The DSP Toolkit – What Is It All About?

In this article, we are going to examine the National Data Guardian’s 10 data security standards and how the DSP Toolkit is used to ascertain compliance with these standards. We will explore who is required to complete the DSP Toolkit as well as the challenges in doing so. Further, we will demonstrate how the access management software tenfold can be used to help implement the compliance requirements of the 10 security standards and thus help you prove that you are practicing good data security.

The Data Security and Protection Toolkit (DSPT), provided by NHS Digital, is a free online self-assessment questionnaire based on the 10 Data Security standards. It consists of assertions (i.e. statements) which are again divided into 179 evidence items (sub-questions). All organizations in the healthcare sector – from NHS trusts to nursing homes to GPs – must complete the DSP Toolkit annually (or twice a year for larger organizations) to measure their level of compliance with the data and information governance requirements, as stipulated by the Department of Health and Social Care, in particular the 10 Data Security Standards set out by the National Data Guardian.

These standards were formulated as a response to the WannaCry ransomware attack, which took place in 2017 and affected several organizations around the world – including NHS trusts. The 10 security standards are designed to address basic cyber vulnerabilities and to ensure that attacks such as WannaCry can be better prevented in the future.

As data security standards are constantly changing, the DSP Toolkit and its requirements are reviewed on a regular basis and updated to ensure they are always aligned with current best practices. This is why annual or semi-annual completion is mandatory.

The keywords here are: accountability and compliance.

The field of data privacy and confidentiality is a growing area of interest to organisations as people are becoming more aware of their data protection rights.

The purpose of the DSPT is to demonstrate to these people and the people you work with – GPs, NHS services, commissioners, regulators – that your organisation can be trusted to handle confidential patient data appropriately and securely. A higher level of accountability raises public confidence that the NHS and its partner organisations can be trusted with confidential data. This, in turn, reduces the likelihood that patients will withdraw their consent for sharing personal information with such organisations.

The DSP Toolkit also helps organisations protect against data breaches by requiring them to demonstrate compliance with the key points of the General Data Protection Regulation (GDPR), as identified in the NHS GDPR Checklist, as well as with the guidelines of other frameworks, such as the Data Protection Act 2018 and ISO 27001.

Once completed, organizations can publish their completed DSPT to further increase that trust.

All organizations who have/need or would like to have access to confidential NHS patient data and systems, or who provide services to the NHS and have direct or indirect access to national informatics services, must complete the DSP Toolkit in order to demonstrate that they are practicing good data security and that they are handling confidential patient information correctly.

Organizations required to complete the DSPT are sorted into four categories:

Each category is required to demonstrate compliance with the 10 Security Standards. However, the DSP Toolkit does distinguish between categories: for example, while Category 4 organisations are only required to answer 42 of the 179 evidence items, Category 1 organisations must provide 116 evidence items to prove compliance.

Also, Category 1 and 2 organisations are required to complete the DSPT twice a year, while Category 3 and 4 organisations are required to complete it only once per year.

Furthermore, the completed DSP Toolkits submitted by Category 1 and 2 organisations are subject to independent annual audits.

The classifications and differing requirements are supposed to reflect the varying levels of data security risk, IT arrangement and digital maturity between categories.

No, John. You cannot have more time. You should have started on the DSP Toolkit sooner! Adobe Stock, (c) Elnur

First, you must register your organization and determine the category it falls under by supplying information. Based on the data you provide here, the questions included in the DSP Toolkit will be tailored to your organization. You can then access the DSPT and feed it with information as you go along. Your aim should be to complete a so-called “standards met”, which essentially means that you must respond to all mandatory questions of the DSPT.

It is advisable not to procrastinate this task until the very last minute. The deadline for submission is usually 31^st March of each year (and 31^st October for those who are required to complete the DSPT semi-annually). However, due to the Covid crisis, the deadline for submission in 2020/2021 has been pushed back from March to 30^th June, 2021.

For a more detailed overview of how to complete the DSP Toolkit, click here.

The 10 Data Security Standards are organized under three so-called leadership obligations (i.e. topics):

More specifically, the requirements laid out under these categories are the following.

Data Security Standard 1: All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes.

Data Security Standard 2: All staff understand their responsibilities under the National Data Guardian’s Data Security Standards, including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.

Data Security Standard 3: All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit.

Data Security Standard 4: Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals

Data Security Standard 5: Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.

Data Security Standard 6: Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection.

Data Security Standard 7: A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management

Data Security Standard 8: No unsupported operating systems, software or internet browsers are used within the IT estate.

Data Security Standard 9: A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.

Data Security Standard 10: IT suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standards.

The DSPT is an extensive and detailed questionnaire. The 179 evidence items, of which 166 are mandatory for Category 1 organisations, are called evidence items because they require you to provide evidence to support your answers. Some items will require you to provide a written answer, while other will ask you to provide a document of some sort to support your answer, such as an Excel spreadsheet or PDF file.

Doing so for 166 questions is a time-consuming process that demands a high level of meticulousness and great organizational skills, as well as insight from the person or persons completing it. As mentioned earlier, completing the DSPT is a big task that should not be left until the deadline. It should be an on-going process where information is added and updated regularly throughout the whole year.

If you are a medium to large-scale organization and do not have the appropriate processes and workflows in place to aid you in providing evidence wherever the DSP Toolkit demands it, you have a problem. You will find yourself frantically skimming through digital mountains of information and lists to find the very one you need. x166.

tenfold is an access management tool that automates and simplifies complex access management processes. The software is aimed at organizations with 100 users or more and therefore best suited to aid Category 1 and 2 organizations, who handle a large amount of patient data and users, in completing the DSP Toolkit. Some examples of how tenfold can aid such organizations:

Solution: One of tenfold’s key features is that it uses automated workflows to assign privileges to users and withdraws them again when they are no longer needed. This ensures users only ever have the privileges they actually need to perform their job duties – which in essence is the core value of the Principle of Least Privilege, or POLP. By implementing POLP, tenfold guarantees that critical (patient) data cannot be copied or downloaded by people who do not have the appropriate privileges to do so.

One such risk that exists in every organization where data is shared among users is the insider threat. An insider threat might be an irate employee or business associate who has access to critical data and steals it (e.g. for financial or personal gain or simply for revenge). VPN access also falls into this category, especially now during the COVID crisis, where many companies are allowing their employees to work remotely, often using their own unsafe home networks. These internal risks are hard to recognize and often overlooked, as most companies are focused on preventing external attacks, rather than internal ones.

Solution: tenfold allows you to govern who has access to what resource and automatically removes privileges (e.g. VPN access) which are no longer needed. So, when the irate employee returns to the office, their VPN rights will automatically be withdrawn.

While tenfold addresses various aspects of all three leadership obligations (People – Process – Technology), its core mostly covers Leadership Obligation 2: Process. Click on the evidence items below to see how tenfold can assist you in achieving compliance with the DSP Toolkit.

To summarize, tenfold can be of great assistance to your organization in meeting the requirements of the 10 Data Security Standards, especially Standards 1 and 4. Many of the user management tasks your admins would usually waste valuable time on doing manually can be automated. tenfold provides detailed reports on privileges and who has access to what and why as well as who granted it. These reports can be uploaded to the DSP Toolkit to corroborate that you are practicing good data security.