Beyond DSPT: can you prove your cyber controls actually work?

Evidence: the framework was never meant to be the finish line

DSPT is explicitly an annual self-assessment. Its public guidance says organisations respond to mandatory evidence items and confirm assertions before publication, with requirements tailored by organisation type. That structure provides a common baseline and a disciplined prompt for governance. It should not be described as a guarantee that an organisation is secure or will avoid an incident.

The case for additional proof comes from authoritative sources, not a criticism invented outside the system. The National Data Guardian called for audit or objective assurance when the standards were created. ICO security guidance says organisations need processes to test, assess and evaluate whether their technical and organisational measures remain effective, document results and act on findings. NCSC says a compliance-only approach can create overconfidence and mask weak practice.

Analysis: separate design, implementation, operation and assurance

Take leaver access. Design is the rule that former workers must lose access. Implementation is the workflow linking the manager, HR and system administrator. Operation is whether that workflow ran for each person who left. Assurance is a sample showing that accounts across email, care records, rostering and cloud storage were actually disabled as intended.

The distinction prevents weak evidence from being asked to prove too much. A policy shows intent. A completed ticket shows a process step. A system report or attempted login can show an outcome. A repeat sample shows whether improvement has lasted. Boards should ask which level each dashboard measure represents.

A green policy measure is evidence of intent. Assurance begins when the organisation tests the outcome the control was meant to produce.

Practice: test access where identities and roles change

Start with a small sample of recent leavers, role changes, temporary workers and privileged accounts. Confirm what access each person should have, compare it with the live systems and investigate exceptions. Then identify high-consequence services that can still be reached with only a password, shared credentials or an unmanaged supplier account. Multi-factor authentication is valuable, but the assurance question is where it is enforced, for whom and with what exceptions.

This is primarily an organisational test, not a penetration test. It can be run by a manager with support from IT or the system supplier. Evidence might include the sample definition, date, systems checked, exceptions found, risk decision, corrective action and retest. Avoid retaining unnecessary personal data in the assurance record.

Practice: prove the restore, then compare it with care tolerance

A successful backup job shows that a copying process completed. It does not show that the information is complete, usable or recoverable quickly enough. ICO guidance says organisations must be able to restore access and availability to personal data in a timely manner and regularly test the effectiveness of their security measures. The appropriate test and cadence depend on the organisation, its processing and the risk to people.

Choose one critical dataset and restore it through the real recovery route. Check completeness, integrity, permissions and the time taken. Compare that time with the service's operational tolerance: when will staff next need current medicines, risk, rota or contact information? If the supplier controls the backup, establish what evidence it can provide and what the provider can access while the live system is unavailable.

Record the result honestly. A slow but successful restore may still expose a care-continuity gap; an unsuccessful exercise is useful if it produces remediation before a real event.

Practice: exercise the people who will meet the incident first

NCSC's Exercise in a Box is free, requires no specialist expertise and includes scenarios such as ransomware, phishing and supply-chain incidents. Its purpose is to rehearse decisions, test policies and identify improvement. For care, the scenario should begin with an operational problem rather than technical jargon: the care-record and medicines systems are unavailable, the cause is uncertain and the supplier has no recovery estimate.

Run at least part of the exercise with the frontline or out-of-hours team. Can they recognise that the problem needs escalation, find contacts without the shared drive, reach current contingency information, protect people through the next care activity and record temporary decisions? Success is not a flawless performance. It is a clearer plan, corrected contact route and evidence that the action was completed and retested.

Assurance: sample the edges of the operating model

A multi-site provider should not infer estate-wide performance from head office. Sample recent acquisitions, older locations, different care models and sites with unusual suppliers or connectivity. A smaller provider does not need an internal cyber department: one leaver review, one restore, one device check and one tabletop can reveal more than a large untested policy library.

External suppliers belong in the same evidence model. A provider cannot test every control inside a platform, but it can seek proportionate evidence of authentication, recovery, incident communication and independent assurance; check that certification scope matches the service; and test its own continuity when the service is absent. Exceptions should be visible, approved, mitigated and reviewed rather than quietly normalised.

Governance: retain the learning and close the loop

A proportionate assurance record is short: control and risk, test performed, date and scope, result, weakness, owner, target date and retest. Report consequence as well as percentage. Ninety-five per cent MFA coverage can conceal an unprotected administrator account; a perfect backup-success dashboard can conceal that no restore has been attempted.

For CQC-registered services, Regulation 17 requires effective systems and processes to assess, monitor and improve quality and safety, mitigate risks, maintain secure and accurate records, and evaluate and improve information processing. That does not create a prescribed cyber-test schedule, but it makes an evidence-and-improvement loop relevant to good governance. CQC's current care-home registration guidance also asks applicants for a business-continuity plan covering IT failures and cyber attacks; that specific page should not be generalised beyond its care-home registration context.

The board's final question should be simple: what did we test, what did we learn, what changed and has the change been proved?