Contact Us

Contact Us

Please get in touch using the form below

I prefer to be contacted by:
View our privacy policy
Learn about the techniques attackers use to evade detection and how to defend against them. Sign up for our webinar on June 9th.

Overview

Raise security standards and protect patient data to the latest NHS standards

The Data Security and Protection Toolkit (DSP Toolkit) is an online-self assessment tool that helps organisations within the NHS to benchmark their security against the National Data Guardian’s ten Data Security Standards (NDG Standards).

The DSP Toolkit helps to ensure that robust data security and data privacy standards are in place across the healthcare sector and are aligned to the requirements of the General Data Protection Regulation (GDPR).

A Redscan employee shakes hands with a partner

About

The importance of NHS data security

All health and social services are built on a foundation of trust, and the understanding that sensitive information is shared only with the individuals that need it.

As healthcare organisations become increasingly digitised, it becomes more challenging to maintain the confidentiality, integrity and availability of sensitive patient data. Organisations have a duty to protect information systems against cyber threats, but without compromising quality of care.

Giving individuals better visibility of and control over how their data is processed is also more important than ever.

Standards

NDG Data Security Standards

The National Data Guardian’s (NDG) Data Security Standards apply to all organisations that handle health and social care information. Organisations are required to commit to ten NDG Data Security Standards, split across three Leadership Obligations – People, Process and Technology.

Leadership Obligation 1: People

Ensuring staff are equipped to handle information respectfully and safely.

Data Security Standard 1
All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes.

Data Security Standard 2
All staff understand their responsibilities under the National Data Guardian’s Data Security Standards, including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.

Data Security Standard 3
All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit.

Leadership Obligation 2: Process

Ensuring the organisation proactively prevents data security breaches and responds appropriately to incidents or ‘near misses’.

Data Security Standard 4
Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals.

Data Security Standard 5
Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.

Data Security Standard 6
Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection.

Data Security Standard 7
A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.

Leadership Obligation 3: Technology

Ensuring technology is secure and up to date.

Data Security Standard 8
No unsupported operating systems, software or internet browsers are used within the IT estate.

Data Security Standard 9
A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.

Data Security Standard 10
IT suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standards.

Compliance

Achieving DSP compliance

Understanding how the NDG standards apply to your organisation and putting the necessary controls in place to meet them can be daunting.

Redscan is an award-winning of provider of managed security and assessment services. We have experience of working with organisations of all sizes, including hospitals, health trusts and others in the healthcare sector, helping them to significantly improve their cyber security posture.

As a CREST accredited provider of security assessment services, Redscan can help organisations to review and implement cyber security practices in line with NDG Data Security Standard 9. This requires organisations to undertake a penetration test at least once a year, covering critical network infrastructure and web servers. Red teaming also helps to test continuity plans, as mandated by NDG standard 7.

Proactive identification of data breaches is a key NDG obligation but is often difficult for organisations, particularly those that lack a dedicated security team, to achieve. ThreatDetect™ is an award-winning Managed Detection and Response service that provides the support needed to detect current and emerging cyber threats the actionable mitigation guidance needed to respond swiftly and effectively to them.

Our Services

Our award-winning services

Redscan’s security services are designed to provide the vital assistance needed to make tangible improvements to your organisation’s cyber security posture.

ThreatDetect MDR

Managed Detection and Response

Award-winning support to rapidly detect and respond to the latest threats 24/7

Read more

Assessment Services

Specialist engagements to uncover and address hidden cyber security risks

Read more
A person choosing from a range of Managed Security Services

Managed Security Services

Expert help to manage and monitor your choice of security technologies

Read more

Get in touch

Complete the form for a prompt response from our team.

I prefer to be contacted by:
View our privacy policy

Resources

Discover our latest content and resources

From the blog
From the blog Case studies Latest news
22nd May 2020
Cybersecurity cited by WEF as one of the top COVID-19 fallout issues
Cybersecurity is one of the ‘Top 10 Fallout’ issues from COVID-19 according to a new Global Risks report published by the Word Economic Forum. Nearly 38% of risk professionals surveyed say changing work patterns will lead to increases in cyber security and fraud incidents
15th May 2020
CISA and FBI publishes list of top 10 security vulnerabilities
A new reported authored by CISA and the FBI reveals that vulnerabilities in Microsoft Office and Apache Struts were among the software vulnerabilities most commonly exploited between 2016 and 2019.
7th May 2020
Cyber security warning issued to healthcare providers
Healthcare bodies and medical research organisations are being targeted by advanced persistent threat groups and must take steps to minimise the risk of ‘password spraying’ campaigns, according to a joint security advisory issued by the NCSC in the UK and CISA in the US.
1st May 2020
FCA extends SCA deadline to September 2021
Due to the COVID-19 crisis, The UK's Financial Conduct Authority has announced that it is to delay the implementation of strong customer authentication rules by a further six months.