{"text_format":"2","workbook":"xlsx","n_sheets":4,"sheets":["Summary","IGPs","Policy and data collections","Products and Services NEW "],"not_rendered":{"charts":0,"images":0,"macros":0,"external_links":0,"defined_names":3,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Summary","index":0,"n_rows":51,"n_cols":17,"rows_kept":51,"cut":false,"hidden":false,"merged":[[22,4,25,4],[13,4,16,4],[13,5,16,5],[0,0,0,2],[0,3,0,5],[2,3,4,3],[2,4,4,4],[2,5,4,5],[2,1,10,1],[2,0,10,0],[2,2,10,2],[5,3,7,3],[26,4,28,4],[26,5,28,5],[13,3,16,3],[9,3,10,3],[11,3,12,3],[17,3,21,3],[22,3,25,3],[0,6,0,8],[22,5,25,5],[5,4,7,4],[5,5,7,5],[9,4,10,4],[9,5,10,5],[11,4,12,4],[11,5,12,5],[17,4,21,4],[17,5,21,5],[43,0,50,0],[43,1,50,1],[43,2,50,2],[38,0,42,0],[38,2,42,2],[38,1,42,1],[49,4,50,4],[49,5,50,5],[47,4,48,4],[29,5,30,5],[31,4,36,4],[31,5,36,5],[29,4,30,4],[47,5,48,5],[44,4,46,4],[44,5,46,5],[38,4,40,4],[38,5,40,5],[41,4,42,4],[41,5,42,5],[44,3,46,3],[47,3,48,3],[49,3,50,3],[29,3,30,3],[31,3,36,3],[41,3,42,3],[38,3,40,3],[26,3,28,3],[11,0,30,0],[11,2,30,2],[31,0,37,0],[31,2,37,2],[11,1,30,1],[31,1,37,1]]}
["Objective",null,null,"Principle",null,null,"Outcome"]
["Key","Title","Description","Key","Title","Description","Key","Title","Description","OES, ALBs and CSUs Expected level of achievement","OES, ALBs and CSUs Standards exceeded level of achievement ","Mandatory requirement type","Mandatory requirement summary","Mandatory requirement question","Mandatory requirement link","Guidance URL","Hide this outcome for sectors"]
["A","Managing risk","Appropriate organisational structures, policies, processes and procedures in place to understand, assess and systematically manage risks to the security and governance of information, systems and networks supporting essential functions.","A1","Governance","The organisation has appropriate management policies, processes and procedures in place to govern its approach to the security and governance of information, systems and networks. ","A1.a ","Board direction ","You have effective organisational information assurance management led at board level and articulated clearly in corresponding policies.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/governance/#a1-a-board-direction"]
[{"$nulls":6},"A1.b ","Roles and responsibilities","Your organisation has established roles and responsibilities for the security and governance of information, systems and networks at all levels, with clear and well-understood channels for communicating and escalating risks. ","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/governance/#a1-b-roles-and-responsibilities"]
[{"$nulls":6},"A1.c ","Decision-making ","You have senior-level accountability for the security and governance of information, systems and networks, and delegate decision-making authority appropriately and effectively. Risks to information, systems and networks related to the operation of your essential function(s) are considered in the context of other organisational risks.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/governance/#a1-c-decision-making"]
[null,null,null,"A2","Risk management","The organisation takes appropriate steps to identify, assess and understand risks to the security and governance of information, systems and networks supporting the operation of essential functions. This includes an overall organisational approach to risk management.","A2.a ","Risk management process ","Your organisation has effective internal processes for managing risks to the security, resilience  and governance of information, systems and networks related to the operation of your essential function(s) and communicating associated activities. This includes a process for data protection impact assessments (DPIAs).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/risk-management/#a2-a-risk-management-process"]
[{"$nulls":6},"A2.b","Understanding threat\n","You understand the capabilities, methods and techniques of threat actors and what information, systems and networks they may compromise to adversely impact your essential function(s). \nThis information is used to inform security and resilience risk management decisions, adjusting, enhancing or adding security measures to better defend against threats.","Partially achieved","Partially achieved",null,null,null,"https://www.dsptoolkit.nhs.uk/Help/Independent-Assessment-Guides","https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/risk-management#a2-b-understanding-threat"]
[{"$nulls":6},"A2.c","Assurance","You have gained confidence in the effectiveness of your technology, people and processes relevant to the security and governance of information, systems and networks supporting your essential function(s). ","Achieved","Achieved","Policy","Organisations must arrange and undergo an independent audit of each DSPT submission, following the audit guidance published by NHS England. \n\nOrganisations must have due regard to the findings. \n\nOrganisations must provide the findings to their board and within their DSPT submission.\n\nThe response fields are currently ‘read only’ and will be automatically populated once you have provided audit details.","Has your organisation met this policy?",null,"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/risk-management#a2-c-assurance"]
[null,null,null,"A3","Asset management","Everything required to deliver, maintain or support information, systems and networks necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).","A3.a ","Asset management","Everything required to deliver, maintain or support information, systems and networks necessary for the operation of essential functions is determined and understood. This includes data, people and systems, as well as any supporting infrastructure (such as power or cooling).","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/asset-management/"]
[null,null,null,"A4","Supply chain","The organisation understands and manages security and information governance risks to the operation of essential functions that arise as a result of dependencies on suppliers. This includes ensuring that appropriate measures are employed where third party services are used.","A4.a ","Supply chain","You understand and effectively manage the security and information governance risks associated with suppliers supporting the operation of your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/supply-chain/"]
[{"$nulls":6},"A4.b","Secure software development and support","You actively maximise the use of secure and supported software, whether developed internally or sourced externally, within systems and networks supporting the operation of your essential function(s).","Not achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-a/supply-chain#a4-b-secure-software-development-and-support"]
["B","Protecting against cyber attack and data breaches","Proportionate security measures are in place to protect information, systems and networks supporting essential functions from cyber attack and data breaches.","B1","Policies, processes and procedures ","The organisation defines, implements, communicates and enforces appropriate policies, processes and procedures that direct its overall approach to securing information, systems and networks that support operation of essential functions.","B1.a","Policy, process and procedure development","You have developed and continue to improve a set of information assurance and resilience policies, processes and procedures that manage and mitigate the risk of adverse impact to your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b1-policies-processes-and-procedures/#b1-a-policy-process-and-procedure-development"]
[{"$nulls":6},"B1.b ","Policy, process and procedure implementation","You have successfully implemented your information assurance policies, processes and procedures and can demonstrate the benefits achieved.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b1-policies-processes-and-procedures/#b1-b-policy-process-and-procedure-implementation"]
[null,null,null,"B2","Identity and access control","The organisation understands, documents and manages access to information, systems and networks supporting the operation of essential functions. Individuals (or automated functions) that can access data or systems are appropriately verified, authenticated and authorised.","B2.a ","Identity verification, authentication and authorisation","You robustly verify, authenticate and authorise access to the information, systems and networks supporting your essential function(s).","Partially achieved","Partially achieved","Policy",null,null,null,"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b2-identity-and-access-control/#b2-a-identity-verification-authentication-and-authorisation"," "]
[{"$nulls":6},"B2.b ","Device management","You fully know and have trust in the devices that are used to access your information, systems and networks that support your essential function(s).","Not achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b2-identity-and-access-control/#b2-b-device-management"]
[{"$nulls":6},"B2.c","Privileged user management","You closely manage privileged user access to network and information systems supporting your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b2-identity-and-access-control/#b2-c-privileged-user-management"]
[{"$nulls":6},"B2.d","Identity and access management (IdAM)","You closely manage and maintain identity and access control for users, devices and systems accessing network and information systems supporting your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b2-identity-and-access-control/#b2-d-identity-and-access-management-iam-"]
[null,null,null,"B3","Data security","Data stored or transmitted electronically is protected from actions such as unauthorised access, modification, or deletion that may cause an adverse impact on essential functions. Such protection extends to the means by which authorised users, devices and systems access critical data necessary for the operation of essential functions. It also covers information that would assist a threat actor, such as design details of network and information systems. ","B3.a ","Understanding data","You have a good understanding of data important to the operation of  your essential function(s), where it is stored, where it travels and how unavailability or unauthorised access, uncontrolled release, modification or deletion would adversely impact the essential function(s). This also applies to third parties storing or accessing data important to the operation of your essential function(s). ","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b3-data-security/#b3-a-understanding-data"]
[{"$nulls":6},"B3.b ","Data in transit","You have protected the transit of data important to the operation of your essential function(s). This includes the transfer of data to third parties.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b3-data-security/#b3-b-data-in-transit"]
[{"$nulls":6},"B3.c","Stored data","You have protected stored soft and hard copy data important to the operation of your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b3-data-security/#b3-c-stored-data"]
[{"$nulls":6},"B3.d ","Mobile data","You have protected data important to the operation of your essential function(s) on mobile devices (such as smartphones, tablets and laptops).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b3-data-security/#b3-d-mobile-data"]
[{"$nulls":6},"B3.e ","Media/equipment sanitisation","Before reuse and/or disposal you appropriately sanitise devices, equipment and removable media holding data important to the operation of your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b3-data-security/#b3-e-media-and-equipment-sanitation"]
[null,null,null,"B4","System Security","Network and information systems and technology critical for the operation of essential functions are protected from cyber attack. An organisational understanding of risk to essential functions informs the use of robust and reliable protective security measures to effectively limit opportunities for threat actors to compromise networks and systems.","B4.a ","Secure by design","You design security into network and information systems that support the operation of your essential function(s). You minimise their attack surface and ensure that the operation of your essential function(s) should not be impacted by the exploitation of any single vulnerability.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b4-system-security/#b4-a-secure-by-design"]
[{"$nulls":6},"B4.b","Secure configuration","You securely configure network and information systems that support the operation of your essential function(s).","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b4-system-security/#b4-b-secure-configuration"]
[{"$nulls":6},"B4.c ","Secure management","You manage your organisation's network and information systems that support the operation of your essential function(s) to enable and maintain security.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b4-system-security/#b4-c-secure-management"]
[{"$nulls":6},"B4.d ","Vulnerability management","You manage known vulnerabilities in network and information systems to prevent adverse impact on your essential function(s).","Partially achieved","Partially achieved","Policy","For each high-severity cyber alert issued by NHS England, organisations must:\n\n•\tfollow the advice within the alert, other than in exceptional circumstances agreed at board level (or as delegated);\n\n•\tuse the NHS England ‘Respond to an NHS cyber alert’ service to confirm a decision to act (or a decision not to follow the advice) promptly, and in any case within 14 days of issue (for alerts issued between 1 July 2026 and 31 December 2026) or within 48 hours of issue (for alerts issued between 1 January 2027 and 30 June 2027); and\n\n•\tuse the service to report actions taken in response to the alert.\n","Has your organisation met this policy?","https://digital.nhs.uk/services/respond-to-an-nhs-cyber-alert","https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b4-system-security/#b4-d-vulnerability-management"]
[null,null,null,"B5","Resilient networks and systems","The organisation builds resilience against cyber attack and system failure into the design, implementation, operation and management of systems that support the operation of your essential function(s).","B5.a ","Resilience preparation","You are prepared to restore the operation of your essential function(s) following adverse impact to network and information systems.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b5-resilient-networks-and-systems/#b5-a-resilience-preparation"]
[{"$nulls":6},"B5.b","Design for resilience","You design network and information systems supporting your essential function(s) to be resilient to cyber security incidents. Systems are appropriately segregated and resource limitations are mitigated.","Not achieved","Not achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b5-resilient-networks-and-systems/#b5-b-design-for-resilience"]
[{"$nulls":6},"B5.c ","Backups","You hold accessible and secured current backups of data and information needed to recover operation of your essential function(s) following an adverse impact to network and information systems.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b5-resilient-networks-and-systems/#b5-c-backups"]
[null,null,null,"B6","Staff awareness and training","Staff have appropriate awareness, knowledge and skills to carry out their organisational roles effectively in relation to the security and governance of information, systems and networks supporting the operation of your essential function(s). ","B6.a ","Culture","You develop and maintain a positive culture around information assurance and a shared sense of responsibility.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b6-staff-awareness-and-training/#b6-a-culture"]
[{"$nulls":6},"B6.b ","Training","The people who support the operation of your essential function(s) are appropriately trained in information assurance.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b6-staff-awareness-and-training/#b6-b-training"]
["C","Detecting cyber security events","Capabilities exist to ensure security defences remain effective and to detect cyber security events and incidents adversely affecting, or with the potential to adversely affect, essential function(s).","C1","Security monitoring","The organisation monitors the security status of network and information systems supporting the operation of essential function(s) in order to detect security events indicative of a security incident.","C1.a ","Sources and tools for logging and monitoring","The data sources and tools that you include in your logging and monitoring allow for timely identification of events which might adversely affect the security or resiliency of network and information system(s) supporting the operation of your essential function(s). ","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/security-monitoring#c1-a-sources-and-tools-for-logging-and-monitoring"]
[{"$nulls":6},"C1.b ","Securing logs","You hold log data securely and grant appropriate user and system access only to accounts with a business need. Log data is held for a suitable retention period, after which it is deleted.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/security-monitoring/#c1-b-securing-logs"]
[{"$nulls":6},"C1.c ","Generating alerts","Evidence of potential security incidents contained in your monitoring data is reliably identified and where appropriate triggers alerts.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/security-monitoring/#c1-c-generating-alerts"]
[{"$nulls":6},"C1.d ","Triage of security alerts","You contextualise alerts with knowledge of the threat and your systems, to identify security incidents as well as responding to all alerts appropriately.","Partially achieved","Partially achieved","Policy","You must tell us if you comply with our high severity cyber alert policy to achieve or partially achieve this contributing outcome.\n\nOrganisations must register and maintain up-to-date contact details with the NHS England ‘Respond to an NHS cyber alert’ service;\n\nOrganisations must use the service to acknowledge receipt of high severity cyber alerts issued by NHS England within: \n\n48 hours for high severity alerts issued between 1st July 2026 and 31st December 2026, and;\n\n24 hours for high severity alerts issued between 1st January 2027 and 30th June 2027.","Has your organisation met this policy?","https://digital.nhs.uk/services/respond-to-an-nhs-cyber-alert","https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/security-monitoring#c1-d-triage-of-security-alerts"]
[{"$nulls":6},"C1.e ","Personnel skills for monitoring and detection","Monitoring and detection personnel skills and roles, including those outsourced, reflect governance and reporting requirements, expected threats and the complexities of the network or system data they need to use. Monitoring and detection personnel have sufficient knowledge of network and information systems and the essential function(s) they need to protect.","Partially achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/security-monitoring#c1-e-personnel-skills-for-monitoring-and-detection"]
[{"$nulls":6},"C1.f","Understanding user and system behaviour, and threat intelligence","Threats to the operation of network and information systems, and corresponding user and system behaviour, are sufficiently understood. These are used to detect cyber security incidents.","Not achieved","Partially achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/security-monitoring#c1-f-understanding-user-and-system-behaviour-and-threat-intelligence-within-security-monitoring"]
[null,null,null,"C2","Threat hunting","The organisation proactively seeks to detect, within networks and information systems, adverse activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard security prevent / detect solutions (or when standard solutions are not deployable).","C2.a ","Threat hunting","The organisation proactively seeks to detect, within networks and information systems, adverse activity affecting, or with the potential to affect, the operation of essential functions even when the activity evades standard security prevent / detect solutions (or when standard solutions are not deployable).","Not achieved","Not achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-c/threat-hunting"]
["D","Minimising the impact of incidents","Capabilities exist to minimise the adverse impact of an incident on the operation of essential functions, including the restoration of those functions where necessary, and to uphold the rights of impacted individuals. ","D1","Response and recovery planning","There are well-defined and tested incident management processes in place, that aim to ensure continuity of essential function(s) in the event of system or service failure and to uphold the rights of impacted individuals. Mitigation activities designed to contain or limit the impact of compromise are also in place.","D1.a ","Response plan","You have an up-to-date incident response plan that is grounded in a thorough risk assessment that takes account of information, systems and networks supporting the operation of your essential function(s) and covers a range of incident scenarios.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-d/principle-d1-response-and-recovery-planning/#d1-a-response-plan"]
[{"$nulls":6},"D1.b ","Response and recovery capability","You have the capability to enact your incident response plan, including effective limitation of impact on the operation of your essential function(s). During an incident, you have access to timely information on which to base your response decisions.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-d/principle-d1-response-and-recovery-planning/#d1-b-response-and-recovery-capability"]
[{"$nulls":6},"D1.c ","Testing and exercising","Your organisation carries out exercises to test response plans, using past incidents that affected your (and other) organisation, and scenarios that draw on threat intelligence and your risk assessment.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-d/principle-d1-response-and-recovery-planning/#d1-c-testing-and-exercising"]
[null,null,null,"D2","Lessons learned","When an incident or near miss occurs, steps are taken to understand its causes and to ensure remediating action is taken to protect against future incidents.","D2.a","Post incident analysis","When an incident or near miss occurs, your organisation takes steps to understand its causes, informing appropriate remediating action.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-d/principle-d2-lessons-learned#d2-a-post-incident-analysis"]
[{"$nulls":6},"D2.b ","Using incidents and near misses to drive improvements","Your organisation uses lessons learned from incidents and near misses to improve your security measures.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-d/principle-d2-lessons-learned/#d2-b-using-incidents-and-near-misses-to-drive-improvements"]
["E","Using and sharing information appropriately","The organisation ensures that information is used and shared lawfully and appropriately. ","E1","Transparency","The organisation is transparent about how it collects, uses, shares and stores information. Privacy notices are clear and easy for members of the public to access. ","E1.a ","Privacy and transparency information ","You follow best practice for providing privacy and transparency information to ensure that all individuals have a reasonable understanding of their rights and how their information is being used.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/transparency/"]
[null,null,null,"E2","Upholding the rights of individuals","The organisation respects and supports individuals in exercising their information rights. ","E2.a ","Managing data subject rights under UK GDPR","You appropriately assess and manage information rights requests such as subject access, rectification and objections.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/upholding-the-rights-of-individuals/#e2-a-managing-data-subject-rights-under-uk-gdpr"]
[{"$nulls":6},"E2.b","Consent","You have a good understanding of requirements around consent and privacy, including the common law duty of confidentiality, and use these to manage consent.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/upholding-the-rights-of-individuals/#e2-b-consent"]
[{"$nulls":6},"E2.c ","National data opt-out policy","A robust policy and system is in place to ensure opt-outs are correctly applied to the information being used and shared by your organisation.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/upholding-the-rights-of-individuals/#e2-c-national-data-opt-out-policy"]
[null,null,null,"E3","Using and sharing information","The organisation uses and shares information appropriately. ","E3.a","Using and sharing information for direct care","You lawfully and appropriately use and share information for direct care.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/using-and-sharing-information/#e3-a-using-and-sharing-information-for-direct-care"]
[{"$nulls":6},"E3.b ","Using and sharing information for other purposes ","You lawfully and appropriately use and share information for purposes outside of direct care.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/using-and-sharing-information/#e3-b-using-and-sharing-information-for-other-purposes"]
[null,null,null,"E4","Records management","The organisation manages records in accordance with professional obligations and the law.  ","E4.a ","Managing records","You manage records in accordance with professional obligations and the law.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/records-management/#e4-a-managing-records"]
[{"$nulls":6},"E4.b","Clinical coding","You are committed to regularly evaluating and improving your organisations coded clinical data.","Achieved","Achieved",{"$nulls":4},"https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-e/records-management/#e4-b-clinical-coding","ICBs, ALBs, CSUs"]

{"sheet":"IGPs","index":1,"n_rows":291,"n_cols":9,"rows_kept":291,"cut":false,"hidden":false,"merged":[[0,1,0,6]]}
[null,"Indicators of Good Practice reference point for assessment. Not achieved or Achieved is determined by larger overarching outcomes",{"$nulls":6},"Note: there is no horizontal relationship between IGPs.  For example cell C4 and G4 are not necessarily the same topic.\nWe should preserve the vertical order of each column though"]
["Contributing outcome","Not achieved reference","Not achieved - At least one of the following statements is true","Partially achieved reference","Partially achieved - All of the following statements are true","Achieved reference","Achieved - All of the following statements are true"]
["A1.a Board direction ","NA#1","The security and governance of information, systems and networks related to the operation of essential functions is not discussed or reported on regularly at board-level.",null,null,"A#1","Your organisation's approach and policy relating to the security and governance of information, systems and networks supporting the operation of your essential function(s) are owned and managed at board level. These are communicated, in a meaningful way, to risk management decision-makers across the organisation."]
["A1.a Board direction ","NA#2","Board-level discussions on the security and governance of information, systems and networks are based on partial or out-of-date information, without the benefit of expert guidance.",null,null,"A#2","Regular board discussions on the security and governance of information, systems and networks supporting the operation of your essential function(s) take place, based on timely and accurate information and informed by expert guidance."]
["A1.a Board direction ","NA#3","The security and governance of information, systems and networks supporting your essential functions are not driven effectively by the direction set at board level.",null,null,"A#3","There are board-level individuals who have overall accountability for the security and governance of information, systems and networks (these may be the same person), who drive regular discussion at board level."]
["A1.a Board direction","NA#4","Senior management or other pockets of the organisation consider themselves exempt from some policies or expect special accommodations to be made.",null,null,"A#4","Direction set at board level is translated into effective organisational practices that direct and control the security and governance of information, systems and networks supporting your essential function(s)."]
["A1.a Board direction",{"$nulls":4},"A#5","The board has the information and understanding needed in-order to effectively discuss how the security, resilience and governance of information, systems and networks contribute to the delivery of essential function(s) and what the potential impact from compromise of the organisation’s information or systems would be."]
["A1.a Board direction",{"$nulls":4},"A#6","Information assurance is recognised as an important enabler for the resilience of your essential function(s) and considered in all relevant discussions."]
["A1.b Roles and responsibilities","NA#1","Key roles are missing, left vacant, or fulfilled on an ad hoc or informal basis.",null,null,"A#1","Key roles and responsibilities for the security and governance of information, systems and networks supporting your essential function(s) have been identified. These are reviewed regularly to ensure they remain fit for purpose. "]
["A1.b Roles and responsibilities","NA#2","Staff are assigned security or information governance responsibilities but without adequate authority or resources to fulfil them.",null,null,"A#2","Appropriately capable and knowledgeable staff fill those roles and are given the time, authority, and resources to carry out their duties."]
["A1.b Roles and responsibilities","NA#3","Staff are unsure what their responsibilities are for the security and governance of the essential function(s).",null,null,"A#3","There is clarity on who in your organisation has overall accountability for the security and governance of information, systems and networks supporting your essential function(s)."]
["A1.b Roles and responsibilities","NA#4","Not all staff contracts clearly set out their responsibilities for the security and governance of information, systems and networks.",null,null,"A#4","All staff contracts contain clear clauses confirming their responsibilities for the security and governance of information, systems and networks."]
["A1.c Decision-making ","NA#1","What should be relatively straightforward risk decisions are constantly referred up the chain, or not made.",null,null,"A#1","Senior management have visibility of key risk decisions made throughout the organisation."]
["A1.c Decision-making ","NA#2","Risks are resolved informally (or ignored) at a local level when the use of a more formal risk reporting mechanism would be more appropriate.",null,null,"A#2","Risk management decision-makers understand their responsibilities for making effective and timely decisions in the context of the risk appetite regarding the essential function(s), as set by senior management."]
["A1.c Decision-making ","NA#3","Decision-makers are unsure of what senior management's risk appetite is, or only understand it in vague terms such as 'averse' or 'cautious'.",null,null,"A#3","Risk management decision-making is delegated and escalated where necessary, across the organisation, to people who have the skills, knowledge, tools and authority they need."]
["A1.c Decision-making ","NA#4","Decision-makers are unable to justify their risk management decisions.\n",null,null,"A#4","Risk management decisions are regularly reviewed to ensure their continued relevance and validity."]
["A1.c Decision-making ","NA#5","Organisational structure causes risk decisions to be made in isolation - for example, engineering and IT do not talk to each other about risk.\n",null,null,"A#5","Risk decisions are joined up between different departments."]
["A1.c Decision-making ","NA#6","Risk priorities are too vague to make meaningful distinctions between them (such as almost all risks are rated 'medium' or 'amber')."]
["A2.a Risk management process ","NA#1","Risk assessments are not based on a clearly defined set of threat assumptions.","PA#1","Your organisational process ensures that security and wider Information Governance (IG) risks to information, systems and networks relevant to essential function(s) are identified, analysed, prioritised, and managed. This includes incorporating data protection by design and default into your process.","A#1","Your organisational process ensures that security and wider Information Governance (IG) risks to information, systems and networks relevant to essential function(s) are identified, analysed, prioritised, and managed. This includes incorporating data protection by design and default into your process."]
["A2.a Risk management process ","NA#2","Risk assessment outputs are too complex or unwieldy to be consumed by decision-makers and are not effectively communicated in a clear and timely manner.","PA#2","Your risk assessments are informed by an understanding of known and well understood threats and vulnerabilities in the systems and networks supporting your essential function(s), as well as your other data processing activities.","A#2","Your approach to risk is focused on the possibility of adverse impact to your essential function(s), leading to a detailed understanding of how such impact might arise as a consequence of possible threat actor actions and the security properties of information, systems and networks supporting your essential function(s)."]
["A2.a Risk management process ","NA#3","Risk assessments (including DPIAs) for information, systems and networks supporting your essential function(s) or high-risk processing activities are a 'one-off' activity (or not done at all).","PA#3","The output from your risk management process is a clear set of security and IG requirements and mitigations that will address the risks in line with your organisational approach to security and IG more widely.","A#3","Your risk assessments are based on a clearly understood set of threat assumptions, informed by an up-to-date understanding of  threats to information, systems and networks supporting your essential function(s),  your sector and wider national infrastructure."]
["A2.a Risk management process ","NA#4","The security and IG elements of projects or programmes are solely dependent on the completion of a risk management assessment without any regard to the outcomes.","PA#4","Significant conclusions reached in the course of your risk management process are communicated to key decision-makers and accountable individuals.","A#4","Your risk assessments are informed by an understanding of the information and vulnerabilities in the systems and networks supporting your essential function(s), as well as a good understanding of your data processing activities in all areas of your organisation. This includes evaluation of repeated or significant near misses."]
["A2.a Risk management process ","NA#5","There is no systematic process in place to identify risks, and then ensure that identified risks are managed effectively, which includes incorporating data protection by design and default.","PA#5","You conduct risk assessments (including DPIAs) when significant events potentially affect the essential function(s), such as replacing a system, introducing new or emergent technologies, commencing new or changing high-risk data processing, or a change in the cyber security threat.","A#5","The output from your risk management process is a clear set of traceable and prioritised security requirements that will address the risks in line with your organisational approach to security and IG more widely."]
["A2.a Risk management process ","NA#6","Systems and risks are assessed in isolation, without consideration of dependencies and interactions with other systems or risks in other areas of the business. For example interactions between IT and operational technology environments, or finance risks and the impact on information governance.","PA#6","Your risk process clearly demonstrates how your organisation’s processing complies with data protection principles and relevant legislation, including the right to a private life.","A#6","Significant conclusions reached in the course of your risk management process are communicated to key decision-makers and accountable individuals."]
["A2.a Risk management process ","NA#7","Security and information governance requirements and mitigations are arbitrary or are applied from a control catalogue without consideration of how they contribute to the security and governance of information, systems and networks supporting your  essential function(s).",null,null,"A#7","Your risk assessments (including DPIAs) are dynamic and readily updated in the light of relevant changes which may include technical changes to systems and networks supporting your essential function(s), change of use, or processing, the introduction of new emergent technologies, or new threat information."]
["A2.a Risk management process ","NA#8","Risks remain unresolved on a register for prolonged periods of time awaiting senior decision-making or resource allocation to resolve. These risks may be out of date or incomplete.",null,null,"A#8","The effectiveness of your information and security risk management process is reviewed regularly, and improvements made as required."]
["A2.a Risk management process ",{"$nulls":4},"A#9","You anticipate technological developments that could be used to adversely impact information, systems and networks supporting your essential function(s)."]
["A2.a Risk management process ",{"$nulls":4},"A#10","Your risk process clearly demonstrates how your organisation’s processing complies with data protection principles and relevant legislation, including the right to a private life."]
["A2.b Understanding Threat","NA#1","You are unable to perform threat analysis. ","PA#1","You perform threat analysis and understand how common threats apply to information, systems and networks supporting your essential function(s).","A#1","You perform detailed threat analysis and understand how this applies to  your essential function(s), in the context of your sector and wider national infrastructure. "]
["A2.b Understanding Threat","NA#2","You do not understand the threats to information, systems and networks supporting your essential function(s). ","PA#2","You understand common types of cyber attacks, including the methods and techniques, and how these might apply to  information, systems and networks supporting your essential function(s). This understanding is kept up to date.\n\n \n\n","A#2","Your detailed understanding of threat includes the methods and techniques available to capable and well resourced threat actors and how they could be used systematically against your essential function(s). "]
["A2.b Understanding Threat","NA#3","You do not have a clearly defined set of threat assumptions. ","PA#3","You anticipate what threat actors might target in information, systems and networks to cause an adverse impact to your essential function(s). \n\n \n\n","A#3","You use appropriate techniques to develop an understanding of information, systems and networks supporting your essential function(s) from a threat actor’s perspective. You anticipate probable attack methods and techniques, targets and objectives, and develop plausible scenarios."]
["A2.b Understanding Threat","NA#4","You do not use your understanding of threat to inform your risk management decisions.","PA#4","Your understanding of threat is informed by common incidents.\n\n \n\n","A#4","You understand the different steps a capable and well-resourced threat actor would need to take to reach the probable target(s). \n"]
["A2.b Understanding Threat",null,null,"PA#5","You apply your understanding of threat to inform your risk management decision-making. ","A#5","You identify and justify what measures can be used at each step to reduce the likelihood of the threat actor reaching the probable target(s) or achieving their objective(s).\n"]
["A2.b Understanding Threat",{"$nulls":4},"A#6","You maintain a detailed understanding of current threats (for example by threat intelligence and proactive research).\n"]
["A2.b Understanding Threat",{"$nulls":4},"A#7","You apply your detailed understanding of threat to inform your risk management decision making."]
["A2.b Understanding Threat",{"$nulls":4},"A#8","You have documented the steps required to undertake detailed threat analysis."]
["A2.c Assurance","NA#1","A particular product or service is seen as a 'silver bullet' and vendor claims are taken at face value.",null,null,"A#1","You validate that the security and governance measures in place to protect information, systems and networks are effective and remain effective for the lifetime over which they are needed."]
["A2.c Assurance","NA#2","Assurance methods are applied without appreciation of their strengths \nand limitations.",null,null,"A#2","You understand the assurance methods available to you and choose appropriate methods to gain confidence in the security and governance of information, systems and networks. "]
["A2.c Assurance","NA#3","Assurance is assumed because there have been no known problems to date.",null,null,"A#3","Your confidence in the security and governance of your technology, people, and processes can be justified to, and verified by, a third party. "]
["A2.c Assurance",{"$nulls":4},"A#4","Security and governance deficiencies uncovered by assurance activities are assessed, prioritised and remedied when necessary in a timely and effective way."]
["A2.c Assurance",{"$nulls":4},"A#5","The methods used for assurance are reviewed to ensure they are working as intended and remain the most appropriate method to use."]
["A3.a Asset management","NA#1","Inventories of assets relevant to your essential function(s) are incomplete, non-existent, or inadequately detailed.",null,null,"A#1","All assets relevant to information and the secure operation of your essential function(s) are identified and inventoried (at a suitable level of detail). The inventory is kept up-to-date."]
["A3.a Asset management","NA#2","Only certain domains or types of asset are documented and understood. Dependencies between assets are not understood (such as the dependencies between IT and operational technology).",null,null,"A#2","Dependencies on supporting infrastructure (such as power, cooling etc) are recognised and recorded."]
["A3.a Asset management","NA#3","Information assets, which could include personally identifiable information and/or important/critical data, are stored for long periods of time with no clear business need or retention policy.",null,null,"A#3","You have prioritised your assets according to their importance to the operation of your essential function(s)."]
["A3.a Asset management","NA#4","Knowledge critical to the management, operation, or recovery of information, systems and networks is held by one or two key individuals with no succession plan.",null,null,"A#4","You have assigned responsibility for managing all assets, including physical assets, relevant to the operation of your essential function(s)."]
["A3.a Asset management","NA#5","Asset inventories are neglected and out of date.",null,null,"A#5","Assets relevant to your essential function(s) are managed with cyber security in mind throughout their lifecycle, from creation through to eventual decommissioning or disposal."]
["A3.a Asset management","NA#6","Information asset owners and information asset administrators have not been appointed."]
["A4.a Supply chain","NA#1","You do not know what data belonging to you is held by suppliers, or how it is managed.","PA#1","You understand the general risks suppliers may pose to your essential function(s).","A#1","You have a deep understanding of your supply chain, including sub-contractors and the wider risks it faces."]
["A4.a Supply chain","NA#2","Elements of the supply chain for your essential function(s) are subcontracted and you have little or no visibility of the sub-contractors.","PA#2","You know the extent of your supply chain that supports your essential function(s), including sub-contractors.","A#2","You consider factors such as information governance considerations, due diligence, your supplier’s ownership, nationality, partnerships, competitors, other organisations with which they sub-contract and their approach to cyber security. These factors inform your risk assessment and are fully considered in your procurement lifecycle processes and purchasing decisions. \n"]
["A4.a Supply chain","NA#3","You have no understanding of which contracts are relevant and/or relevant contracts do not specify appropriate security or information governance obligations.\n","PA#3","Suppliers that support your essential function(s) can demonstrate appropriate and proportionate levels of cyber security within the context of common threats.","A#3","Your approach to supply chain risk management considers the risks to  your essential function(s) arising from supply chain subversion by capable and well-resourced threat actors."]
["A4.a Supply chain","NA#4","Suppliers have access to information, systems and networks that is unrestricted, not monitored or bypasses your own security controls.","PA#4","You understand which contracts are relevant and you include appropriate security and information governance obligations.\n","A#4","Critical suppliers supporting your essential functions(s) can demonstrate appropriate and proportionate levels of cyber security within the context of capable and well-resourced threat actors.\n"]
["A4.a Supply chain","NA#5","Information governance is not factored into the procurement process. \n","PA#5","You are aware of all third-party connections and have assurance that they meet your organisation’s security and IG requirements.","A#5","You have confidence that information held by suppliers that is essential to the operation of your essential function(s) is appropriately protected from capable and well-resourced threat actors.\n"]
["A4.a Supply chain","NA#6","You are not sure if any data shared with suppliers leaves the UK, or if all international data transfers are covered by a legal protection.","PA#6","Your approach to security and data protection incident management considers incidents that might arise in your supply chain.","A#6","You understand which contracts are relevant and you include appropriate security and information governance obligations."]
["A4.a Supply chain",null,null,"PA#7","You have confidence that information shared with suppliers that is necessary for the operation of your essential function(s) is appropriately protected from well-known attacks and known vulnerabilities.","A#7","You have a proactive approach to contract management which may include a contract management plan for relevant contracts."]
["A4.a Supply chain",null,null,"PA#8","All international data transfers to suppliers are covered by a legal protection.","A#8","Customer / supplier ownership of responsibilities is defined in contracts. "]
["A4.a Supply chain",{"$nulls":4},"A#9","All network connections and data sharing with third parties are managed effectively and proportionately."]
["A4.a Supply chain",{"$nulls":4},"A#10","When appropriate, your incident management process and that of your suppliers provide mutual support in the resolution of incidents."]
["A4.a Supply chain",{"$nulls":4},"A#11","All international data transfers to suppliers are covered by a legal protection."]
["A4.b Secure software development and support ","NA#1","Your software supplier(s) is unaware of the composition and provenance of software provided to you.\n","PA#1","Your software supplier leverages secure development principles and practices.\n","A#1","Your software supplier(s) leverages an established secure software \ndevelopment framework (for example NIST Secure Software Development Framework (SSDF), Microsoft Secure Development Lifecycle (SDL)).\n"]
["A4.b Secure software development and support ","NA#2","Software, including updates and patches, undergoes little to no testing.","PA#2","Your software supplier(s) can demonstrate a limited understanding of the composition and provenance of software provided to you.\n","A#2","Your software supplier can demonstrate a thorough understanding of the composition and provenance of software provided to you, including any third-party components used in the development of that software, and those components are being monitored for new vulnerabilities throughout the lifespan of the product."]
["A4.b Secure software development and support ","NA#3","Updates and patches often introduce new problems or fail to address existing issues.\n","PA#3","You consider the security of environments (such as development, test and production), including source code and repositories, used in the production of software to be appropriate and proportionate within the context of common threats.","A#3","You consider the security of environments (including, development, test, and production), including source code and repositories, used in the production of software to be appropriate and proportionate within the context of capable and well-resourced threat actors.\n"]
["A4.b Secure software development and support ","NA#4","Vulnerabilities are discovered in software despite the negligible difficulty of implementing mitigations.","PA#4","The testing regime uses a range of different approaches (e.g. static and dynamic analysis, unit and integration testing and point in time assessments) that verify all aspects of the development lifecycle covering both functional and non-functional testing. \n","A#4","The software development lifecycle is informed by a detailed and up to date understanding of threat and applies appropriate techniques, such as threat modelling, to identify and assess potential vulnerabilities and attack vectors. \n"]
["A4.b Secure software development and support ",null,null,"PA#5","You have arrangements in place with your software supplier to receive timely security updates, patches and notifications.\n","A#5","You can attest to the authenticity and integrity of software, including updates and patches."]
["A4.b Secure software development and support ",null,null,"PA#6","Software, including updates and patches, is obtained from your supplier(s) via secure channels. "]
["A4.b Secure software development and support ",null,null,"PA#7","Your software supplier(s) has processes in place to identify, report and mitigate security vulnerabilities."]
["A4.b Secure software development and support ",null,null,"PA#8","You have arrangements in place with your software supplier to be notified of any significant events that may adversely impact your essential function(s). "]
["A4.b Secure software development and support ",null,null,"PA#9","If open-source software is used, you have taken appropriate and proportionate steps to establish and maintain sufficient confidence in its security for its use."]
["A4.b Secure software development and support ",null,null,"PA#10","You have appropriate support and maintenance arrangements in place."]
["B1.a Policy, process and procedure development","NA#1","Your policies, processes and procedures are absent or incomplete.","PA#1","Your policies, processes and procedures document your overarching security governance and risk management approach, technical security practice and specific regulatory compliance.","A#1","You fully document your overarching security governance and risk management approach, technical security practice and specific regulatory compliance."]
["B1.a Policy, process and procedure development","NA#2","Policies, processes and procedures are not applied universally or consistently.","PA#2","You review and update policies, processes and procedures in response to major cyber security incidents and data breaches.","A#2","Information assurance principles are integrated and embedded throughout these policies, processes and procedures and key performance indicators are reported to your executive management."]
["B1.a Policy, process and procedure development","NA#3","People often or routinely circumvent policies, processes and procedures to achieve business objectives.","PA#3","Your IG policies, processes and procedures are aligned with national policies and legal frameworks.","A#3","Your organisation’s policies, processes and procedures are developed to be practical, usable and appropriate to mitigate the risk of adverse impact to your essential function(s)."]
["B1.a Policy, process and procedure development","NA#4","Your organisation’s security governance and risk management approach has no bearing on your policies, processes and procedures.",null,null,"A#4","Policies, processes and procedures that rely on user behaviour are practical, appropriate and achievable."]
["B1.a Policy, process and procedure development","NA#5","System security is totally reliant on users' careful and consistent application of manual security processes.",null,null,"A#5","You review and update policies, processes and procedures at suitably regular intervals to ensure they remain relevant. This is in addition to reviews following a major cyber security incident or data breach."]
["B1.a Policy, process and procedure development","NA#6","Policies, processes and procedures have not been reviewed in response to major changes (such as technology or regulatory framework), or within a suitable period.",null,null,"A#6","Any changes to the essential function(s) or the threat it faces triggers a review of policies, processes and procedures."]
["B1.a Policy, process and procedure development","NA#7","Policies, processes and procedures are not readily available to staff, too detailed to remember, or too hard to understand.",null,null,"A#7","Your systems are designed so that they remain secure even when user security policies, processes and procedures are not always followed."]
["B1.a Policy, process and procedure development","NA#8","Your IG policies, processes and procedures are not aligned with national policies and legal frameworks.",null,null,"A#8","Your IG policies, processes and procedures are aligned with national policies and legal frameworks."]
["B1.b Policy, process and procedure implementation","NA#1","Policies, processes and procedures are ignored or only partially followed.","PA#1","Most of your policies, processes and procedures are followed and their application is monitored.","A#1","All your policies, processes and procedures are followed, their correct application and effectiveness is evaluated."]
["B1.b Policy, process and procedure implementation","NA#2","How your policies, processes and procedures support the resilience of your essential function(s) is not well understood.","PA#2","Your policies, processes and procedures are integrated with other organisational policies, processes and procedures, including HR assessments of individuals' trustworthiness.","A#2","Your policies, processes and procedures are integrated with other organisational policies, processes and procedures, including HR assessments of individuals' trustworthiness."]
["B1.b Policy, process and procedure implementation","NA#3","Staff are unaware of their responsibilities under your policies, processes and procedures.","PA#3","All staff are aware of their responsibilities under your policies, processes and procedures.","A#3","Your policies, processes and procedures are effectively and appropriately communicated across all levels of the organisation resulting in good staff awareness of their responsibilities."]
["B1.b Policy, process and procedure implementation","NA#4","You do not attempt to detect breaches of policies, processes and procedures.","PA#4","All breaches of policies, processes and procedures with the potential to adversely impact the essential function(s) are fully investigated. Other breaches are tracked, assessed for trends and action is taken to understand and address.","A#4","Appropriate action is taken to address all breaches of policies, processes and procedures with potential to adversely impact the essential function(s) including aggregated breaches."]
["B1.b Policy, process and procedure implementation","NA#5","Policies, processes and procedures lack integration with other organisational policies, processes and procedures."]
["B1.b Policy, process and procedure implementation","NA#6","Your policies, processes and procedures are not well communicated across your organisation."]
["B2.a Identity verification, authentication and authorisation","NA#1","Initial identity verification is not robust enough to provide an acceptable level of confidence of a users' identity profile.","PA#1","Your process of initial identity verification is robust enough to provide a reasonable level of confidence of a user’s identity profile before allowing an authorised user access to information, systems and networks that support your essential function(s).","A#1","Your process of initial identity verification is robust enough to provide a high level of confidence of a user’s identity profile before allowing an authorised user access to information, systems and networks that support your essential function(s)."]
["B2.a Identity verification, authentication and authorisation","NA#2","Authorised users and systems with access to information, systems and networks on which your essential function(s) depends cannot be individually identified.","PA#2","All authorised users and systems with access to information, systems and networks supporting your essential function(s) are individually identified and authenticated.","A#2","Only authorised and individually authenticated users can physically access information and logically connect to your information, systems and networks on which your essential function(s) depends."]
["B2.a Identity verification, authentication and authorisation","NA#3","Unauthorised individuals or devices can access information or networks on which your essential function(s) depends.","PA#3","The number of authorised users and systems that have access to  information, systems and networks is limited to the minimum necessary.","A#3","The number of authorised users and systems that have access to   information, systems and networks is limited to the minimum necessary."]
["B2.a Identity verification, authentication and authorisation","NA#4","The number of authorised users and systems that have access to your information, systems and networks is not limited to the minimum necessary.","PA#4","You use additional strong authentication mechanisms, such as multi-factor authentication (MFA), for privileged access to all information, systems and networks that operate or support your essential function(s).","A#4","You use additional strong authentication mechanisms, such as multi-factor authentication (MFA), for all user access, including remote access, to all information, systems and networks that operate or support your essential function(s)."]
["B2.a Identity verification, authentication and authorisation","NA#5","Your approach to authenticating users, devices and systems does not follow up to date best practice.","PA#5","You individually authenticate and authorise all remote access to all information, systems and networks that support your essential function(s).","A#5","The list of users and systems with access to information, systems and networks supporting and delivering the essential function(s) is reviewed on a regular basis, at least every six months."]
["B2.a Identity verification, authentication and authorisation",null,null,"PA#6","The list of users and systems with access to information, systems and networks supporting and delivering the essential function(s) is reviewed on a regular basis, at least annually.","A#6","Your approach to authenticating users, devices and systems follows up to date best practice."]
["B2.a Identity verification, authentication and authorisation",null,null,"PA#7","Your approach to authenticating users, devices and systems follows up to date best practice."]
["B2.b Device management","NA#1","Users can connect to network and information systems supporting your essential function(s) using devices that are not corporately owned and managed.","PA#1","Only corporately owned and managed devices can access your essential function(s)'s network and information systems.","A#1","All privileged operations performed on network and information systems supporting your essential function(s) are conducted from highly trusted devices, such as Privileged Access Workstations, dedicated solely to those operations."]
["B2.b Device management","NA#2","Privileged users can perform privileged operations from devices that are not corporately owned and managed.","PA#2","All privileged operations are performed from corporately owned and managed devices. These devices provide sufficient separation, using a risk-based approach, from the activities of standard users.","A#2","You either obtain independent and professional assurance of the security of third-party devices or networks before they connect to your network and information systems, or you only allow third-party devices or networks that are dedicated to supporting network and information systems to connect."]
["B2.b Device management","NA#3","You have not gained assurance in the security of any third-party devices or networks connected to your systems.","PA#3","You have sought to understand the security properties of third-party devices and networks before they can be connected to your systems. You have taken appropriate steps to mitigate any risks identified.","A#3","You perform certificate-based device identity management and only allow known devices to access systems necessary for the operation of your essential function(s)."]
["B2.b Device management","NA#4","Physically connecting a device to network and information systems gives that device access without device or user authentication.","PA#4","The act of connecting to a network port or cable does not grant access to any systems.","A#4","You perform regular scans to detect unknown devices and investigate any findings."]
["B2.b Device management",null,null,"PA#5","You are able to detect unknown devices being connected to network and information systems and investigate such incidents."]
["B2.c Privileged user management","NA#1","The identities of the individuals with privileged access to network and information systems (infrastructure, platforms, software, configuration, etc) supporting your essential function(s) are not known or not managed.","PA#1","All privileged user access to network and information systems supporting your essential function(s) requires strong authentication, such as multi-factor authentication (MFA).","A#1","Privileged user access to network and information systems supporting your essential function(s) is carried out from dedicated separate accounts that are closely monitored and managed."]
["B2.c Privileged user management","NA#2","Privileged user access to network and information systems supporting your essential function(s) is via weak authentication mechanisms (for example the use of simple passwords only).","PA#2","The identities of the individuals with privileged access to network and information systems (infrastructure, platforms, software, configuration etc) supporting your essential function(s) are known and managed. This includes third parties.","A#2","The issuing of temporary, time-bound rights for privileged user access and/or external third-party support access is in place."]
["B2.c Privileged user management","NA#3","The list of privileged users has not been reviewed recently (for example  within the last 12 months).","PA#3","Activity by privileged users is routinely reviewed and validated (for example at least annually).","A#3","Privileged user access rights are regularly reviewed and always updated as part of your joiners, movers and leavers process."]
["B2.c Privileged user management","NA#4","Privileged user access is granted on a system-wide basis rather than by role or function.","PA#4","Privileged users are only granted specific privileged user access rights which are essential to their business role or function.","A#4","All privileged user activity is routinely reviewed, validated and recorded for offline analysis and investigation."]
["B2.c Privileged user management","NA#5","Privileged user access to network and information systems supporting your essential function(s) is via generic, shared or default name accounts."]
["B2.c Privileged user management","NA#6","Where there are “always on” terminals which can perform privileged actions (such as in a control room), there are no additional controls (for example physical controls) to ensure access is appropriately restricted. "]
["B2.c Privileged user management","NA#7","There is no logical separation between roles that an individual may have and hence the actions they perform (for example access to corporate email and privileged user actions)."]
["B2.d Identity and access management (IdAM)","NA#1","Greater access rights are granted than necessary.","PA#1","You follow a robust procedure to verify each user and issue the minimum required access rights.","A#1","You follow a robust procedure to verify each user and issue the minimum required access rights, and the application of the procedure is regularly audited."]
["B2.d Identity and access management (IdAM)","NA#2","Identity validation and requirement for access of a user, device or systems is not carried out.","PA#2","You regularly review access rights and those no longer needed are revoked.","A#2","User access rights are reviewed both when people change roles via your joiners, leavers and movers process and at regular intervals - at least annually."]
["B2.d Identity and access management (IdAM)","NA#3","User access rights are not reviewed when users change roles.","PA#3","User access rights are reviewed when users change roles via your joiners, leavers and movers process.","A#3","All user, device and systems access to network and information systems supporting the essential function(s) is logged and monitored."]
["B2.d Identity and access management (IdAM)","NA#4","User access rights remain active when users leave your organisation.\n","PA#4","All user, device and system access to the systems supporting the essential function(s) is logged and monitored, but it is not compared to other log data or access records.","A#4","You regularly review access logs and correlate this data with other access records and expected activity."]
["B2.d Identity and access management (IdAM)","NA#5","Access rights granted to devices or systems to access other devices and systems are not reviewed on a regular basis (at least annually).","PA#5","When issues are raised about staff not having appropriate access to information, these are resolved without undue delay.","A#5","Attempts by unauthorised users, devices or systems to connect to network and information systems supporting your essential function(s) are alerted, promptly assessed and investigated."]
["B2.d Identity and access management (IdAM)","NA#6","When issues are raised about staff not having appropriate access to information, these are not promptly resolved.",null,null,"A#6","When issues are raised about staff not having appropriate access to information, these are resolved without undue delay."]
["B3.a Understanding data","NA#1","You have incomplete knowledge of what data is used by and produced in the operation of your essential function(s).","PA#1","You have identified and catalogued all the data important to the operation of your essential function(s) or that would assist a threat actor. This includes maintaining a record of processing activities (ROPA) and an information asset register (IAR) which are updated whenever significant changes occur.","A#1","You have identified and catalogued all the data important to the operation of your essential function(s), or that would assist a threat actor. This includes maintaining a record of processing activities (ROPA) and an information asset register (IAR) which are reviewed and kept up to date.\n"]
["B3.a Understanding data","NA#2","You have not identified the important data on which your essential function(s) relies.","PA#2","You have identified and catalogued who has access to the data important to the operation of your essential function(s). ","A#2","You have identified and catalogued who has access to the data important to the operation of your essential function(s)."]
["B3.a Understanding data","NA#3","You have not identified staff members with access to data important to the operation of the essential function(s).","PA#3","You regularly review location, transmission, quantity and quality of data important to the operation of your essential function(s).","A#3","You maintain a current understanding of the location, quantity and quality of data important to the operation of your essential function(s)."]
["B3.a Understanding data","NA#4","You have not clearly articulated the impact of data compromise or unavailability.","PA#4","You have identified all mobile devices and media that hold data important to the operation of your essential function(s).","A#4","You take steps to remove or minimise unnecessary copies or unneeded historic data."]
["B3.a Understanding data","NA#5","Your record of processing activities (ROPA) or information asset register (IAR) or registers are incomplete or out of date.","PA#5","You understand and document the impact on your essential function(s) of all relevant scenarios, including unauthorised data access, uncontrolled release, modification or deletion, or when authorised users are unable to appropriately access this data.","A#5","You have identified all mobile devices and media that may hold data important to the operation of your essential function(s)."]
["B3.a Understanding data","NA#6","Information asset owners and information asset administrators have not been appointed.","PA#6","You occasionally validate these documented impact statements.","A#6","You maintain a current understanding of the data links used to transmit data that is important to your essential function(s)."]
["B3.a Understanding data",null,null,"PA#7","You have appointed information asset owners and information asset administrators.","A#7","You understand the context, limitations and dependencies of your important data."]
["B3.a Understanding data",{"$nulls":4},"A#8","You understand and document the impact on your essential function(s) of all relevant scenarios, including unauthorised data access, uncontrolled release, modification or deletion, or when authorised users are unable to appropriately access this data."]
["B3.a Understanding data",{"$nulls":4},"A#9","You validate these documented impact statements regularly, at least annually."]
["B3.b Data in transit ","NA#1","You do not know what all your data links are, or which carry data important to the operation of the essential function(s).","PA#1","You have identified and protected (effectively and proportionately) all the data links that carry data important to the operation of your essential function(s).","A#1","You have identified and protected (effectively and proportionately) all the data links that carry data important to the operation of your essential function(s)."]
["B3.b Data in transit","NA#2","Data and physical information important to the operation of the essential function(s) travels without appropriate protection over non-trusted or openly accessible carriers or delivery services.\n","PA#2","You apply appropriate physical and/or technical means (such as cryptography) to protect information that travels over non-trusted or openly accessible carriers or delivery services, but you have limited or no confidence in the robustness of the protection applied.","A#2","You apply appropriate physical and/or technical means (such as cryptography) to protect information that travels over non-trusted or openly accessible carriers or delivery services, with justified confidence in the robustness of the protection applied."]
["B3.b Data in transit","NA#3","Critical data paths that could fail, be jammed, be overloaded, etc. have no alternative path.",null,null,"A#3","Suitable alternative transmission paths are available where there is a significant risk of impact on the operation of the essential function(s) due to resource limitation (for example transmission equipment or function failure, or important data being blocked or jammed)."]
["B3.c Stored data","NA#1","You have no, or limited, knowledge of where data important to the operation of your essential function(s) is stored.","PA#1","All copies of data important to the operation of your essential function(s) are necessary. Where this important data is transferred to less secure systems, the data is provided with limited detail and/or as a read-only copy.","A#1","All copies of data important to the operation of your essential function(s) are necessary. Where this important data is transferred to less secure systems, the data is provided with limited detail and/or as a read-only copy."]
["B3.c Stored data","NA#2","You have not protected vulnerable stored data important to the operation of your essential function(s) in a suitable way.","PA#2","You have applied suitable physical and/or technical means to protect this important stored data from unauthorised access, modification or deletion.","A#2","You have applied suitable physical and/or technical means to protect this important stored data from unauthorised access, modification or deletion."]
["B3.c Stored data","NA#3","Backups are incomplete, untested, not adequately secured or could be inaccessible in a disaster recovery or business continuity situation.","PA#3","If cryptographic protections are used, you apply suitable technical and procedural means, but you have limited or no confidence in the robustness of the protection applied.","A#3","If cryptographic protections are used you apply suitable technical and procedural means, and you have justified confidence in the robustness of the protection applied."]
["B3.c Stored data",null,null,"PA#4","You have suitable, secured backups of data to allow the operation of your essential function(s) to continue should the original data not be available. This may include off-line or segregated backups, or appropriate alternative forms such as paper copies.","A#4","You have suitable, secured backups of data to allow the operation of your essential function(s) to continue should the original data not be available. This may include off-line or segregated backups, or appropriate alternative forms such as paper copies."]
["B3.c Stored data",{"$nulls":4},"A#5","Necessary historic or archive data is suitably secured in storage, which may include off-site archives."]
["B3.d Mobile data","NA#1","You don’t know which mobile devices may hold data important to the operation of your essential function(s).","PA#1","You know which mobile devices hold data important to the operation of your essential function(s).","A#1","Mobile devices that hold data that is important to the operation of your essential function(s) are catalogued, are under your organisation's control and configured according to best practice for the platform, with appropriate technical and procedural policies in place."]
["B3.d Mobile data","NA#2","You allow data important to the operation of your essential function(s) to be stored on devices not managed by your organisation, or to at least equivalent standard.","PA#2","Data important to the operation of your essential function(s) is stored on mobile devices only when they have at least the security standard aligned to your overarching security policies. ","A#2","Your organisation can remotely wipe all mobile devices holding data important to the operation of your essential function(s)."]
["B3.d Mobile data","NA#3","Data on mobile devices is not technically secured, or only some is secured.","PA#3","Data on mobile devices is technically secured.","A#3","You have minimised this data on these mobile devices. Some data may be automatically deleted off mobile devices after a certain period."]
["B3.e Media/equipment sanitisation","NA#1","Some or all devices, equipment or removable media that hold data important to the operation of your essential function(s) are reused or disposed of without sanitisation of that data.","PA#1","Data important to the operation of your essential function(s) is removed from all devices, equipment and removable media before reuse and/or disposal","A#1","You catalogue and track all devices that contain data important to the operation of your essential function(s) (whether a specific storage device or one with integral storage)."]
["B3.e Media/equipment sanitisation",{"$nulls":4},"A#2","Data important to the operation of your essential function(s) is removed from all devices, equipment or removable media before reuse and/or disposal using an assured product or service."]
["B4.a Secure by design","NA#1","Systems supporting the operation of the essential function(s) are not appropriately segregated from other systems.","PA#1","You employ appropriate expertise to design network and information systems.","A#1","You employ appropriate expertise to design network and information systems."]
["B4.a Secure by design","NA#2","Internet services, such as browsing and email, are accessible without restriction or business need from network and information systems supporting your essential function(s).","PA#2","You design strong boundary defences where network and information systems interface with other organisations or the world at large.","A#2","Network and information systems are segregated into appropriate security zones (for example systems supporting the essential function(s) are segregated in a highly trusted, more secure zone)."]
["B4.a Secure by design","NA#3","Data flows between network and information systems supporting your essential function(s) and other systems are complex, making it hard to discriminate between legitimate and illegitimate/malicious traffic.","PA#3","You design simple data flows between network and information systems and any external interface to enable effective monitoring.","A#3","The networks and information systems supporting your essential function(s) are designed to have simple data flows between components to support effective security monitoring."]
["B4.a Secure by design","NA#4","Remote or third-party accesses circumvent some network controls to gain more direct access to network and information systems supporting the essential function(s).","PA#4","You design to make network and information system recovery simple.","A#4","The networks and information systems supporting your essential function(s) are designed to be easy to recover."]
["B4.a Secure by design",null,null,"PA#5","All inputs to network and information systems supporting your essential function(s) are checked and validated at the network boundary where possible, or additional monitoring is in place for content-based attacks.","A#5","Content-based attacks are mitigated for all inputs to network and information systems that affect the essential function(s) (for example via transformation and inspection / sanitisation and validation)."]
["B4.a Secure by design",{"$nulls":4},"A#6","If automated decision making technologies are in use, you design and apply appropriate restrictions to prevent actions that could have an adverse impact on network and information systems supporting your essential function(s)."]
["B4.b Secure configuration","NA#1","You have not identified the assets that need to be carefully configured to maintain the security of your essential function(s).\n","PA#1","You have identified and documented the assets that need to be carefully configured to maintain the security of your essential function(s).","A#1","You have identified, documented and actively manage the assets that need to be carefully configured to maintain the security of your essential function(s). For example: you maintain security configurations, patch, and update according to good practice."]
["B4.b Secure configuration","NA#2","Policies relating to the security of operating system builds or configuration are not applied consistently across network and information systems relating to your essential function(s).","PA#2","Secure platform and device builds are used across the estate.","A#2","All platforms conform to your secure, defined baseline build, or the latest known good configuration version for that environment."]
["B4.b Secure configuration","NA#3","Configuration details are not recorded or lack enough information to be able to rebuild the system or device.","PA#3","Consistent, secure and minimal system and device configurations are applied across the same types of environment.","A#3","You closely and effectively manage changes in your environment, ensuring that network and system configurations are secure and documented."]
["B4.b Secure configuration","NA#4","The recording of security changes or adjustments that affect your essential function(s) is lacking or inconsistent.\n","PA#4","Changes and adjustments to security configurations at security boundaries of network and information systems supporting your essential function(s) are approved and documented.\n","A#4","You regularly review and validate that network and information systems have the expected, secure settings and configuration."]
["B4.b Secure configuration","NA#5","Generic, shared, default name and built-in accounts have not been removed or disabled.","PA#5","You verify software before installation is permitted.","A#5","Only permitted software can be installed."]
["B4.b Secure configuration","NA#6","Standard users are able to change settings that would adversely impact the security of your essential function(s)","PA#6","Generic, shared, default name and built-in accounts have been removed or disabled. Where this is not possible, credentials to these accounts have been changed. Service accounts are appropriately protected.","A#6","If automated decision-making technologies are in use, their operation is well understood, and decisions can be replicated."]
["B4.b Secure configuration",null,null,"PA#7","Standard users are not able to change settings that would adversely impact the security of your essential function(s).","A#7","Generic, shared, default name and built-in accounts have been removed or disabled. Where this is not possible, credentials to these accounts have been changed. Service accounts are appropriately protected."]
["B4.c Secure management","NA#1","Your systems and devices supporting the operation of the essential function(s) are administered or maintained from devices that are not corporately owned and managed.","PA#1","Your systems and devices supporting the operation of the essential function(s) are only administered or maintained by authorised privileged users from devices sufficiently separated, using a risk-based approach, from the activities of standard users.","A#1","Your systems and devices supporting the operation of the essential function(s) are only administered or maintained by authorised privileged users from highly trusted devices, such as Privileged Access Workstations, dedicated solely to those operations."]
["B4.c Secure management","NA#2","You do not have good or current technical documentation of network and information systems.","PA#2","Technical knowledge about network and information systems, such as documentation and network diagrams, is regularly reviewed and updated.","A#2","You regularly review and update technical knowledge about network and information systems, such as documentation and network diagrams, and ensure they are securely stored."]
["B4.c Secure management",null,null,"PA#3","You prevent, detect and remove malware and unauthorised software. You use technical, procedural and physical measures as necessary.","A#3","You prevent, detect and remove malware and unauthorised software. You use technical, procedural and physical measures as necessary."]
["B4.d Vulnerability management","NA#1","You do not understand the exposure of your essential function(s) to publicly-known vulnerabilities.","PA#1","You maintain a current understanding of the exposure of network and information systems supporting your essential function(s) to publicly-known vulnerabilities.","A#1","You maintain a current understanding of the exposure of network and information systems supporting your essential function(s) to publicly known vulnerabilities."]
["B4.d Vulnerability management","NA#2","You do not mitigate externally exposed vulnerabilities promptly.","PA#2","Announced vulnerabilities for all software packages used in network and information systems supporting your essential function(s) are tracked, prioritised and externally exposed vulnerabilities are mitigated promptly (such as by patching).\n","A#2","Announced vulnerabilities for all software packages used in network and information systems supporting your essential function(s) are tracked, prioritised and mitigated promptly (such as by patching).\n"]
["B4.d Vulnerability management","NA#3","You have not recently tested to verify your understanding of the vulnerabilities of network and information systems that support your essential function(s).","PA#3","Some vulnerabilities that are not externally exposed have temporary mitigations for an extended period.","A#3","You regularly test to fully understand the vulnerabilities of network and information systems that support the operation of your essential function(s) and verify this understanding with third-party testing."]
["B4.d Vulnerability management","NA#4","You have not suitably mitigated systems or software that is no longer supported.","PA#4","You have temporary mitigations for unsupported systems and software while pursuing migration to supported technology.","A#4","You actively maximise the use of supported software, firmware and hardware in network and information systems supporting your essential function(s)."]
["B4.d Vulnerability management","NA#5","You are not pursuing replacement for unsupported systems or software.","PA#5","You regularly test to fully understand the vulnerabilities of network and information systems that support the operation of your essential function(s)."]
["B5.a Resilience preparation","NA#1","You have limited understanding of all the elements that are required to restore operation of your essential function(s).\n","PA#1","You know all network and information systems, and underlying technologies, that are necessary to restore the operation of your essential function(s) and understand their interdependence.\n","A#1","You have business continuity and disaster recovery plans that have been tested for practicality, effectiveness and completeness. Appropriate use is made of different test methods (such as include manual fail-over, table-top exercises, or red-teaming)."]
["B5.a Resilience preparation","NA#2","You have not completed business continuity and disaster recovery plans for network and information systems, including their dependencies, supporting the operation of the essential function(s).","PA#2","You know the order in which systems need to be recovered to efficiently and effectively restore the operation of the essential function(s).","A#2","You use your security awareness and threat intelligence sources to identify new or heightened levels of risk, which result in immediate and potentially temporary security measures to enhance the security of network and information systems supporting your essential function(s) (for example in response to a widespread outbreak of very damaging malware)."]
["B5.a Resilience preparation","NA#3","You have not fully assessed the practical implementation of your business continuity and disaster recovery plans."]
["B5.b Design for resilience","NA#1","Network and information systems supporting the operation of your essential function(s) are not appropriately segregated.","PA#1","Network and information systems supporting the operation of your essential function(s) are logically separated from your business systems (for example they reside on the same network as the rest of the organisation but within isolated zones).","A#1","Network and information systems supporting the operation of your essential function(s) are segregated from other business and external systems by appropriate technical and physical means (such as separate network and system infrastructure with independent user administration)."]
["B5.b Design for resilience","NA#2","Internet services, such as browsing and email, are accessible without restriction or business need from network and information systems supporting your essential function(s).","PA#2","Internet services, such as browsing and email, are not accessible from network and information systems supporting your essential function(s) unless there is a clear business need and with appropriate restrictions. ","A#2","Internet services, such as browsing and email, are not accessible from network and information systems supporting your essential function(s)."]
["B5.b Design for resilience","NA#3","You do not understand or lack plans to mitigate all resource limitations that could adversely affect your essential function(s).","PA#3","Resource limitations (such as network bandwidth, single network paths) have been identified but not fully mitigated.","A#3","You have identified and mitigated all resource limitations, such as bandwidth limitations and single network paths."]
["B5.b Design for resilience",{"$nulls":4},"A#4","You have identified and mitigated any geographical constraints or weaknesses. (For example, systems that your essential function(s) depends upon are replicated in another location, important network connectivity has alternative physical paths and service providers.)\n"]
["B5.b Design for resilience",{"$nulls":4},"A#5","You review and update assessments of dependencies, resource and geographical limitations and mitigations when necessary."]
["B5.c Backups","NA#1","Backup coverage is incomplete and does not include all relevant data and information needed to restore the operation of your essential function(s).","PA#1","You have appropriately secured backups (including data, configuration information, software, equipment, processes and knowledge). These backups will be accessible to recover from an extreme event including ransomware attack.\n","A#1","Your comprehensive, automatic and tested technical and procedural backups are secured at centrally accessible or secondary sites to recover from an extreme event."]
["B5.c Backups","NA#2","Backups are not frequent enough for the operation of your essential function(s) to be restored effectively.","PA#2","You routinely test backups to ensure that the backup process functions correctly and the backups are usable.","A#2","Backups of all important data and information needed to recover the essential function(s) are made, tested, documented and routinely reviewed."]
["B5.c Backups","NA#3","Your restoration process does not restore your essential function(s) in a suitable time frame."]
["B6.a Culture","NA#1","People in your organisation do not understand what they contribute to the  security and governance of information, systems and networks supporting your essential function(s).","PA#1","Your executive management understand and widely communicate the importance of a positive information assurance culture. Positive attitudes, behaviours and expectations are described for your organisation.","A#1","Your executive management clearly and effectively communicates the organisation's priorities and objectives around information assurance to all staff. Your organisation displays positive security and governance attitudes, behaviours and expectations. "]
["B6.a Culture","NA#2","People in your organisation do not know how to raise a concern about the security and governance of information, systems and networks.","PA#2","All people in your organisation understand the contribution they make to the security and governance of information, systems and networks supporting your essential function(s).","A#2","People in your organisation raising potential security incidents and issues are treated positively."]
["B6.a Culture","NA#3","People believe that reporting issues may get them into trouble.","PA#3","All individuals in your organisation know who to contact and where to access more information about information assurance. They know how to raise a security issue.","A#3","Individuals at all levels in your organisation routinely report concerns or issues about information assurance and are recognised for their contribution to keeping the organisation and its information secure."]
["B6.a Culture","NA#4","Your organisation’s approach to the security and governance of information, systems and networks is perceived by staff as hindering the business of the organisation and may encourage poor security behaviours.","PA#4","You identify and address issues that inhibit people from behaving in a manner that supports your intended information assurance outcomes.","A#4","Your management is seen to be committed to and actively involved in information assurance."]
["B6.a Culture","NA#5","Formal or informal incentives and rewards conflict with the promotion of positive information assurance outcomes.",null,null,"A#5","Your organisation communicates openly about information assurance with any concern being taken seriously."]
["B6.a Culture",{"$nulls":4},"A#6","People across your organisation collaborate in activities to improve information assurance, building joint ownership and bringing knowledge of their area of expertise."]
["B6.b Training","NA#1","There are teams who operate and support your essential function(s) that lack any information assurance training.","PA#1","You have defined appropriate information assurance training and awareness activities for all roles in your organisation, from executives to the most junior roles.","A#1","All people in your organisation, from the most senior to the most junior, follow appropriate information assurance training paths."]
["B6.b Training","NA#2","Information assurance training is restricted to specific roles in your organisation.","PA#2","You use a range of teaching and communication techniques for information assurance training and awareness to reach the widest audience effectively.","A#2","Each individual’s information assurance training is tracked and refreshed at suitable intervals."]
["B6.b Training","NA#3","Information assurance training records for your organisation are lacking or incomplete.","PA#3","Information assurance information is easily available.","A#3","You routinely evaluate your information assurance training and awareness activities to ensure they reach the widest audience and are effective."]
["B6.b Training","NA#4","Training is used as a “silver bullet” for all user security behaviours.",null,null,"A#4","You make information assurance information and good practice guidance easily accessible, widely available and you know it is referenced and used within your organisation."]
["B6.b Training","NA#5","The success of training is only measured by the number of people reached, rather than assessing whether it has a positive impact on security behaviours."]
["B6.b Training","NA#6","Training materials contain out of date or contradictory information, or information that conflicts with other policies, processes or procedures."]
["C1.a Sources and tools for logging and monitoring","NA#1","Data relating to the security and operation of network and information systems is not collected.","PA#1","Data relating to the security and operation of some areas of networks and systems is collected but coverage is not comprehensive.","A#1","Monitoring is based on a thorough understanding of your network and information systems, techniques used by threat actors, and awareness of what logging and monitoring is required to detect events and incidents that could affect the operation of your essential function(s)."]
["C1.a Sources and tools for logging and monitoring","NA#2","You are not able to audit the activities of users and systems in relation  to network and information systems.","PA#2","Some user and system monitoring is done, but not covering a fully agreed list of suspicious or undesirable behaviour.\n","A#2","Your monitoring data provides enough detail to promptly and reliably detect security events, incidents and support investigations. This is reviewed regularly and after a significant security event."]
["C1.a Sources and tools for logging and monitoring","NA#3","You do not monitor traffic crossing your network boundary.","PA#3","You monitor traffic crossing your network boundary (including IP address connections as a minimum)","A#3","Extensive monitoring of user and system activity in relation to your essential function(s) enables you to promptly detect policy violations, suspicious or undesirable user and system behaviour, deviations from normal / routine behaviour or abnormalities indicative of adverse activity.\n"]
["C1.a Sources and tools for logging and monitoring","NA#4","Log data cannot be synchronised using an accurate common time source.","PA#4","Some but not all log datasets can be easily queried with search tools to aid in investigations. ","A#4","Your logging and monitoring capability includes host-based and network monitoring.\n"]
["C1.a Sources and tools for logging and monitoring","NA#5","Logs are stored in locations where they are not readily available to authorised users and systems. \n","PA#5","Your monitoring tools work with most log data, with some configuration.","A#5","All new network and information systems are considered as potential logging and monitoring data sources to maintain a comprehensive monitoring capability.\n"]
["C1.a Sources and tools for logging and monitoring","NA#6","Your monitoring tools cannot be configured to make use of new log streams as they come online.\n","PA#6","Your monitoring tools can make use of log data that would capture all common threats.\n","A#6","Log datasets are synchronised including using an accurate common time source so that separate datasets can be correlated in appropriate ways."]
["C1.a Sources and tools for logging and monitoring","NA#7","Your monitoring tools are only able to make use of a fraction of the log data being collected. ","PA#7","You ensure log data is available for analysis when needed.","A#7","You enrich log data with other network and information systems data to provide a more comprehensive picture of actions and behaviours."]
["C1.a Sources and tools for logging and monitoring","NA#8","You do not understand where log data is stored or how long it should be stored for.\n",null,null,"A#8","Your monitoring tools make use of log data to pinpoint activity.\n"]
["C1.a Sources and tools for logging and monitoring","NA#9","You have no way of ensuring log data is being captured as expected and available when needed. ",null,null,"A#9","You regularly review the data sources and tools included in your logging and monitoring strategy to ensure it remains effective."]
["C1.b Securing logs","NA#1","It is possible for log data to be easily edited or deleted by unauthorised users / systems or attackers.\n","PA#1","Only authorised users and systems can access log data.\n","A#1","Appropriate access to log data is limited to those users and systems with a business need. \n"]
["C1.b Securing logs","NA#2","There is no control of the users and systems that can access log data.\n","PA#2","There is some monitoring of access to log data (including copying, deleting or modification, or even viewing).","A#2","The logging architecture has mechanisms to ensure that it can protect itself from threats comparable to those it is trying to identify. This includes protecting the essential function(s) itself, and the data within it."]
["C1.b Securing logs","NA#3","There is no monitoring of the access to log data.","PA#3","You have defined and implemented retention periods for log data.","A#3","Log data analysis and normalisation is only performed on copies of the log data keeping the master copy unaltered."]
["C1.b Securing logs","NA#4","There are no policies covering access to log data.",null,"You have given legitimate reasons for accessing log data in your policies. ","A#4","All actions involving log data (such as copying, deleting, modification, or even viewing) can be traced back to a unique user or system."]
["C1.b Securing logs","NA#5",null,null,null,"A#5","The integrity of log data is protected, verified and any modification, including deletion, is detected and attributed."]
["C1.b Securing logs",{"$nulls":4},"A#6"]
["C1.b Securing logs",{"$nulls":4},"A#7"]
["C1.c Generating alerts","NA#1","You do not apply updates to your detection security technologies in a timely way, after receiving them - for example antivirus signature updates, other threat signatures or Indicators of Compromise (IoCs). \n","PA#1","You easily detect the presence of Indicators of Compromise (IoCs) on network and information systems, such as known malicious command and control signatures. \n","A#1","You easily detect the presence of Indicators of Compromise (IoCs) on network and information systems, such as known malicious command and control signatures, as well as abnormalities or behaviours indicative of adverse activity."]
["C1.c Generating alerts","NA#2","Security alerts relating to network and information systems supporting your essential function(s) are not prioritised. ","PA#2","You apply some updates, new signatures and IoCs in a timely way. \n","A#2","You apply all updates, new signatures and IoCs promptly. "]
["C1.c Generating alerts","NA#3","The enrichment of security alerts within network and information systems cannot be performed.\n","PA#3","Security alerts relating to network and information systems that support your essential function(s) are prioritised. ","A#3","Security alerts relating to all networks and information systems supporting your essential function(s) are prioritised and this information is used to support incident management. "]
["C1.c Generating alerts","NA#4","You do not confidently detect the presence of IoCs on network and information systems, such as known malicious command and control signatures (for example, because applying the indicator is difficult or your log data is not sufficiently detailed).","PA#4","The enrichment of alerts within network and information systems is performed but not as part of the original alert.","A#4","Alerts are routinely enriched within network and information systems. The enrichment of these alerts is performed in almost real time and as part of the original alert. "]
["C1.c Generating alerts","NA#5","You do not monitor for user or system abnormalities indicative of adverse activity. ","PA#5","Detections and alerting rely on off the shelf tooling without customisation or users reporting events and potential incidents. \n","A#5","Alerts and the underlying detections are regularly reviewed and tested to ensure they are generated promptly and reliably, and it is possible to distinguish genuine security incidents from false alarms.\n"]
["C1.c Generating alerts","NA#6","Logs are monitored infrequently","PA#6","There is a documented and shared process for all users who support the operation of the essential function to report events and potential security incidents. \n","A#6","Alerts and the underlying detection rules are customisable and tuned to reduce false positives as well as optimising responses. "]
["C1.c Generating alerts",null,null,"PA#7","Where appropriate, detections and alerting result in automated actions being taken. (such as malware identified by anti virus is quarantined). \n","A#7","Detections and alerting may use off the shelf tooling and rules as well as custom tooling and / or rules. "]
["C1.c Generating alerts",null,null,"PA#8","You monitor on an irregular basis for user or system abnormalities indicative of adverse activity.","A#8","You continuously monitor for user and system abnormalities indicative of adverse activity generating alerts based on the results of such monitoring. \n"]
["C1.c Generating alerts",null,null,"PA#9","Logs are monitored at regular intervals. ","A#9","Logs are monitored continuously in near real time.  "]
["C1.d Triage of security alerts","NA#1","You do not triage alerts from your detection security technologies (such as antivirus and intrusion detection systems).","PA#1","You investigate and triage alerts from some security tools and take action. \n","A#1","You investigate and triage alerts from all security tools and take action.\n"]
["C1.d Triage of security alerts","NA#2","You do not categorise alerts and incidents by type and priority / severity level. ","PA#2","You have created, made available and use when appropriate, Standard Operating Procedures (SOPs) / Playbooks / Runbooks covering the most common use cases. These are regularly reviewed to ensure they remain effective.\n","A#2","You have created, made available and use when appropriate, Standard Operating Procedures (SOPs) / Playbooks / Runbooks covering all plausible use cases. These are regularly reviewed to ensure they remain effective. \n"]
["C1.d Triage of security alerts","NA#3","You do not have Standard Operating Procedures (SOPs) / Playbooks / Runbooks available for use during triage. \n","PA#3","You perform some triage and actions taken by monitoring and detection personnel are recorded.\n","A#3","You categorise alerts and incidents by type and priority / severity level. "]
["C1.d Triage of security alerts","NA#4","You do not keep records of triage performed. ","PA#4","You categorise alerts and incidents by type and priority / severity level.\n","A#4","You document all triage related activities performed by monitoring and detection personnel and these are used to drive improvements."]
["C1.d Triage of security alerts","NA#5","You do not have a sufficient understanding of normal user or system behaviour to make effective decisions within triage. ","PA#5","Your understanding of normal user or system behaviour informs your decision making within triage.","A#5","Triage provides enough information for subsequent activities to be prioritised (for example the containment of damaging malware).\n"]
["C1.d Triage of security alerts",{"$nulls":4},"A#6","Your understanding of normal user and system behaviour, and threats, is sufficient for effective decision making within triage."]
["C1.e Personnel skills for monitoring and detection","NA#1","There are no personnel who perform a monitoring and detection function.\n","PA#1","Monitoring and detection personnel have some investigative skills and a basic understanding of the data they need to work with.","A#1","You have monitoring and detection personnel who are responsible for the proactive and reactive analysis, investigation and reporting of monitoring alerts including both security and performance.\n"]
["C1.e Personnel skills for monitoring and detection","NA#2","Monitoring and detection personnel do not have the correct specialist skills.\n","PA#2","Monitoring and detection personnel can report to other parts of the organisation (such as security directors, resilience managers).","A#2","Monitoring and detection personnel have defined roles and skills that cover all parts of the monitoring and investigation process."]
["C1.e Personnel skills for monitoring and detection","NA#3","Monitoring and detection personnel are not capable of reporting against governance requirements. \n","PA#3","Monitoring and detection personnel are capable of following most of the required workflow(s).","A#3","Monitoring and detection personnel follow policies, processes and procedures that address all governance reporting requirements, internal and external.\n"]
["C1.e Personnel skills for monitoring and detection","NA#4","Monitoring and detection personnel have a lack of awareness of the essential function(s) the organisation provides, what assets relate to those functions and hence the importance of the log data and security events.","PA#4","Monitoring and detection personnel are aware of some of the network and information systems and your essential function(s), and can manage alerts relating to them.\n","A#4","Monitoring and detection personnel are empowered to look beyond the fixed process to investigate and understand non-standard threats. "]
["C1.e Personnel skills for monitoring and detection","NA#5","Monitoring and detection personnel have no awareness of other roles or tasks outside of security monitoring and detection that are relevant to the operation of your essential function(s).","PA#5","Monitoring and detection personnel have some understanding of the operational context (for example people, processes, network and information systems that support your essential function(s)) to enhance the security monitoring function.","A#5","Monitoring and detection personnel are aware of the network and information systems and your essential  function(s), related assets and can identify and prioritise alerts and investigations that relate to them."]
["C1.e Personnel skills for monitoring and detection","NA#6","Monitoring and detection personnel are overwhelmed with the amount of data and alerts they have to work with. Alert / triage fatigue is present.","PA#6","Monitoring and detection personnel deal with their workload and cases effectively.","A#6","Monitoring and detection personnel drive and shape new log data collection and can make effective use of it."]
["C1.e Personnel skills for monitoring and detection",{"$nulls":4},"A#7","Monitoring and detection personnel are capable of following all of the required workflow(s)."]
["C1.e Personnel skills for monitoring and detection",{"$nulls":4},"A#8","Monitoring and detection personnel have a sufficient understanding of the operational context (for example. people, processes, network and information systems that support your essential function) to enhance the security monitoring function."]
["C1.e Personnel skills for monitoring and detection",{"$nulls":4},"A#9","Monitoring and detection personnel deal with their workload and cases effectively as well as identifying areas for improvement."]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#1","Your organisation has no sources of threat intelligence.","PA#1","You know how effective your threat intelligence is (for example by tracking how threat intelligence helps you identify security incidents). ","A#1","You track the effectiveness of your threat intelligence and actively share feedback on the usefulness of Indicators of Compromise (IoCs) and other intelligence with the threat community (such as sector partners, threat intelligence providers, government agencies)."]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#2","You do not evaluate the usefulness of your threat intelligence or share feedback with providers or other users.","PA#2","Your organisation may use threat intelligence services, but you do not necessarily choose sources or providers specifically because of your business needs, or specific threats in your sector (examples include  sector-based infoshare, software vendors, anti-virus providers, specialist threat intel firms, special interest groups).","A#2","When using threat intelligence feeds, these have been selected using risk-based and threat informed decisions based on your business needs and sector."]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#3","You have no awareness of the steps necessary to make best use of threat intelligence for security monitoring.","PA#3","The user and system abnormalities from past attacks and threat intelligence, on your and other network and information systems, are used to signify adverse activity.","A#3","You make relevant, reliable and actionable threat intelligence available to the necessary users and systems promptly."]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#4","Threat intelligence is unreliable and / or is not actioned by the appropriate users or systems in a timely manner. ","PA#4","You receive regular updates for all of your detection security technologies (such as antivirus , intrusion detection systems). ","A#4","You contextualise threat intelligence and link it to the why and / or how attacks take place for security monitoring."]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#5","You have no established understanding of what abnormalities to look for that might signify adverse activities.",null,null,"A#5","You understand normal user and system abnormalities fully, to such an extent that searching for system abnormalities is an effective way of detecting adverse activity (for example, you fully understand which systems should and should not communicate and when)."]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#6","You do not receive updates for all your detection security technologies (such as antivirus and intrusion detection systems)",null,null,"A#6","The user and system abnormalities you monitor for are based on the nature of adverse activities likely to impact network and information systems supporting the operation of your essential function(s). "]
["C1.f Understanding user and system behaviour, and threat intelligence ","NA#7","You do not understand normal user and system behaviour sufficiently to be able to use abnormalities to detect adverse activity. ",null,null,"A#7","The user and system abnormalities indicative of adverse activity you use are regularly updated to reflect changes in network and information systems supporting your essential function(s) and current threat intelligence. "]
["C1.f Understanding user and system behaviour, and threat intelligence ",{"$nulls":4},"A#8","You possess the capability to share threat intelligence (such as ways to effectively detect adversaries) with the threat community / defender community (sector partners, threat intelligence providers, government agencies) when required. "]
["C2.a Threat hunting ","NA#1","You do not know the resources required for threat hunting.\n","PA#1","You have identified the resources required to perform threat hunting and are able to deploy these, in a timely manner, on an occasional basis.","A#1","You understand the resources required to perform threat hunting and these are deployed as part of business as usual. "]
["C2.a Threat hunting ","NA#2","You do not have access to an effective threat hunting capability.\n","PA#2","You deploy an effective threat hunting capability but not frequent enough to match the risks posed to your essential function(s) (for example, you perform threat hunts in response to a tip off from a reputable source).\n","A#2","You deploy threat hunting resources at a frequency that matches the risks posed to your essential function(s).\n"]
["C2.a Threat hunting ","NA#3","Your threat hunts do not follow any structure and few if any records are created.","PA#3","Your threat hunts follow pre-determined and documented methods (for example, hypothesis driven, data driven, entity driven) designed to identify adverse activity not detected by automated detections.","A#3","Your threat hunts follow pre-determined and documented methods (such as, hypothesis driven, data driven, entity driven) designed to identify adverse activity not detected by automated detections.\n"]
["C2.a Threat hunting ",null,null,"PA#4","You document details of threat hunts and post hunt analysis.","A#4","You turn threat hunts into automated detections and alerting where appropriate."]
["C2.a Threat hunting ",{"$nulls":4},"A#5","You routinely record details of previous threat hunts and post hunt activities. You use these to drive improvements in your threat hunting and security posture."]
["C2.a Threat hunting ",{"$nulls":4},"A#6","You have justified confidence in the effectiveness of your threat hunts and the threat hunting process is reviewed and updated to match the risks posed to  your essential function(s). \n"]
["C2.a Threat hunting ",{"$nulls":4},"A#7","You leverage automation to improve threat hunts where appropriate (for example some stages of the threat hunting process are automated)."]
["C2.a Threat hunting ",{"$nulls":4},"A#8","Your threat hunts focus on the tactics, techniques and procedures (TTPs) of threats over atomic IoCs (Indicators of Compromise) (for example, hashes, IP addresses, domain names etc)"]
["D1.a Response plan","NA#1","Your incident response plan is not documented.","PA#1","Your incident response plan covers information, systems and networks supporting your essential function(s).","A#1","Your incident response plan is based on a clear understanding of the security risks to information, systems and networks supporting your essential function(s)."]
["D1.a Response plan","NA#2","Your incident response plan does not include your organisation's identified essential function(s).","PA#2","Your incident response plan comprehensively covers scenarios that are focused on likely impacts of known and well understood attacks and incidents only.\n","A#2","Your incident response plan is comprehensive (i.e. covers the complete lifecycle of an incident, roles and responsibilities, and reporting) and covers likely impacts of both known and possible (but previously unseen) attack patterns and breaches of individuals' rights."]
["D1.a Response plan","NA#3","Your incident response plan is not well understood by relevant staff.","PA#3","Your incident response plan is understood by all staff who are involved with your organisation's response function.","A#3","Your incident response plan is documented and integrated with wider organisational business plans and supply chain response plans, as well as dependencies on supporting infrastructure (such as power, cooling etc)."]
["D1.a Response plan","NA#4","Your incident response plan does not cover your obligations as a controller or processor.","PA#4","Your incident response plan is documented and shared with all relevant stakeholders.","A#4","Your incident response plan is communicated and understood by the business areas involved with the operation of your essential function(s)."]
["D1.a Response plan",null,null,"PA#5","Your incident response plan is readily accessible, even when your organisations IT systems have been adversely affected by an incident.\n","A#5","Your incident response plan covers your obligations as a controller or processor."]
["D1.a Response plan",null,null,"PA#6","Your incident response plan is regularly reviewed to ensure it remains effective.","A#6","Your incident response plan includes notifying impacted system partners."]
["D1.a Response plan",null,null,"PA#7","Your incident response plan covers your obligations as a controller or processor."]
["D1.a Response plan",null,null,"PA#8","Your incident response plan includes notifying impacted system partners."]
["D1.b Response and recovery capability","NA#1","Inadequate arrangements have been made to make the right resources available to implement your response plan.",null,null,"A#1","You understand the resources that will likely be needed to carry out any required response activities, and arrangements are in place to make these resources available."]
["D1.b Response and recovery capability","NA#2","Your response team members are not equipped to make good response decisions and put them into effect.",null,null,"A#2","You understand the types of information that will likely be needed to inform response decisions and arrangements are in place to make this information available."]
["D1.b Response and recovery capability","NA#3","Inadequate back-up mechanisms exist to allow the continued operation of your essential function(s) during an incident.",null,null,"A#3","Your response team members have the skills and knowledge required to decide on the response actions necessary to limit harm, and the authority to carry them out."]
["D1.b Response and recovery capability",{"$nulls":4},"A#4","Key roles are duplicated, and operational delivery knowledge is shared with all individuals involved in the operations and recovery of the essential function(s)."]
["D1.b Response and recovery capability",{"$nulls":4},"A#5","Back-up mechanisms are available that can be readily activated to allow continued operation of your essential function(s), although possibly at a reduced level, if primary information, systems and networks fail or are unavailable."]
["D1.b Response and recovery capability",{"$nulls":4},"A#6","Arrangements exist to augment your organisation’s incident response capabilities with external support if necessary (such as specialist cyber incident responders)."]
["D1.c Testing and exercising","NA#1","Exercises test only a discrete part of the process (for example that backups are working), but do not consider all areas.",null,null,"A#1","Exercise scenarios are based on incidents experienced by your and other organisations or are composed using experience or threat intelligence."]
["D1.c Testing and exercising","NA#2","Incident response exercises are not routinely carried out or are carried out in an ad hoc way.",null,null,"A#2","Exercise scenarios are documented, regularly reviewed, and validated."]
["D1.c Testing and exercising","NA#3","Outputs from exercises are not fed into the organisation's lessons learned process.",null,null,"A#3","Exercises are routinely run, with the findings documented and used to refine incident response plans and protective security, in line with the lessons learned."]
["D1.c Testing and exercising","NA#4","Exercises do not test all parts of the response cycle.",null,null,"A#4","Exercises test all parts of your response cycle relating to your essential function(s) (for example restoration of normal function levels)."]
["D2.a Post incident analysis","NA#1","You are not usually able to resolve incidents or near misses to a root cause or identify the contributing factors within a broader systems context.\n",null,null,"A#1","Post incident analysis is conducted routinely as a key part of your lessons learned activities following an incident or near miss.\n"]
["D2.a Post incident analysis","NA#2","You do not have a formal process for investigating causes.",null,null,"A#2","Your post incident analysis is comprehensive, considering organisational factors (such as policies, processes and procedures), technical factors (such as system design and vulnerabilities), human factors (such as training and security culture) and any changes to threat.\n"]
["D2.a Post incident analysis","NA#3","Investigators form theories early in the process and only seek evidence that affirms their belief.\n",null,null,"A#3","All relevant incident or near miss data is made available to the analysis team to perform post incident analysis.\n"]
["D2.a Post incident analysis","NA#4","Investigations are solely focused on identifying the person(s) who can be held responsible for the incident.",null,null,"A#4","Your analysis considers what could have happened under plausible, alternative circumstances (for example, ‘what if’/’if only’ scenarios). "]
["D2.b Using incidents and near misses to drive improvements","NA#1","Following incidents and near misses, lessons learned are not captured or are limited in scope.",null,null,"A#1","You have a documented incident review process / policy which ensures that lessons learned from each incident, including near misses, are identified, captured, and acted upon. \n"]
["D2.b Using incidents and near misses to drive improvements","NA#2","Improvements arising from lessons learned following an incident or near miss are not implemented or not given sufficient organisational priority.",null,null,"A#2","Lessons learned cover issues with reporting, roles, governance, skills and organisational policies, processes and procedures as well as technical aspects of systems and networks."]
["D2.b Using incidents and near misses to drive improvements","NA#3","Changes are made as a ‘knee jerk’ reaction to an incident without proper analysis and testing to ensure the change is appropriate.\n",null,null,"A#3","You use lessons learned to improve security measures, including updating and retesting response plans when necessary."]
["D2.b Using incidents and near misses to drive improvements","NA#4","You wait until a severe or high-profile incident has occurred before you take steps to improve.",null,null,"A#4","Security improvements identified as a result of lessons learned are prioritised, with the highest priority improvements completed promptly.\n"]
["D2.b Using incidents and near misses to drive improvements",{"$nulls":4},"A#5","Analysis is fed to senior management and incorporated into risk management and continuous improvement."]
["D2.b Using incidents and near misses to drive improvements",{"$nulls":4},"A#6","Your organisation maximises the lessons learned by using the analysis into ‘what if’/’if only’ scenarios.\n"]
["D2.b Using incidents and near misses to drive improvements",{"$nulls":4},"A#7","Your organisation learns from reported incidents in your sector and the wider national infrastructure"]
["E1.a Privacy and transparency  information","NA#1","Privacy information is either not available, incomplete, or out of date.","PA#1","Your privacy information is complete and up to date, covering how data is used, what individuals’ rights are and how they can exercise them.","A#1","Your privacy information is complete and up to date, covering how data is used, what individuals’ rights are and how they can exercise them."]
["E1.a Privacy information","NA#2","Privacy information is provided in a format that not all people are able to access.","PA#2","Privacy information is easily accessible to people who use your service.","A#2","Privacy information is easily accessible and provided in a range of formats for different audiences."]
["E1.a Privacy information","NA#3","Privacy information is  unclear, overly complex or does not use accessible language.","PA#3","Privacy information is concise, in clear and plain language and communicated in an effective way.","A#3","Privacy information is concise, in clear and plain language, communicated in an effective way and uses a layered approach."]
["E1.a Privacy information",{"$nulls":4},"A#4","Your organisation goes beyond providing privacy information and uses different approaches to increase transparency with the public about how it uses their information."]
["E2.a Managing data subject rights under UK GDPR","NA#1","Information rights requests under UK GDPR are frequently not recognised or appropriately responded to.",null,null,"A#1","Your organisation appropriately recognises and responds to information rights requests."]
["E2.a Managing data subject rights under UK GDPR","NA#2","Responsibility for responding to information rights requests has not been assigned to an appropriately trained member, or members, of staff.",null,null,"A#2","Relevant staff members recognise that individuals can make information rights requests, the different categories of requests, and what action they should take when they receive one."]
["E2.a Managing data subject rights under UK GDPR",{"$nulls":4},"A#3","Responsibilities for information rights requests have been delegated to appropriately trained and resourced staff members who can manage them in line with legal requirements."]
["E2.b Consent","NA#1","Relevant staff members are not familiar with the common law duty of confidentiality or privacy rights or do not understand when they need to ask for consent.",null,null,"A#1","Relevant staff members understand consent under the common law duty of confidentiality when they can rely on implied consent, and when they need to ask for or refresh existing explicit consent."]
["E2.b Consent","NA#2","You either do not have a policy or procedures in place, or are unsure whether your existing policy or procedures are adequate to ensure that consent is managed appropriately.",null,null,"A#2","Your organisation has a policy and procedures to ensure that consent is managed appropriately, including any decisions made by the Caldicott Guardian."]
["E2.b Consent","NA#3","Information provided to people about their consent under the common law duty of confidentiality is either not given or unclear.",null,null,"A#3","Information provided to people about the use and sharing of information and consent is appropriate and clear. "]
["E2.b Consent","NA#4","You do not have a process for refreshing consent when necessary."]
["E2.c National data opt-out policy","NA#1","Relevant staff members are unsure where individuals can opt-out of their data being processed.",null,null,"A#1","Your organisation understands the circumstances under which opt-outs must be applied and has recorded its applications in the information assets and data flows register."]
["E2.c National data opt-out policy","NA#2","You are not sure whether opt-outs have been appropriately applied to relevant data sets.",null,null,"A#2","Your organisation clearly communicates to the public where they can opt-out of their data being shared."]
["E2.c National data opt-out policy","NA#3","Your procedure is not robust enough to ensure that all opt-outs are applied and routinely refreshed.",null,null,"A#3","You have robust procedures and an adequate technical solution in place to ensure opt-outs are correctly applied."]
["E2.c National data opt-out policy","NA#4","You are unsure whether your organisation is fully compliant with the national data opt-out policy."]
["E3.a Using and sharing information for direct care","NA#1","Relevant staff members do not understand what direct care is, the activities it covers and when they should use and share information to facilitate it.",null,null,"A#1","Relevant staff understand what direct care is, the activities it covers, and when they should use or share information to facilitate it."]
["E3.a Using and sharing information for direct care","NA#2","Information is not always used or shared when it is needed for direct care.",null,null,"A#2","Information is used or shared for direct care when it is needed."]
["E3.a Using and sharing information for direct care","NA#3","Information being used or shared for direct care is either inadequate or excessive.",null,null,"A#3","Information which is used or shared for direct care is relevant and proportionate."]
["E3.a Using and sharing information for direct care","NA#4","You are unsure whether individuals would reasonably expect their information to be used or shared in all instances where your organisation does so.",null,null,"A#4","When information is used or shared for direct care, individuals’ reasonable expectations are considered. Where applicable, specific legislation about confidential information is also adhered to. "]
["E3.a Using and sharing information for direct care","NA#5","There are no arrangements in place for routine information sharing for direct care.",null,null,"A#5","Your organisation has a process in place to enable appropriate non-routine ad hoc data sharing for direct care purposes."]
["E3.a Using and sharing information for direct care","NA#6","There is no process to share data for non-routine ad hoc direct care purposes, or it is not routinely followed.",null,null,"A#6","There are appropriate arrangements in place for information sharing for direct care. "]
["E3.b Using and sharing information for other purposes ","NA#1","Relevant staff members are not aware of the circumstances under which information might be used or shared outside of direct care. ",null,null,"A#1","Relevant staff members understand which of your organisation’s activities for using and sharing information fall outside of direct care."]
["E3.b Using and sharing information for other purposes ","NA#2","Your organisation’s practices for using and sharing information for purposes outside of direct care do not satisfy legal requirements including the common law duty of confidentiality UK GDPR or  individuals’ right to a respect for private life.",null,null,"A#2","Your organisation’s practices for using and sharing information for purposes outside of direct care satisfy legal requirements including the common law duty of confidentiality, UK GDPR and individuals’ right to respect for a private life."]
["E3.b Using and sharing information for other purposes ","NA#3","Individuals are not appropriately informed when their information is used or shared for purposes outside of direct care.",null,null,"A#3","Your organisation clearly communicates to individuals where their information may be used or shared for purposes outside of direct care."]
["E3.b Using and sharing information for other purposes ","NA#4","There are no arrangements in place for routine information sharing outside of direct care.",null,null,"A#4","You maintain a disclosure log which details requests for individuals’ information for purposes outside of direct care and sharing decisions your organisation has made, including the lawful basis for the sharing where appropriate.\n"]
["E3.b Using and sharing information for other purposes ","NA#5","You don’t maintain an up-to-date disclosure log detailing requests for individuals’ information for purposes outside of direct care and sharing decisions your organisation has made.",null,null,"A#5","There are appropriate arrangements in place for information sharing outside of direct care. "]
["E3.b Using and sharing information for other purposes ","NA#6","There is no record of the lawful basis for disclosures that you have made."]
["E3.b Using and sharing information for other purposes ","NA#6"]
["E4.a Managing records","NA#1","There are no organisational measures to ensure that records are filed in the locations indicated on the record keeping system.",null,null,"A#1","Your organisation understands legal and professional obligations for records management."]
["E4.a Managing records","NA#2","You do not have an approved process for disposing of records or it is not routinely followed.",null,null,"A#2","You have a record keeping system implemented at the organisational level which covers every stage of the information lifecycle and arranges records into an appropriate classification scheme."]
["E4.a Managing records","NA#3","There is no procedure for reviewing records to ensure they are not kept for longer than is needed.",null,null,"A#3","Records are appraised towards the end of their retention period and disposed of when appropriate."]
["E4.a Managing records","NA#4","Your standards for record keeping are not in alignment with national and professional guidance and frameworks.",null,null,"A#4","Data destruction can be evidenced via destruction certificates or equivalent."]
["E4.b Clinical coding","NA#1","Your clinical coding practices are not compliant with current national clinical coding standards for the ICD-10 and OPCS-4 classifications.",null,null,"A#1","Your clinical coding practices are compliant with current national clinical coding standards for the ICD-10 and OPCS-4 classifications."]

{"sheet":"Policy and data collections","index":2,"n_rows":11,"n_cols":7,"rows_kept":11,"cut":false,"hidden":false,"merged":[]}
["Outcome ID","Content title","Policy/data collection requirement ","Collection Step 1","Collection Step 2","Collection Step 3","Links "]
["A2.a","Top three cyber security risks ","What are your organisation’s top three cyber security risks that could impact patient/service user care and the ability to deliver services.","These should be assessed through your organisation’s cyber security risk management framework and be provided in order of criticality."]
["A2.c ","Mandatory policy requirement: Independent audit ","Organisations must arrange and undergo an independent audit of each DSPT submission, following the audit guidance published by NHS England. \n\nOrganisations must have due regard to the findings. \n\nOrganisations must provide the findings to their board and within their DSPT submission.\n\nThe response fields are currently ‘read only’ and will be automatically populated once you have provided audit details.","Has your organisation met this policy?\n\nResponse required\nYes\n\nNo \n"]
["B2.a ","Mandatory policy requirement: multi-factor authentication ","You must tell us if you comply with our multi-factor authentication (MFA) policy, to achieve or partially achieve this contributing outcome. \n\nOrganisations:\nmust enforce strong MFA on all remote user access to all systems; and  \n\nmust enforce strong MFA on all privilege access to externally-hosted systems; and \n\nshould enforce MFA on all privileged user access to all other systems;\n\nexcept as permitted in the 'Exceptions' section of this policy.\n\nPermitted exceptions are listed in our MFA policy (opens in a new tab) and any exception applied must be provided using the MFA exceptions register (Excel, 33KB). \n\nRead our full multi factor authentication policy (opens in a new tab) ","Has your organisation met this requirement? \n\nResponse required\nYes, with no exceptions \n\nYes, with exceptions (you'll be asked to upload details of these) \n\nNo \n\nI don't know and will answer later \n\nSave and continue \n\n","Provide details of all your systems that do not enforce MFA because permitted exceptions have been applied. \n\nYou must provide this information using the MFA exceptions register (Excel, 33KB). \n\nRead our guide to MFA policy (opens in a new tab). \n\nFind out more about confirming your compliance with MFA (opens in a new tab). ",null,"multi factor authentication policy"]
["B3.b","Mandatory policy requirement: PCQ (Post-Quantum Cryptography) ","The National Cyber Security Centre (NCSC) recommends timelines for migration to post-quantum cryptography[ link], with milestones to be completed by 2028, 2031 and 2035. \n\nYour organisations must plan to achieve, by the end of 2028, both of the following:\n\n\na full discovery exercise to understand which services and infrastructure should be migrated to quantum-safe algorithms\n\nan initial plan for migration \n\nYour organisation must submit an approved and realistic plan to meet the 2028 requirement in order to achieve or partially achieve this contributing outcome.\n\nYou will be asked to upload your migration plan later in the assessment year.","Has you organisation created a plan to meet the 2028 milestone?\n\nResponse required\nUpload plan\nNo plan yet\n\n\n\n",null,null,"NCSC Post-Quantum Cryptography "]
["B4.d","Mandatory policy requirement: High Severity Alerts ","For each high-severity cyber alert issued by NHS England, organisations must:\n\n•\tfollow the advice within the alert, other than in exceptional circumstances agreed at board level (or as delegated);\n\n•\tuse the NHS England ‘Respond to an NHS cyber alert’ service to confirm a decision to act (or a decision not to follow the advice) promptly, and in any case within 14 days of issue (for alerts issued between 1 July 2026 and 31 December 2026) or within 48 hours of issue (for alerts issued between 1 January 2027 and 30 June 2027); and\n\n•\tuse the service to report actions taken in response to the alert.\n","Has your organisation met this requirement? \n\nResponse required\nYes\n\nNo \n\n",null,null,"https://digital.nhs.uk/services/respond-to-an-nhs-cyber-alert"]
["B4.d","Number of desktops and laptops with unsupported operating system","What percentage of your organisation's desktops and laptops are running on a supported version of an operating system (as a proportion of all managed desktops and laptops)?","You should provide a percentage number (0 to 100) calculated as a  proportion of all desktop and laptops."]
["B4.d","Number of servers with unsupported operating system","What percentage of your organisation's servers are running on a supported version of an operating system (as a proportion of all managed servers)?","You should provide a percentage number (0 to 100) calculated as a  proportion of all servers."]
["C1.a ","Mandatory policy requirement: Extended detection and response policy (XDR)","As part of this outcome, you must tell us how your organisation complies with specific parts of the XDR Policy to achieve, or partially achieve, this outcome.\n\nWe need to know if your organisation:\n\nmeets the endpoint Detection and Response (EDR) criteria \nmeet the Identity Threat Detection and Response (ITDR) criteria \nhas any permitted exceptions ","Does your organisation comply with Endpoint Detection and Response (EDR)?\n\nTo comply with this part of the policy, your organisation must:\n\ndeploy and maintain the national endpoint detection and response solution to all servers and endpoints, on promises, remote and in the cloud \n\nconfigure and onboard your devices to Microsoft Defender for Endpoint (MDE)\n\nregularly update and maintain your devices \n\nResponse required\nYes/No/Answer later ","Does  your organisation comply with Identify Threat Detection and Response (ITDR)?  \n\nTo comply with this part of the policy, your organisation must:\n\ndeploy and maintain the national identity threat detection and response solution to your infrastructure, the on-premises Windows Server 2019, and the newer Active Directory and compatible identity solutions. \n\nconfigured and onboard your devices to Microsoft Defender for Identity (MDI)\n\nregularly updated and maintain your devices\n\nResponse required\nYes/No/Answer later \n ","What is the total number of devices within your organisation?\nResponse required\nNumber value \n\nDo you have permitted exceptions?\nWhere MDE, or MDI, is not installed or configured on one, or more, of your devices.\nResponse required\nYes/No/Answer later\n\nIf Yes\nWhat permitted exceptions are you applying to your devices?\nYou have told us you have some devices that do not have Microsoft Defender for Endpoint (MDE) or Microsoft Defender for Identity (MDI) installed.\n\nYou must tell us which permitted exceptions you are relying on to do this.\n\nProvide the number of devices for each permitted exception type:\n\nMedical devices where deployment of MDE and MDI would compromise certification\n\nDevices owned or managed by third party with contractual or technical restrictions to deploying MDE and MDI\n\nDevices that do not support MDE and MDI\n\nDevices in scope of a contract signed to publication of this policy that provides for alternative detection and response capability\n"]
["C1.d","Mandatory policy requirement: acknowledge High Severity Alerts ","You must tell us if you comply with our high severity cyber alert policy to achieve or partially achieve this contributing outcome.\n\nOrganisations must register and maintain up-to-date contact details with the NHS England ‘Respond to an NHS cyber alert’ service;\n\nOrganisations must use the service to acknowledge receipt of high severity cyber alerts issued by NHS England within: \n\n48 hours for high severity alerts issued between 1st July 2026 and 31st December 2026, and;\n\n24 hours for high severity alerts issued between 1st January 2027 and 30th June 2027.\n","Has your organisation met this requirement? \n\nResponse required\nYes\n\nNo \n\nI don't know and will answer later \n\nSave and continue \n\n"]
["N/A","Essential functions ","You'll have conducted an essential functions scoping exercise during your preparation for completing this year's assessment. \n\nFind out more about scoping essential functions (opens in a new tab). \n\nUpload your findings \n\nYou'll need to upload these findings before you can publish your assessment. ","Upload your essential functions \n\nYour findings should include: \n\na list of all your organisation's essential functions \n\nall information, systems and networks which support them \n\n \n\nYou can provide this information using the essential functions template (Excel, 479KB). \n\nSee examples of essential functions by organisation type (opens in a new tab). \n\nFind out more about defining essential functions (opens in a new tab). \n\nTo edit your findings after uploading them, you'll need to remove the file and upload a new one. "]

{"sheet":"Products and Services NEW ","index":3,"n_rows":21,"n_cols":4,"rows_kept":21,"cut":false,"hidden":false,"merged":[[7,0,7,3],[8,0,8,3],[9,0,9,3],[10,0,10,3],[2,0,2,3],[3,0,3,3],[4,0,4,3],[5,0,5,3],[6,0,6,3]]}
["Products and services you provide "]
[]
["The cohort of organisations this change applies to are:"]
["- all category 2 organisations"]
["- those organisations who complete CAF aligned DSPT annual assessments listed below:"]
["o   NHS trusts and foundation trusts"]
["o   commissioning support units (CSUs)"]
["o   arm’s-length bodies (ALBs) of the Department of Health and Social Care (DHSC)"]
["o   integrated care boards (ICBs)"]
["o   independent health organisations who have been designated as 'operators of essential services' under the Network and Information Systems (NIS) regulations 2018"]
["o   genomics organisations as nominated by DHSC"]
[]
["We'll ask you some questions to find out more about the products and services you provide to health or care organisations."]
["Question Ref ","Question ","Response ","Tool tip "]
["PS.1 ","Does your organisation provide products or services to health or care organisations?","Yes/No ","If YES, tell us about the products or services you provide \nAs part of this year’s assessment, we’re trying to find out more about the products and services provided to health or care organisations.\n\nFor each product or service you provide to a health or care organisation, we’ll ask about:\n\n•\tdocumented security controls that align with the supplier charter\n•\tthe security vulnerability management process \n•\tyour access controls \n•\tthe incident management process \n•\tmeeting DTAC (NHSDigital Technology Assessment Criteria)\n\nYou need to answer these questions before you publish your assessment.\n\nYou can upload evidence to support your answers.\nFor more information on the supplier charter, https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/cyber-security-charter-for-suppliers-to-the-nhs\n"]
["PS.2 ","What is the name of the product or service you supply?\n\nName of Product:\nVersion:","Text ","This should be the name that health and care customers would recognise it by. We need to know all the versions you have, like ABC Ltd (Windows 10), ABC Ltd (Windows 11)."]
["PS.3","Does your product or service have documented security controls?","Yes/No ","These must protect the confidentiality, integrity and availability of the service and its data throughout its lifecycle, and align with the supplier charter."]
["PS.4","Are there defined processes to identify, assess, and remediate security vulnerabilities?","Yes/No ","This must include regular security updates and communicating this to your customers."]
["PS.5","Is access to sensitive data and administrative functions restricted to authorised personnel only?","Yes/No ","They must be using appropriate authentication mechanisms and role-based access controls."]
["PS.6","Is there an incident management process?","Yes/No ","This must include identifying, managing, and promptly notifying customers of security incidents that affect, or could affect, the product or service you provide."]
["PS.7","Have you completed a Digital Technology Assessment Criteria (DTAC) assessment for this product or service?","Yes/No ","The NHS DTAC is an assessment framework for care commissioners and providers to use when assuring Digital Health Technology (DHT) products. Further details available in the: https://transform.england.nhs.uk/key-tools-and-info/digital-technology-assessment-criteria-dtac/"]