For NHS Trust leaders, meeting the demands of cyber security assurance has never been more urgent. With the Data Security and Protection Toolkit (DSPT) now aligned to the Cyber Assessment Framework (CAF), NHS organisations now need to demonstrate not only whether controls are in place, but how effective they are in practice.
This checklist is designed to help you plan, prioritise, and validate your approach to CAF and DSPT in 2026, ensuring your organisation can demonstrate robust cyber resilience.
Checklist overview: planning and governance
Here’s a practical step-by-step approach to help you get started.
1. Define your scope and stakeholders
Start by confirming your essential functions and assets. This should include IT systems, Operational Technology (OT), and any medical internet of things (IoT)/ internet of medical things (IoMT) devices. In the context of CAF-aligned DSPT, evidence will be assessed against outcomes that map directly to clinical and business risk.
Ensure your stakeholders are involved:
- Chief information security officer (CISO) is responsible for cyber security strategy, risk management, and CAF alignment.
- Senior information risk owner (SIRO) for governance sign-off.
- Information governance (IG) lead for information governance evidence.
- Head of IT/ cyber security sponsor to coordinate evidence.
2. Map CAF objectives to DSPT requirements
The CAF-aligned DSPT guidance organises evidence under outcome-focused objectives:
- Objective A – Managing risk
- Objective B – Protecting against cyber-attacks and data breaches
- Objective C – Detecting cyber security events
- Objective D – Minimising the impact of incidents
- Objective E – Using and sharing information appropriately
This mapping is essential and evidence you collect for one objective often supports multiple DSPT assertions. A clear matrix that maps controls against CAF/DSPT outcomes ensures you don’t miss anything.
3. Formalise governance and assurance structures
- Establish regular cyber risk board reviews
- Confirm DSPT and CAF responsibilities in job descriptions
- Ensure CISOs and executive oversight sign-off processes are documented
CAF-aligned DSPT expects organisations to show continuous risk management, not ad-hoc reporting.
Checklist for technical and operational controls
4. Network and system security
Review your network protection layers and maintain documentation showing how firewalls, segmentation, and secure configurations protect essential services. Ensure patch management schedules and evidence of execution is available, especially for systems handling patient data.
5. Asset discovery and observability
CAF-aligned assessments will look for evidence that organisations have visibility across their estate, including IoMT, operational technology, and cloud environments. Passive discovery tools and observability platforms help demonstrate that controls are working across the estate.
6. Detection and monitoring evidence
Ensure you have:
- SIEM tools or monitoring platforms logging security events
- Defined alert thresholds and escalation processes
- Regular log reviews
- Evidence of trend analysis and action on anomalies
Detection capability is a key contributor to DSPT evidence under CAF objectives.
7. Incident response readiness
You should have:
- Updated major incident response plans
- Evidence of at least one tested scenario (tabletop or live)
- Post-incident review documents
- Defined roles and response times
CAF and DSPT both emphasise preparedness before an incident, not just reports after one.
8. Data protection and governance
Data protection and governance is key. With patient information involved, you need clear evidence of:
- Responsible data owners
- Data classification schemes
- Encryption policies
- Data retention and disposal policy
Documenting how data is protected and audited will be crucial during independent assessments.
Evidence portfolio and documentation checklist
CAF-aligned DSPT is outcome-based so evidence counts more than narrative. These are the kinds of artefacts assessors will expect:
Policies and frameworks
- Cyber security policy
- Risk management and governance documentation
- Access control and IAM policies
- Patch and change management policies
Control evidence
- Penetration and vulnerability testing logs
- Access control reviews
- Firewall rule sets and change logs
- Evidence of network segmentation and device management
Audit and monitoring reports
- SIEM event logs with analysis
- Incident logs with lessons learned
- Testing and review records
- Staff training completion reports
Well maintained documentation not only supports CAF outcomes – it also future-proofs annual DSPT returns.
Practical preparation tips
- Start planning early: Plan your 2026 audit at least 6 - 9 months in advance. Independent assessments for CAF-aligned DSPT are expected to occur between January and June 2026.
- Use mapping templates: Mapping CAF objectives to specific DSPT evidence items early allows teams to see overlap and avoid duplication.
- Practice dry runs: Internal mock assessments help identify gaps before the real audit. These help governance teams understand where improvements are needed early.
Leadership and assurance insights
CAF-aligned DSPT is as much a leadership framework as it is a security one. Boards are expected to understand cyber risk strategies, resourcing constraints, and mitigation plans. The senior information risk owner (SIRO) must ultimately approve the submission.
Good governance documentation goes a long way towards demonstrating organisational understanding of risk and assurance.
Final thoughts: move beyond compliance
CAF and DSPT are no longer just compliance exercises. They show that security controls work in practice and that cyber risk is actively managed across your organisation.
For NHS Trusts and healthcare providers, this shift is critical. Strong cyber resilience protects patient data, reduces service disruption risk, and builds trust in digital services that underpin modern healthcare.
Annual self-assessments shouldn’t just tick a regulatory box. Done effectively, they provide a structured opportunity to strengthen security posture, improve operational resilience, and drive continuous improvement across teams, helping your Trust stay ahead of cyber threats and confidently meet CAF & DSPT requirements.
Discover how we can assist you with DSPT and navigate its detailed requirements.
Frequently asked questions about CAF and DSPT
What is the Data Security and Protection Toolkit (DSPT)?
The DSPT is the UK’s annual self-assessment tool that allows NHS organisations to measure their security and information governance capability against national expectations. All organisations that access NHS patient data or systems must complete it to show they can protect sensitive information appropriately.
In recent years, DSPT has aligned more closely with the National Cyber Security Centre’s (NCSC) Cyber Assessment Framework (CAF). This change emphasises outcomes, effectiveness, and evidence - not just documentation.
In recent years, DSPT has aligned more closely with the National Cyber Security Centre’s (NCSC) Cyber Assessment Framework (CAF). This change emphasises outcomes, effectiveness, and evidence - not just documentation.
What is the Cyber Assessment Framework (CAF)?
The Cyber Assessment Framework (CAF) is a structured set of objectives that helps organisations manage cyber risks by guiding how they protect, detect, and respond to security incidents. These objectives, covering risk management, protection, detection, and incident minimisation now underpin DSPT assessments for NHS Trusts.
How Wavenet can support you with your CAF assessment?
We help NHS Trusts move from compliance to confidence by providing structured guidance and practical support throughout your CAF-aligned DSPT assessment. This includes:
- Gap analysis and readiness assessments – identifying areas for improvement and prioritising actions.
- Evidence mapping – helping teams align controls and documentation to CAF objectives.
- Technical and operational guidance – ensuring network, system, and data protection controls meet requirements.
- Board and governance support – advising on risk management, reporting, and executive sign-off processes.
- Ongoing support – from preparation through submission, to help your Trust build sustainable cyber resilience rather than just meeting regulatory checkboxes.
Our approach ensures that Trusts can confidently demonstrate cyber resilience, maintain compliance, and strengthen overall information governance.
