<!-- Derived Markdown alternate of caf-dspt.md; canonical repository sources and registered evidence retain authority. -->


# CAF-aligned DSPT explained

**CAF-aligned DSPT is the NHS assessment route that applies the Cyber Assessment Framework to cyber security and information governance.** It includes health-and-care additions. It assesses the organisation's practices and evidence; it is not a smartcard product certificate. [SRC-028](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-028)

Reviewed **23 October 2026**. Read this page for definitions, then use [DSPT scope and evidence for RA services](https://nhs-smartcard-printing-wiki.pages.dev/dspt-assessment/index.md) to connect them to a deployment.

## What do CAF and DSPT mean?

| Term | Meaning |
|---|---|
| Cyber Assessment Framework (CAF) | The National Cyber Security Centre's (NCSC) method for assessing how an organisation manages cyber risks to its essential functions. It describes outcomes and supports expert judgement. [SRC-033](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-033) |
| Data Security and Protection Toolkit (DSPT) | NHS England's online self-assessment tool. Organisations with access to NHS patient data and systems use it to report their data security and information-handling practices. [SRC-034](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-034) |
| CAF-aligned DSPT | The NHS adaptation of CAF for specified organisation types. It changes some terminology and outcomes and adds information governance (IG), including confidentiality and data protection. [SRC-028](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-028) |
| Essential function | A part of the organisation needed to deliver its services. Scope depends on local consequences of failure or compromise and the systems that support the function. [SRC-029](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-029) |
| Information assurance | In this guidance, cyber security and IG together. “Information, systems and networks” also covers physical information, such as paper records. [SRC-036](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-036) |

## How the assessment is structured

The framework moves from broad goals to assessable outcomes. [SRC-033](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-033), [SRC-040](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-040)

| Level | Meaning | Example |
|---|---|---|
| Objective | A broad assurance goal. | B: protecting against cyber attacks and data breaches. |
| Principle | An area that supports the objective. | B4: system security. |
| Contributing outcome | A result to assess using evidence. | B4.a: secure by design. |
| Indicator of good practice (IGP) | A description that helps judge whether the outcome is met. It requires informed interpretation. | Evidence that design decisions limit exposure and the effect of vulnerabilities. |
| Profile | The expected achievement levels assigned to the organisation. | The required level for each outcome, confirmed in its DSPT assessment. |

The B4 example comes from the [NHS system security guidance](https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/objective-b/principle-b4-system-security). It does not prescribe one printer or workstation build. [SRC-030](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-030)

An IGP is a guide to professional judgement, not an exhaustive checklist. A CAF profile sets target levels; the relevant oversight body determines those targets. Use the NHS-assigned profile for the DSPT return. [SRC-033](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-033), [SRC-040](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-040)

## The five NHS objectives

NCSC CAF has four objectives, A–D. The NHS overlay adds E and extends the assessment to health-and-care information governance. [SRC-028](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-028), [SRC-033](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-033)

| NHS objective | Meaning | Example RA evidence to consider locally |
|---|---|---|
| A — Managing risk | Governance and risk management. | Service ownership, asset inventory and supplier dependencies. |
| B — Protecting against cyber attacks and data breaches | Protective controls. | Operator permissions, supported software, secure configuration and handling of cards. |
| C — Detecting cyber security events | Monitoring and detection. | Agreed event sources, review responsibilities and escalation. |
| D — Minimising the impact of incidents | Response and recovery. | A tested workstation rebuild or alternative issuance route. |
| E — Using and sharing information appropriately | Health-and-care information governance. | Approved handling and retention of cardholder information and print output. |

The objective names follow NHS guidance. The RA examples are this wiki's proposed application, not a complete assessment or an official NHS mapping. Use the [deployment assurance checklist](https://nhs-smartcard-printing-wiki.pages.dev/security-assurance/index.md) for more detail. [SRC-028](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-028)

## Which version and route apply?

NHS England's **2026–27 DSPT version 9** aligns with **NCSC CAF 4.0**. Its published submission deadline is **30 June 2027**. NCSC CAF and DSPT use separate version numbers. The NHS planning guide describes 49 outcomes in its health-and-care assessment; the NCSC core describes 41. [SRC-037](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-037), [SRC-041](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-041), [SRC-033](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-033)

**Not every DSPT organisation uses the CAF-aligned route.** NHS identifies Category 1 as the CAF-aligned view. Other categories use their applicable assertions and evidence items. See [organisation applicability](https://nhs-smartcard-printing-wiki.pages.dev/dspt-assessment/index.md#confirm-the-organisations-route) before selecting a profile or assessment form. [SRC-038](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-038)

Use the current [NHS version 9 release and downloads](https://www.dsptoolkit.nhs.uk/News/169) and the organisation's assigned requirements. The public outcomes workbook is labelled “no profiles”; it does not establish this deployment's target levels. [SRC-037](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-037)

## What does “Standards met” mean?

Each outcome receives an assessment of Not achieved, Partially achieved or Achieved. The DSPT compares those results with the expected levels shown for the organisation. “Standards met” does not require Achieved for every outcome and is a minimum assessment threshold, not proof that all risk has gone. [SRC-035](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-035)

Supporting statements and evidence must justify the selected levels. Where the toolkit references a national directive policy, a “No” response makes that outcome Not achieved. Outcome-based assessment does not remove those policy requirements. [SRC-035](https://nhs-smartcard-printing-wiki.pages.dev/sources/index.md#src-035)

This wiki has not selected an organisational profile or assessed any deployment. Continue to [scope, evidence and independent assessment](https://nhs-smartcard-printing-wiki.pages.dev/dspt-assessment/index.md), or return to [Secure by Design](https://nhs-smartcard-printing-wiki.pages.dev/secure-by-design/index.md).