The DSPT measures compliance using a set of assessment outcomes that reflect how well an organisation meets the mandatory requirements.
There are three possible outcomes:
- Standards Met: All mandatory requirements are satisfied.
- Approaching Standards: Progress has been made, but not all evidence is complete or submitted.
- Not Published: The assessment has not yet been submitted for review.
Organisations should aim to reach “Standards Met” status each year to demonstrate full compliance with the National Data Guardian’s 10 Data Security Standards and applicable Cyber Assessment Framework (CAF) controls.
This status also strengthens contractual assurance and supports ongoing access to NHS systems.
