You understand the capabilities, methods and techniques of threat actors and what information, systems and networks they may compromise to adversely impact your essential function(s). This information is used to inform security and resilience risk management decisions, adjusting, enhancing or adding security measures to better defend against threats.

You have gained confidence in the effectiveness of your technology, people and processes relevant to the security and governance of information, systems and networks supporting your essential function(s).

Everything required to deliver, maintain or support information, systems and networks necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).

You understand and effectively manage the security and information governance risks associated with suppliers supporting the operation of your essential function(s).

You actively maximise the use of secure and supported software, whether developed internally or sourced externally, within network and information systems supporting the operation of your essential function(s).

You have developed and continue to improve a set of information assurance and resilience policies, processes and procedures that manage and mitigate the risk of adverse impact to your essential function(s).

You have successfully implemented your information assurance policies, processes and procedures and can demonstrate the benefits achieved.

You robustly verify, authenticate and authorise access to the information, systems and networks supporting your essential function(s).

You fully know and have trust in the devices that are used to access your information, systems and networks that support your essential function(s).

You closely manage privileged user access to networks and information systems supporting your essential function(s).

You closely manage and maintain identity and access control for users, devices and systems accessing network and information systems supporting your essential function(s).

You have a good understanding of data important to the operation of your essential function(s), where it is stored, where it travels and how unavailability or unauthorised access, uncontrolled release, modification or deletion would adversely impact the essential function(s). This also applies to third parties storing or accessing data important to the operation of your essential function(s).

You have protected the transit of data important to the operation of your essential function(s). This includes the transfer of data to third parties.

You have protected stored soft and hard copy data important to the operation of your essential function(s).

You have protected data important to the operation of your essential function(s) on mobile devices (such as smartphones, tablets and laptops.)

Before reuse and/or disposal you appropriately sanitise devices, equipment and removable media holding data important to the operation of your essential function(s).

You design security into network and information systems that support the operation of your essential function(s). You minimise their attack surface and ensure that the operation of your essential function(s) should not be impacted by the exploitation of any single vulnerability.

You securely configure network and information systems that support the operation of your essential function(s).

You manage your organisation's network and information systems that support the operation of your essential function(s) to enable and maintain security.

You manage known vulnerabilities in network and information systems to prevent adverse impact on your essential function(s).

You are prepared to restore the operation of your essential function(s) following adverse impact to network and information systems.

You design network and information systems supporting your essential function(s) to be resilient to cyber security incidents. Systems are appropriately segregated and resource limitations are mitigated.

You hold accessible and secured current backups of data and information needed to recover operation of your essential function(s) following an adverse impact to network and information systems.

You develop and maintain a positive culture around information assurance and a shared sense of responsibility.

The people who support the operation of your essential function(s) are appropriately trained in information assurance.

The data sources and tools that you include in your logging and monitoring allow for timely identification of events which might adversely affect the security or resiliency of network and information system(s) supporting the operation of your essential function(s).

You hold log data securely and grant appropriate user and system access only to accounts with business need. Log data is held for a suitable retention period, after which it is deleted.

Evidence of potential security incidents contained in your monitoring data is reliably identified and where appropriate triggers alerts.

You contextualise alerts with knowledge of the threat and your systems, to identify those security incidents as well as responding to all alerts appropriately.

Monitoring and detection personnel skills and roles, including those outsourced, should reflect governance and reporting requirements, expected threats and the complexities of the network or system data they need to use. Monitoring and detection personnel have sufficient knowledge of network and information systems and the essential function(s) they need to protect.

Threats to the operation of network and information systems, and corresponding user and system behaviour, are sufficiently understood. These are used to detect cyber security incidents.

The organisation proactively seeks to detect, within networks and information systems, adverse activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard security prevent/detect solutions (or when standard solutions are not deployable)".

You have an up-to-date incident response plan that is grounded in a thorough risk assessment that takes account of information, systems and networks supporting the operation of your essential function(s) and covers a range of incident scenarios.

You have the capability to enact your incident response plan, including effective limitation of impact on the operation of your essential function(s). During an incident, you have access to timely information on which to base your response decisions.

Your organisation carries out exercises to test response plans, using past incidents that affected your (and other) organisation, and scenarios that draw on threat intelligence and your risk assessment.

When an incident or near miss occurs, your organisation takes steps to understand its causes, informing appropriate remediating action.

Your organisation uses lessons learned from incidents and near misses to improve your security measures.

You follow best practice for providing privacy and transparency information to ensure that all individuals have a reasonable understanding of their rights and how their information is being used.

You appropriately assess and manage information rights requests such as subject access, rectification and objections.

You have a good understanding of requirements around consent and privacy, including the common law duty of confidentiality, and use these to manage consent.

A robust policy and system is in place to ensure opt-outs are correctly applied to the information being used and shared by your organisation.

You lawfully and appropriately use and share information for direct care.

You lawfully and appropriately use and share information for purposes outside of direct care.

You manage records in accordance with your organisation's professional responsibilities and the law.

You are committed to regularly evaluating and improving your organisation's coded clinical data.