.svg)
Key Point:
Your organisation needs effective internal processes for managing risks to the security and governance of information, systems, and networks that support your essential functions. This includes processes for Data Protection Impact Assessments (DPIAs).
Overview:
This outcome focuses on ensuring your organisation has a robust process in place to manage risks, ensuring that critical information and systems remain secure.
How to Meet the Requirement:
Risk management processes should be proactive and continuous. Regular risk assessments should be carried out, especially when there are significant changes to systems or processes. The DSPT does not dictate a specific risk assessment method, but it should address your organisation’s priorities, legal obligations, and cyber security risk boundaries.
Consider using Data Protection Impact Assessments (DPIAs) whenever there’s potential high risk to personal data. Additionally, ensure that risk assessments are linked directly to the security controls your organisation has implemented, either by cataloguing controls or by cross-referencing them with risks.
Evidence to Provide:
Submit documentation such as:
This evidence should be cross-referenced to show how it aligns with your organisation’s risk management processes.
Indicators of Good Practice:
Key Point:
Your organisation should ensure the effectiveness of its cyber security and information governance (IG) controls through regular assurance activities.
Overview:
Assurance involves testing whether your cyber security and IG controls are working as expected. Regular testing can help identify weak points and ensure that systems and processes remain secure despite changing conditions or emerging threats.
How to Meet the Requirement:
To build confidence in your security measures, employ techniques such as penetration testing, vulnerability assessments, and behavioural testing (e.g., phishing simulations). Schedule assurance activities regularly, reviewing and updating them to ensure effectiveness. Weaknesses uncovered during these tests should be documented, addressed, and followed up on.
Evidence to Provide:
To demonstrate compliance, consider submitting:
Ensure your supporting statement references how these activities align with your risk management and assurance processes.
Indicators of Good Practice:
Risk Assessment and Threat Analysis:
A comprehensive risk management process should incorporate threat analysis that is both detailed and tailored to your organisation. Stay updated on emerging threats from NHS England’s Cyber Security Operations Centre (CSOC) and other intelligence sources. Incorporate these into your assessments to stay ahead of evolving risks.
Adverse Impacts:
Risk assessments should go beyond immediate impacts, considering potential long-term consequences on operations, reputation, and dependencies on other services. A robust risk management approach should implement measures to mitigate these wider impacts.
Data Protection by Design and by Default:
Ensure that privacy considerations are embedded into your risk management process, particularly when developing new systems, policies, or sharing data. Conduct DPIAs before any high-risk data processing activities to comply with the principles of data protection by design and by default.
Strengthen your organisation’s risk management processes by aligning with the DSPT framework. Whether you need help with risk assessments, threat analysis, or cyber assurance, Periculo is here to support you. Contact us to ensure your organisation's security measures are robust and compliant!
Contact Periculo for expert cyber security solutions tailored to the digital health industry.
