NHS customers check your toolkit result before they share data with you. Naq sets up most of the work for you, then checks your evidence every night.
DSPT with Naq, a three-minute walkthrough of the product · Narrated, with captions
The Data Security and Protection Toolkit, or DSPT, is NHS England's yearly self-assessment for any organisation that handles NHS patient data or systems.
The deadline to publish your assessment, every year.
Managing risk, protecting against cyber attack, detecting events, limiting the impact of incidents, and using information properly.
NHS bodies check a supplier's published result before they share data with them.
This is everything the toolkit asks of you. For each step, here is what you do and what Naq does.
Write down what the toolkit covers in your organisation, and what it leaves out.
Sets up the toolkit for your whole organisation, with 47 requirements across five objectives mapped to 41 ready-made controls.
List what could go wrong, such as a supplier data breach, and choose how you will reduce it.
Scores each risk by how likely and how serious it is, and keeps every treatment in one register.
Approve the policies, send them to all staff, and assign the training.
Gives you 49 ready-written policies and 16 security and data protection courses, and shows who is overdue.
Log an incident with an owner and a due date, then contain it, resolve it and record the lessons.
Checks that every incident is closed on time, with the lessons recorded.
List each processing activity: whose data it is, your lawful basis, and how long you keep it.
Flags any activity that has no lawful basis or retention period.
Complete and publish your assessment on the toolkit.
Checks your evidence every night, so a missing lesson or a lapsed review is flagged long before the deadline.
Naq links your evidence to the right controls and checks it every night. A missing lesson or a lapsed review is flagged long before 30 June.
Register · linked by Naq
Document · linked by Naq
Real checks from a DSPT control in Naq. The results shown are illustrative.
Publish your toolkit result, controls and documents on your own Trust Centre. NHS customers answer their own questions before they share data with you.
They see your toolkit and the controls behind it.
For example your data protection impact assessment, with their name and the reason they need it.
Naq emails them a link straight away, and nothing reaches them until you decide.
Mapped to the DSPT, version 8, aligned to the Cyber Assessment Framework.
And 32 more.
And 40 more.
Every document you link as evidence is also checked automatically: its current version must be approved, staff acknowledgements must be complete, and its review date must not have passed.
Built from the Naq control library for the Data Security and Protection Toolkit.
See the six steps in your own workspace, with your own data.
