Gaps linked to requirements
Findings connected to the responses and evidence reviewed. We explain what is incomplete, what needs updating and where further information is needed before a conclusion can be reached.
Prepare for your NHS toolkit submission
Make sense of the Data Security and Protection Toolkit (DSPT), review the evidence behind your responses and identify what still needs attention before you submit.
Know what your responses need to demonstrate
The requirements depend on your organisation type and the assessment period. We start with the toolkit that applies to you, the work already completed and the evidence available to support it.
Your current position
Review completed responses, previous submissions and known gaps. Establish what has changed and who holds the information needed to assess your current position.
Policies and records
Check whether supporting policies, training records and approvals are current and relevant. Identify missing evidence and where written procedures need to reflect how your organisation actually works.
Technology controls
Review the agreed evidence for access controls, device security, backups and information handling. Identify where a response needs technical confirmation from your IT team or provider.
People and responsibilities
Clarify who owns each area, who needs to contribute and who approves the responses. Review the evidence for staff awareness and incident handling where the applicable requirements call for it.
Gaps and dependencies
Identify incomplete responses, unsupported statements and work that depends on another person or supplier. Distinguish missing documentation from controls or practices that need to change.
Readiness for approval
Establish which responses have supporting evidence and which still need work or confirmation. Highlight what your organisation needs to resolve before approving its submission.
A clear view of the work still to do
We agree the depth and format of the assessment output before starting. You should be able to see what supports your responses, what is missing and what needs to happen next.
A practical action plan
Prioritised actions to discuss with the people responsible, including dependencies on staff, management or external suppliers. Identify what needs resolving before submission and the work needed to get there.
Support through the next steps
Your team or existing provider can work through the actions, or ask us to scope further help. Changes to systems, policies or working practices are agreed separately. Your organisation remains responsible for approving and submitting its declaration.
Start with the right assessment scope
We agree the requirements to review, access to evidence, responsibilities, timetable and cost before work begins. This service supports preparation for your submission; it does not replace any required independent DSPT audit.
Confirm the scope
Establish your organisation type, assessment period and submission position. Agree the areas to review and the people who will provide and approve the evidence.
Review the evidence
Work through the agreed responses and supporting records. Discuss unclear answers, missing information and any differences between documentation and practice.
Agree the next actions
Walk through the findings and priorities with your team. Clarify the work needed, who will take it forward and what remains for your organisation to approve.
Be clear before you submit
Tell us your organisation type, where the submission stands and which areas feel unclear. Whether you are starting a first assessment or reviewing an existing one, we will help define the work needed.