The session will commence at 14.00 Please mute your microphone Data Security and Protection Toolkit Welcome The session will commence at 14.00 Please mute your microphone Presented by: David Ingham and John Hodson, NHS Digital

What is the Data Security and Protection Toolkit Online data security self assessment Replacement for the IG Toolkit Lets organisations measure themselves against the NDG Data Security Standards Provides help for organisations with support to comply with GDPR All organisations that process health and care data should complete a Data Security and Protection Toolkit.

Why data security is important It’s about Trust! “Trust cannot be ensured without secure systems…” People trust the health and care system to protect information. Data Security must support digital transformation otherwise the risk of breaches increase and trust will be lost.

Why is it changing Static for a long period of time GDPR New threats Move to continuous improvement model NDG Report Making the first step more straightforward for smaller organisations Provide intelligence to CQC for inspections.

Where we are DSP Toolkit is now open for registration Development continuing every week and will continue throughout the year Main focus on the development and testing of the GDPR Breach reporting Guidance being continuously updated.

Take up

What has changed? Requirements reflect the 10 NDG Data Security Standards Support key requirements under the General Data Protection Regulation Move away from level 1,2,3 and towards ‘mandatory’ evidence items Removed duplication Concise, clear requirements Documentary evidence only required where it adds value Exemptions for organisations which use NHSmail or have in place a relevant standard. The requirements of the Data Security and Protection Toolkit (DSPT) are designed to encompass the National Data Guardian review’s 10 data security standards. The requirements of the DSPT support key requirements under the General Data Protection Regulation (GDPR), identified in the NHS GDPR checklist. The IG Toolkit assessed performance against three levels 1, 2 and 3. Organisations were required to provide evidence of compliance with (at least) level 2 for all elements of their assessment. The DSPT does not include levels and instead requires compliance with assertions and (mandatory) evidence items. The assertions and evidence items are designed to be concise and unambiguous. Documentary evidence is only requested where this adds value. Some evidence items will not be required where an organisation uses NHSmail, or has in place an existing relevant standard (Cyber Essentials PLUS, ISO 27001, Public Service Network Information Assurance).

Hardest requirements in DSPT 95% of all staff to have data security training Information Asset register Data protection Impact Assessments Understanding your data flows Understand who has access to all your systems Organisations must survey their software for unsupported systems Organisations must ensure all networking components have had their default passwords changed.

What is coming Public view Combined reporting Secondary sectors Provide evidence for multiple organisations Batch submission Peer benchmarking Generate an action plan Assessment Review.

Support for GPs Ability of IT suppliers / CCGs to provide evidence for GP practices To avoid emailing out 000s of evidence item to GPs GP IT support contract Can vary between suppliers Accountability versus responsibility.

Communications GP email going out this week. Webinars https://www.dsptoolkit.nhs.uk/News/10 Beginners Guide 07/06 Third Sector 13/06 Social Care 21/06 Dentists 19/06 Optician 26/06 Incident Reporting 12/06 Incident Reporting 03/07 What additional communications would you find useful?

Help and Support Register https://www.dsptoolkit.nhs.uk/Account/Register Presentation developed to be used by IG Leads. https://www.dsptoolkit.nhs.uk/News/25 FAQs including Training Tool. https://www.dsptoolkit.nhs.uk/News/9 DSP Toolkit Support available through. Exeter.helpdesk@nhs.net Toolkit training and update events https://www.dsptoolkit.nhs.uk/News/10

Demonstration

Questions? cybersecurity@nhs.net