Next steps – planning for your review

Suggested next steps are below. These steps will enable your organisation to plan effectively for the review:

1. Understand requirements - discuss with an independent assessor the timelines and requirements for an independent assessment to be conducted between January and May, including staff requirements and financial resourcing.
2. Understand CAF profile - review the CAF profile as set out for your organisation.
3. Understand expected achievement levels - review the objectives, principles, outcomes, indicators of good practice (IGPs) and expected achievement levels for the assessment of your organisations set out in our Cyber Assessment Framework (CAF)-aligned Data Security and Protection Toolkit (DSPT) guidance.
4. Update leadership - provide an update to the board and audit committee of your organisation, indicating expected timelines, scope of assessment and the results of the self-assessment.

There is a total of 49 outcomes in the CAF-aligned DSPT, which will all be assessed over a multi-year period. Each year, a selection of outcomes from across the 5 objectives will be tested by independent assessment providers. NHS England (NHSE) will mandate a common core set of outcomes to be assessed for all organisations that undertake the CAF-aligned DSPT, while a further number will be selected by individual organisations.

These outcomes should be approved by the board of each organisation, and will reflect areas of concern that warrant additional assurance over the controls in place during that audit period. A list of mandated outcomes to be audit are listed in task 2 of the independent assessment and audit guide.