Overview of the independent assessment framework and guide

This section provides the purpose, scope, benefits, and an overview of the:

• independent assessment guide
• independent assessment framework 

Both of these documents will be published in November 2024.

The CAF-aligned DSPT harnesses a less prescriptive approach in the response to each outcome and therefore warrants its own guidance to reflect the changes in the toolkit.

This updated guidance is intended to provide the following benefits to health and social care organisations, independent assessment providers, and the health and social care system as a whole:

Health and social care organisations

As the focus of DSPT shifts from verifying the implementation of specific controls mandated by evidence items, to assessing adherence to the desired outcomes under the CAF-aligned DSPT independent assessments, organisations will receive an opinion over the effectiveness of their control environments to adhere to the specified outcomes.

This would ultimately support them in identifying cyber security and information governance gaps between the organisation’s self-assessment and the independent assessment result, that should be mitigated to improve the posture of the organisation. In addition, the increased insight that national bodies will have into the cyber security and information governance posture of multiple organisations across the sector will enable them to support individual organisations in improving their controls.

Independent assessment providers

In recent times, independent assessment providers have been expected to provide an increased level of assurance, over a wider range of data security and protection controls (including more technical cyber-related controls introduced in the CAF-aligned DSPT).

The guidance is not designed to replace the existing expertise, knowledge and professional judgement of independent assessment providers, but should instead support them in identifying how to effectively assess the organisation against the objectives of the CAF-aligned DSPT. It will also help inform the work of cyber security and information governance professionals that are new to the health and social care system, helping them to understand assessor’s requirements to validate the posture of the organisation during the assessment.

National bodies/health and social care system

When followed and widely used across the system, the CAF-aligned DSPT framework and guide should provide national bodies with greater insight into the effectiveness of health and social care organisations’ cyber security and information governance control environments, as well as their alignment to regulations such as the Network and Information Systems (NIS) Regulation 2018.

This will enable new national data security services and guidance to align to known areas of weakness and support shared learnings across the sector from examples of good practice, as well as provide additional support to organisations that may have issues in this area. The Department of Health and Social Care (DHSC), as the competent authority for the health and care sector under the NIS regulations, may access information from the CAF-aligned DSPT to fulfil its regulatory purpose.

The following summary outlines the purpose and scope of the CAF aligned DSPT independent assessment framework.

The NHS England (NHSE) CAF-aligned DSPT independent assessment framework is a resource, created by NHSE, for independent assessors of health and care organisations.

The framework is the resource that the assessor should use to assess the organisation against the requirements of the CAF-aligned DSPT. It can act as the basis of scoping the terms of reference for each CAF-aligned DSPT assessment, the approach that the assessor could take during their review, and inform the type of evidence that the assessor could request and review as part of their work.

Further detail on the framework, and how to navigate it, will be provided in the framework itself.

There are 5 (A to E) objectives within the CAF-aligned DSPT. The CAF-aligned DSPT independent assessment framework outlines the principles that make up each objective, highlighting the area of scope for each principle. Each principle contains several outcomes, which can be 'Achieved', 'Partially Achieved' or 'Not Achieved', depending on the results of their respective indicators of good practice.

The below diagram demonstrates the structure for objective A, principle A2, which has 2 outcomes with the associated achievement levels for each outcome.

Each organisation will be assigned a profile, which will be based on the type and size of the organisation. This profile will be used to identify the expected achievement levels for each outcome.

The framework details:

• the control objective of each outcome and IGP
• provides guidance as to how to assess the organisation’s control environment against the IGPs
• provides indication as to the on-site tests that could be performed and documents that the assessor should typically request and review as part of their work

It also includes details on whether or not the IGP is required for this year’s assessment for each category of health and social care organisation.

The framework is designed to be used by independent assessment providers. It will enable independent assessment providers to carry out their assessments in an efficient and consistent manner.

It's advised that independent assessment providers have experience in reviewing cyber security and information governance control environments, and the assessment approach is not intended to be exhaustive or overly prescriptive, though it does aim to promote consistency of approach.

Assessors are expected to use their professional judgement and expertise in further investigating and analysing the specific control environment, and associated risk, of each health and social care organisation.