DSPT scope and evidence for RA services

Assess the RA service within the organisation's applicable DSPT scope. A working smartcard printer is one source of operational evidence. It cannot establish the organisation's overall assessment result.

Reviewed 23 October 2026. Start with CAF-aligned DSPT explained if the terms are unfamiliar. The deployment examples below are local recommendations, not an official NHS assessment form.

Confirm the organisation's route

NHS England's 2026–27 organisation-type guidance determines the toolkit category. Hosting an RA workstation does not, by itself, select that category. ⁰³⁸

Category	Published organisation groups	Assessment route
1	NHS trusts, integrated care boards, commissioning support units, DHSC arm's-length bodies, designated independent operators of essential services and nominated genomics organisations.	CAF-aligned DSPT.
2	IT suppliers that meet the published selection criteria.	Category 2 assertions and evidence items.
3	Includes smaller suppliers, local authorities, social care, dentists, pharmacies, opticians, universities and other listed organisations.	Category 3 assertions and evidence items.
4	General practice.	Category 4 assertions and evidence items.

Confirm the exact classification using the NHS organisation-type guidance, including supplier criteria and any parent/child assessment arrangements. Do not treat this summary as a classification decision. ⁰³⁸

Scope the RA dependencies

For the CAF-aligned route, identify essential functions and their supporting information, systems, networks and suppliers. Consider disruption, degraded operation and compromise, including simultaneous failures. Information-handling requirements can also bring non-essential functions into scope. ⁰²⁹

For this architecture, a useful local record would cover:

The services that depend on issuing or replacing smartcards, and the effect of an extended RA outage.
The workstation, two readers, printer, software packages, administration and support arrangements.
CIS2 and CIM, the internet path, local browser services, USB connections and any separate legacy dependencies.
Cardholder information, diagnostic records, blank cards, printed output and relevant suppliers.
Recovery arrangements, tested alternatives and the owner of each dependency.

These are proposed scoping prompts derived from the reference architecture, not a declaration that every listed item has the same criticality.

NHS requires the prescribed essential-functions template for the final submission. Version 9 adds recovery point objective (RPO), recovery time objective (RTO) and business-owner job-title fields. Record these through the organisation's continuity process and use the template from its DSPT account. ⁰²⁹

The Senior Information Risk Owner (SIRO) must approve both essential-function scope and the final submission. Keep local deployment approval and organisation-wide DSPT approval distinct. ⁰²⁸

Build evidence for outcomes

Assign outcome owners across cyber security and IG. Supporting statements should explain the selected achievement level and identify the evidence that supports it. Justify any equivalent approach to an IGP. Keep sensitive details in controlled records, using references where appropriate. ⁰³⁵

The following examples show how an RA team could contribute. They do not replace the current outcome wording, expected levels or auditor's evidence requirements.

RA evidence	What it can help demonstrate	Limit
Device and software inventory with owners and support status	Known assets and managed configuration.	An inventory alone does not prove effective patching.
CIM role reviews and workstation administration records	Controlled operator and privileged access.	Successful sign-in alone does not test all access controls.
Approved network and local-service configuration, with test results	Deliberate connection boundaries and controlled changes.	Internet-only capability does not establish security of the local configuration.
Recovery procedure and exercise results	Preparedness for loss of workstation, printer or connectivity.	A written recovery plan alone does not demonstrate recovery.
Information-handling and retention decisions	Deliberate management of personal information and output.	A technical build record does not cover every IG duty.

Use the deployment assurance checklist and acceptance plan to organise these records. NHS independent assessment guidance examines the effectiveness of controls as well as their documentation. ⁰⁴⁰

Independent assessment in 2026–27

For the listed CAF-aligned organisations, NHS specifies 11 mandatory audit outcomes plus one selected by the organisation in 2026–27. These include asset management, privileged-user management, identity and access management, secure management, testing and exercising, and records management. Use the complete annual audit list; this page does not replace it. ⁰³⁹

The annual audit sample is separate from the full self-assessment. NHS plans coverage of all 49 outcomes over multiple years. Its planning guide recommends an independent assessment between January and May and board approval of the selected outcomes. Agree the actual scope, timetable and evidence with the assessor. ⁰⁴¹

The organisation's assigned profile determines expected achievement levels. The NHS independent assessment framework describes how assessors review and test the evidence. ⁰⁴⁰

Evidence boundary for this wiki

The wiki records published guidance and proposes deployment checks. It has not accessed an organisation's DSPT account, chosen its profile, performed an audit or submitted a return. VAL-006 remains parked pending actual local assessment evidence. NHS guidance also states that DSPT does not cover every legal or regulatory obligation. ⁰²⁸

Return to Secure by Design, CAF definitions or the evidence matrix.