CAF-aligned DSPT explained

CAF-aligned DSPT is the NHS assessment route that applies the Cyber Assessment Framework to cyber security and information governance. It includes health-and-care additions. It assesses the organisation's practices and evidence; it is not a smartcard product certificate. ⁰²⁸

Reviewed 23 October 2026. Read this page for definitions, then use DSPT scope and evidence for RA services to connect them to a deployment.

What do CAF and DSPT mean?

Term	Meaning
Cyber Assessment Framework (CAF)	The National Cyber Security Centre's (NCSC) method for assessing how an organisation manages cyber risks to its essential functions. It describes outcomes and supports expert judgement. ⁰³³
Data Security and Protection Toolkit (DSPT)	NHS England's online self-assessment tool. Organisations with access to NHS patient data and systems use it to report their data security and information-handling practices. ⁰³⁴
CAF-aligned DSPT	The NHS adaptation of CAF for specified organisation types. It changes some terminology and outcomes and adds information governance (IG), including confidentiality and data protection. ⁰²⁸
Essential function	A part of the organisation needed to deliver its services. Scope depends on local consequences of failure or compromise and the systems that support the function. ⁰²⁹
Information assurance	In this guidance, cyber security and IG together. “Information, systems and networks” also covers physical information, such as paper records. ⁰³⁶

How the assessment is structured

The framework moves from broad goals to assessable outcomes. ^{033, 040}

Level	Meaning	Example
Objective	A broad assurance goal.	B: protecting against cyber attacks and data breaches.
Principle	An area that supports the objective.	B4: system security.
Contributing outcome	A result to assess using evidence.	B4.a: secure by design.
Indicator of good practice (IGP)	A description that helps judge whether the outcome is met. It requires informed interpretation.	Evidence that design decisions limit exposure and the effect of vulnerabilities.
Profile	The expected achievement levels assigned to the organisation.	The required level for each outcome, confirmed in its DSPT assessment.

The B4 example comes from the NHS system security guidance. It does not prescribe one printer or workstation build. ⁰³⁰

An IGP is a guide to professional judgement, not an exhaustive checklist. A CAF profile sets target levels; the relevant oversight body determines those targets. Use the NHS-assigned profile for the DSPT return. ^{033, 040}

The five NHS objectives

NCSC CAF has four objectives, A–D. The NHS overlay adds E and extends the assessment to health-and-care information governance. ^{028, 033}

NHS objective	Meaning	Example RA evidence to consider locally
A — Managing risk	Governance and risk management.	Service ownership, asset inventory and supplier dependencies.
B — Protecting against cyber attacks and data breaches	Protective controls.	Operator permissions, supported software, secure configuration and handling of cards.
C — Detecting cyber security events	Monitoring and detection.	Agreed event sources, review responsibilities and escalation.
D — Minimising the impact of incidents	Response and recovery.	A tested workstation rebuild or alternative issuance route.
E — Using and sharing information appropriately	Health-and-care information governance.	Approved handling and retention of cardholder information and print output.

The objective names follow NHS guidance. The RA examples are this wiki's proposed application, not a complete assessment or an official NHS mapping. Use the deployment assurance checklist for more detail. ⁰²⁸

Which version and route apply?

NHS England's 2026–27 DSPT version 9 aligns with NCSC CAF 4.0. Its published submission deadline is 30 June 2027. NCSC CAF and DSPT use separate version numbers. The NHS planning guide describes 49 outcomes in its health-and-care assessment; the NCSC core describes 41. ^{037, 041, 033}

Not every DSPT organisation uses the CAF-aligned route. NHS identifies Category 1 as the CAF-aligned view. Other categories use their applicable assertions and evidence items. See organisation applicability before selecting a profile or assessment form. ⁰³⁸

Use the current NHS version 9 release and downloads and the organisation's assigned requirements. The public outcomes workbook is labelled “no profiles”; it does not establish this deployment's target levels. ⁰³⁷

What does “Standards met” mean?

Each outcome receives an assessment of Not achieved, Partially achieved or Achieved. The DSPT compares those results with the expected levels shown for the organisation. “Standards met” does not require Achieved for every outcome and is a minimum assessment threshold, not proof that all risk has gone. ⁰³⁵

Supporting statements and evidence must justify the selected levels. Where the toolkit references a national directive policy, a “No” response makes that outcome Not achieved. Outcome-based assessment does not remove those policy requirements. ⁰³⁵

This wiki has not selected an organisational profile or assessed any deployment. Continue to scope, evidence and independent assessment, or return to Secure by Design.