DSP Toolkit assertions explained: standards, assertions and evidence items

Open the Data Security and Protection Toolkit (DSPT) for the first time and you meet a wall of numbered statements. Those are the assertions, and understanding how they fit together makes the whole toolkit much less daunting. This guide explains the structure, the difference between mandatory and non-mandatory evidence, and what each of the ten standards is really asking you to demonstrate.

It is written for the assertion-based toolkit completed by social care providers, GP, dental and pharmacy practices and other smaller organisations. Larger NHS bodies such as trusts and integrated care boards now complete a version aligned with the National Cyber Security Centre’s Cyber Assessment Framework, which is structured differently.

The three layers: standards, assertions, evidence items

The toolkit is built in three layers.

1. The ten data security standards. These come from the National Data Guardian and set the overall expectations for anyone handling NHS data.
2. Assertions. Under each standard sit a number of statements about your organisation, such as “staff have completed data security and protection training in the last twelve months”. You confirm each assertion is true for you.
3. Evidence items. Beneath each assertion are the specific questions, confirmations or uploads that support it. Some are mandatory; some are not.

The number of assertions and evidence items you see depends on your organisation profile, which is set when you register. A small care home sees a shorter, more focused set than a large IT supplier. Our guide to DSPT assessment levels and profiles explains how that works.

Mandatory and non-mandatory evidence items

This distinction matters more than anything else in the toolkit.

• You cannot publish a Standards Met status until every mandatory evidence item is complete.
• Non-mandatory items are still worth answering. They show good practice, they are often easy once the mandatory ones are done, and commissioners and auditors do look at them.
• If you cannot complete all the mandatory items by the deadline, you may be able to publish Approaching Standards with an improvement plan, which is far better than missing the deadline altogether.

Work through the mandatory items first, in the order that suits your evidence rather than the order on screen.

What the ten standards are asking for

Standard	In plain English	Evidence that usually satisfies it
1. Personal confidential data	You know what data you hold, why, and you handle it lawfully and confidentially	Record of processing, privacy notice, data protection policy, named lead, ICO registration
2. Staff responsibilities	Everyone understands their responsibility for data security	Confidentiality clauses, induction, policy sign-off
3. Training	Staff have completed appropriate training in the last year	Training records showing completion rates, usually 95% or better
4. Managing data access	Only the right people can get at the data, and access is reviewed	Access control policy, user lists, joiners and leavers process, evidence of reviews
5. Process reviews	You learn from things going wrong and improve processes	Incident log, review notes, changes made as a result
6. Responding to incidents	You can spot, report and manage security incidents	Incident procedure, reporting route into the toolkit’s incident tool, staff awareness
7. Continuity planning	You can keep running, and recover, if systems fail	Business continuity plan, backup arrangements and evidence of testing
8. Unsupported systems	You know about, and manage, software that is no longer supported	Asset list, list of unsupported software with risk decisions and plans
9. IT protection	Systems are configured securely, patched and protected	Patching records, antivirus, firewall, secure configuration, penetration testing where required
10. Accountable suppliers	Suppliers who handle your data are checked and contracted properly	Supplier list, contracts with data protection clauses, evidence of suppliers’ own DSPT or certification

Standards 1 to 7 are largely about people, governance and process. Standards 8 to 10 are technical and supplier-focused, and they are where organisations that already hold Cyber Essentials find the toolkit easiest.

Reading an assertion properly

Before you answer any evidence item, read the assertion above it and ask three questions:

• What is it actually claiming? “Staff have completed training” is about completion in the current year, not about having a training policy.
• What would prove it? Usually a document, a record or a screenshot you already hold. A training report from your learning system, a signed policy, an export of user accounts.
• Is the claim true today? If not, the honest answer is to fix the gap first. Confirming an assertion you cannot evidence undermines the whole submission and can surface in an audit or after an incident.

Many providers find that a single well-organised evidence folder, matched to the assertions, covers a surprising amount. Our DSPT evidence checklist maps common documents to the standards.

Common mistakes with assertions

• Confirming assertions without evidence because the deadline is close. It is the fastest route to problems later.
• Leaving non-mandatory items blank on the assumption they do not matter.
• Treating the toolkit as an IT job. Most assertions are about governance, training and process, and need the registered manager, practice manager or information governance lead.
• Uploading whole policies where a short confirmation and a reference would do, then struggling to find the same evidence next year.
• Not using the incident reporting tool built into the toolkit, which Standard 6 expects.
• Starting in May. The deadline is 30 June, and evidence such as training completion and supplier checks takes weeks to gather. See our guide to the DSPT annual cycle.

Turning assertions into an annual rhythm

The assertions barely change from year to year, so the work should get easier each time. Keep the evidence folder, note which document satisfied which assertion, and diarise the things that must be refreshed annually: training, access reviews, supplier checks, continuity testing and policy reviews. Our common DSPT mistakes guide covers the traps that catch organisations on renewal.

Not sure where you stand?

The free DSPT readiness checker gives you a quick sense of which standards you can already evidence and which need work. Any unfamiliar terms are explained in the glossary.

How we can help

We take care providers and practices through every assertion in their profile, match the evidence you already hold, fill the gaps that remain, and check the submission before it is published. It is a fixed-fee engagement planned around the 30 June deadline. Explore our DSPT service or get in touch for a free, no-obligation conversation.