| Requirement | What it means for Viewee | Owner (Instinct / Alex+Cain / External assessor) | Effort | Status | Evidence needed | Source URL |
|---|
| Confirm DSPT applicability and organisation category | DSPT is required where Viewee accesses NHS patient data/systems or an NHS contract/customer requires it. Register under the correct category, likely IT Supplier; do not present DSPT as universally mandatory for all care-home SaaS use. | Alex+Cain | M | Do now; confirm with target customers | Applicability decision, NHS contract/data-flow evidence and ODS/DSPT registration details | https://www.dsptoolkit.nhs.uk/ |
| Use the current annual standard | The toolkit is annual. The published 2025-26 v8 deadline was 30 June 2026; before submission use the live 2026-27 standard and deadline shown in the service. | Alex+Cain | M | Do now; recheck before submission | Current assertions/evidence export and submission timetable | https://www.dsptoolkit.nhs.uk/News/161 |
| Scope all NHS-related data, systems, people and suppliers | Define services, locations, endpoints, app/API, cloud, support, development and subcontractors that process or can access NHS patient data/systems. | Alex+Cain | H | Design now; finalise before NHS processing | DSPT scope and data/system flow diagrams | https://www.dsptoolkit.nhs.uk/News/161 |
| Assign senior accountability and governance | Name accountable senior owner(s), security and data protection responsibilities; review risks, incidents, actions and submission evidence. | Alex+Cain | M | Do now | Roles/RACI, governance calendar and founder review minutes | https://www.dsptoolkit.nhs.uk/News/161 |
| Complete every applicable assertion with evidence | For the selected IT Supplier category, answer current assertions and keep evidence that directly supports each response; do not mark unsupported items complete. | Instinct | H | Do now; operating evidence later | Evidence index mapped to current assertion/evidence IDs | https://www.dsptoolkit.nhs.uk/News/161 |
| Maintain information asset and data-flow records | Know what NHS/personal data is held, where it flows, purpose, owner, recipients, retention, disposal and legal/contractual basis. | Alex+Cain | H | Do now; update before launch | Information asset register, ROPA and data-flow diagrams | https://www.dsptoolkit.nhs.uk/News/161 |
| Staff security and annual training | Ensure founders, staff and contractors understand data security, confidentiality, phishing and incident reporting; retain completion evidence and role-specific competence. | Alex+Cain | M | Do now and annual | Training logs, induction, policies and acknowledgements | https://www.dsptoolkit.nhs.uk/News/161 |
| Access control, MFA and least privilege | Unique accounts, prompt joiner/mover/leaver action, MFA, privileged separation, periodic access review and controlled support access for NHS data/systems. | Alex+Cain | H | Do now; app controls before NHS use | Identity policies, access matrix, reviews and support-access logs | https://www.dsptoolkit.nhs.uk/News/161 |
| Secure configuration, patching and vulnerability management | Maintain supported assets, secure baselines, timely patches, dependency/container/cloud scanning, remediation SLAs and exception governance. | Alex+Cain | H | Do now and ongoing | Asset register, patch/scanner reports, remediation and exceptions | https://www.dsptoolkit.nhs.uk/News/161 |
| Independent penetration testing for internet-facing service | Before relying on the SaaS for NHS data, commission appropriately scoped independent testing of app/API, tenant isolation and cloud exposure; remediate and retest material issues. Frequency/scope should match the current DSPT assertions, NHS contract and risk. | External assessor | H | Before NHS production and after material change | Scope, methodology, full report, remediation and clean retest | https://www.dsptoolkit.nhs.uk/News/161 |
| Logging, monitoring and incident response | Log security-relevant events and admin/support access, protect logs, monitor/alert, triage incidents, preserve evidence and exercise the plan. | Alex+Cain | H | Build now; prove in operation | Log design/retention, alerts, incident plan, exercises and incident records | https://www.dsptoolkit.nhs.uk/News/161 |
| Report data/security incidents through required routes | Meet contractual, DSPT/NHS and ICO reporting routes and timescales; processor escalation to customer must be without undue delay. | Alex+Cain | M | Before NHS processing | Reporting matrix, contacts, templates and exercise | https://www.dsptoolkit.nhs.uk/News/161 |
| Backups, restore and continuity | Define recovery objectives, segregate/protect backups, test restoration and plan continuity for cloud/service failures and supplier exit. | Alex+Cain | H | Design now; test before NHS production | Backup configuration, restore tests, BCP/DR exercise and supplier exit plan | https://www.dsptoolkit.nhs.uk/News/161 |
| Supplier and cloud assurance | Flow security/data protection duties into cloud and subcontractor contracts; assess locations, support access, incidents, continuity, deletion and assurance evidence. | Alex+Cain | H | Before vendor commitment | Supplier register, due diligence, DPAs, security reports and annual reviews | https://www.dsptoolkit.nhs.uk/News/161 |
| Privacy, ROPA, DPIA and rights controls | Maintain UK GDPR records, complete DPIA for likely high-risk processing, publish privacy information where Viewee is controller and support customer rights requests. | Alex+Cain | H | Do now; test before NHS use | ROPA, DPIA, privacy notices and rights test evidence | https://www.dsptoolkit.nhs.uk/News/161 |
| Independent assessment where mandated | Check the live DSPT category and annual assurance rules. IT Supplier guidance exists for independent assessment; commission an approved/competent assessor if the toolkit, customer contract or risk tier requires it. | External assessor | H | Confirm after category/contract known | Applicability decision, assessor terms, report and remediation | https://www.dsptoolkit.nhs.uk/Help/Independent-Assessment-Guides |
| Submission, improvement plan and annual renewal | Submit by the applicable annual deadline. If the toolkit permits an improvement plan, ensure actions are specific, owned and dated; monitor to closure and repeat annually. | Alex+Cain | M | After evidence ready | Published submission status, improvement plan, action tracking and renewal calendar | https://www.dsptoolkit.nhs.uk/News/Improvement-Plans-25-26 |
