Cyber Assurance Service

We offer centrally funded assessments to help NHS organisations identify vulnerabilities and understand and overcome areas of high risk. This will help your organisation to achieve Data Security and Protection Toolkit (DSPT) standards.

About the assessments 

The assessment will help to build cyber security resilience to help keep patients and service users safe. The assessment will measure your performance by completing an IT Health Check and assessing your alignment to key DSPT standards relating to Cyber Assessment Framework (CAF) Indicators of Good Practice (IGP).

Reports completed after the assessment will detail where improvement is needed, also considering the urgency to correct.

These assessments are for NHS trusts and commissioning support units (CSUs).

Benefits

Improve your organisation’s cyber security and increase patient safety.

Receipt of an approved health technology assessment and remediation advice.

Assistance to develop cyber and infrastructural resilience, creating an understanding of the impact of loss or unavailability of critical national systems and potential mitigating actions.

Provide guidance on implemented cyber security at a local level, while being clear on mandated standards and requirements.

Creation of reporting based on organisational performance including potential actions and feedback.

Support alignment with key DSPT standards and Cyber Assessment Framework (CAF) Indicators of Good Practice (IGP).

What the assessment involves 

Once you register for an assessment, we will confirm that you are in scope to receive an assessment. We will then pass you details to our specialist supplier, Dionach, who will deliver the assessment. The intention is to ensure that the assessment causes minimal disruption to your organisation’s day to day activities.

Dionach will arrange an initiation call with you and will advise you of the activities that will take place and the prerequisite material that will need to be provided. Once initial documentation has been filled in, our supplier will then agree and confirm dates for your assessment at a suitable time for your organisation. Depending on the volume of assessments being completed at the time, this may be a few months later. In the meantime, it is essential the prerequisite materials required before the assessment are provided to Dionach. Scoping documentation requested will need to be received by Dionach 4 weeks prior to the start of your engagement. A call will also be held 3 weeks prior to the start, to confirm scoping document is all filled in, to answer any questions and to confirm everything is ready for the start date. If documentation is not provided by the agreed deadlines, your engagement may be postponed or cancelled. The delivery of the assessment should take between 2-3 weeks.

Please note that we have a limited number of engagements we can deliver. These will be allocated on a first come first served basis. If the current allocation is full, we will place your call on hold and advise you whether further engagements become available.

Our specialist supplier will carry out an IT Health Check and complete a detailed technical review of your organisations IT setup, structure and working practices. The IT Health Check will cover:

file share testing
active directory, central security and mobile device management review
asset security review
wireless security review
external infrastructure review
an optional security review for patient administration system (PAS)

Some data collected as part of the IT Health Check will be used to assess the key DSPT assertions, although some will require additional information from you to complete. The DSPT aspect will cover:

accountability and governance
access management
password protection
software and email anti-virus protection
business continuity disaster recovery
system updates and patch management
vulnerability management
policy management
roles and responsibilities
understanding of risk

Expectations from your organisation

In receiving this assessment, you will be expected to ensure that you/your organisation:

liaise with our supplier and organise a suitable time for the assessment to be delivered
provide relevant information and prerequisite scoping materials pertinent to the delivery of the assessment - documents required will need to be provided at least 4 weeks before assessment is due to take place
keep our supplier informed of any local organisational changes that may impact assessment delivery
inform our supplier as soon as possible if you are no longer able to facilitate delivery or if you need to change delivery dates - a call will be held 4 weeks prior to the assessment to confirm scoping document is complete, whether additional support is needed and to handle any questions

After the assessment

You will receive a detailed report within 10 working days of the assessment, outlining the highest risks and critical areas. This report will include suggested actions your organisation can take to remediate.

Register for a cyber assessment

To find out more or to request this service, raise a call to the helpdesk by registering on the portal, clicking ‘Request Something’ searching for ‘Cyber Assurance Service’.

Our internal teams and supplier will then be in touch to arrange your assessment. 

How this service aligns with the Cyber Assessment Framework

Open the expanders below to find out how this service aligns to the principles and outcomes of the Cyber Assessment Framework (CAF).

Objective A: Managing security risk

A1.a You have effective organisational security management led at board level and articulated clearly in corresponding policies.

A2.a Your organisation has effective internal processes for managing risks to the security of network and information systems related to the operation of essential functions and communicating associated activities.

A2.b You have gained confidence in the effectiveness of the security of your technology, people, and processes relevant to essential functions.

A3.a Everything required to deliver, maintain or support networks and information systems necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).

A4.a The organisation understands and manages security risks to networks and information systems supporting the operation of essential functions that arise as a result of dependencies on external suppliers. This includes ensuring that appropriate measures are employed where third party services are used.

Objective B: Defending systems against cyber attack

B1.b You have successfully implemented your security policies and processes and can demonstrate the security benefits achieved.

B2.a You robustly verify, authenticate and authorise access to the networks and information systems supporting your essential function.

B2.b You fully know and have trust in the devices that are used to access your networks, information systems and data that support your essential function.

B2.c You closely manage privileged user access to networks and information systems supporting the essential function.

B2.d You closely manage and maintain identity and access control for users, devices and systems accessing the networks and information systems supporting the essential function.

B3.b You have protected the transit of data important to the operation of the essential function. This includes the transfer of data to third parties.

B3.c You have protected stored soft and hard copy data important to the operation of the essential function.

B3.d You have protected data important to the operation of the essential function on mobile devices.

B4.a You design security into the network and information systems that support the operation of essential functions. You minimise their attack surface and ensure that the operation of the essential function should not be impacted by the exploitation of any single vulnerability.

B4.c You manage your organisation's network and information systems that support the operation of essential functions to enable and maintain security.

B4.d You manage known vulnerabilities in your network and information systems to prevent adverse impact on the essential function.

B5.b You design the network and information systems supporting your essential function to be resilient to cyber security incidents. Systems are appropriately segregated and resource limitations are mitigated.

Last edited: 4 June 2025 10:52 am