SIGNs Chairs Meeting – 14th December 2016 Update on the Redesigned IG Toolkit Alan Morton Programme Manager NHS Digital

Areas to cover Why we’re re-designing the Toolkit What is currently being done The plan going forward Our approach Feedback from SIGNs groups What we need from the SIGNs Chairs Group

Why we’re re-designing the Toolkit Support and underpin the implementation of the new NDG Data Standards, requiring: Major refresh of IG Toolkit Support the external validation of sites’ data security Identify exemplars and cascade lessons learned to help build professional capability Providing support to those that need help in meeting the standards Allowing everyone to learn from the best Empower leaders to take ownership of data security IG Audit arrangements CQC inspection regime

What is currently being done? DH is working through the NDG Report and Consultation responses We’re engaging with Stakeholders Gathering and testing requirements Utilising previous work on how we could improve the toolkit Setting up governance arrangements to include a User Advisory Group, Design Authority and a Delivery Board Adhering to best practice Programme Management principles Reviewing the existing Toolkit standards to test if they are still required and blending them with the NDG standards

The plan going forward Tenders expected by close, Friday 16th December Evaluation and moderation, w/c 20th December Requirements Gathering underway January 2017 Prototype April 2017 Extended Piloting of the Toolkit April 2017-Jan 2018 Full go live for all sectors April 2018

Our approach Provide time to implement the data security standards by reducing burden and duplication in the toolkit Introducing KPIs that leaders can recognise and utilise to change culture within organisations Listening to our stakeholders and piloting the new toolkit Keeping the toolkit flexible and updated more regularly

What we need from the SIGNs Chairs Group Nominate representatives for the User Advisory Group for Acute Trusts, Mental Health Trusts and Community Please give us and our partners your ideas on how we could improve the toolkit. Comment on the design principles for the toolkit prior to them being agreed. Safe Space to show ideas and receive feedback. Get people to join our testers programme or get on the mailing list to stay in touch via cybersecurity@nhs.net

Initial Feedback from SIGNs Thanks given for hosting meetings with over 100 IG Leads involved IG Leads very keen to be involved in the development of the IGT Intelligence gathered builds on the work that was done last year. All available in a pack for the partner. There is a range of views about improvements to the Toolkit.

Initial Feedback from SIGNs IGT The most requested improvements were: Removing Duplication in the IG Toolkit requirements Reducing the number of requirements A tailored set of requirements per organisation A single set of requirements for all organisations A tool to demonstrate compliance with GDPR Purpose of the Toolkit should be communicated more clearly Consequences of “failing the Toolkit” should be communicated more clearly

Initial Feedback from SIGNs IGT The most popular new functionality identified Updated Knowledge base Dashboard for IG Assurance Auto Save Automatic mapping of evidence to multiple requirements The least popular current functionality identified IG Toolkit News Marking requirements not relevant

Initial Feedback from SIGNs IGT The most popular current areas to remain in the IG Framework Managing access to computer systems ICT Network Operate Securely IG Training The most popular new areas to be included in the IG Framework Cyber Strategy in place

Initial Feedback from SIGNs IGT The least popular areas to remain in the IG Framework Pseudonymisation And Anonymisation NHS Number Clinical Coding Training Clinical Record Audit

Initial Feedback from SIGNs The NDG Standards will require guidance and definitions for Trust to be able to assess compliance Informally There is highest confidence of being able to meet Standards around 10 Contracts and 7 Business Continuity There is lowest confidence of being able to meet the Standards on 5 Process review and 8 Unsupported OSs

What Next Feedback is being added into the data pack being handed to the partner developing the requirements and the prototype for the Re-Designed Toolkit Builds on SIGNs session earlier this year and end of Last year Builds on work completed on rationalising requirements Further Engagement at regional Groups Testing ideas of the prototype