NHS Data Security and Protection Toolkit
Mandatory annual self-assessment for all organisations that have access to NHS patient data and systems. 40 requirements across 10 National Data Guardian standards covering leadership, staff responsibilities, training, managing data access, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection, and accountable suppliers. Aligned with the National Data Guardian's 10 data security standards and NCSC Cyber Essentials. Applies to all NHS trusts, CCGs, GP practices, social care providers, and third-party suppliers processing NHS data.
| Clause | Title | SP 800-53 Controls |
|---|---|---|
| NDG-1.1 | Standard 1 — Confidentiality of personal confidential data | |
| NDG-1.2 | Standard 1 — Caldicott Guardian appointment and registration | |
| NDG-1.3 | Standard 1 — Staff understanding of DPA 2018 and UK GDPR obligations | |
| NDG-2.1 | Standard 2 — Staff understand NDG data security standards | |
| NDG-2.2 | Standard 2 — Annual data security awareness training completion | |
| NDG-2.3 | Standard 2 — Data security induction for new starters | |
| NDG-3.1 | Standard 3 — Role-appropriate data security training | |
| NDG-3.2 | Standard 3 — Annual training needs analysis | |
| NDG-4.1 | Standard 4 — Role-based access controls for personal confidential data | |
| NDG-4.2 | Standard 4 — Access reviews (joiners, movers, leavers) | |
| NDG-4.3 | Standard 4 — Multi-factor authentication | |
| NDG-4.4 | Standard 4 — Least privilege principle | |
| NDG-5.1 | Standard 5 — Annual process reviews for data security improvement | |
| NDG-5.2 | Standard 5 — Data Protection Impact Assessments | |
| NDG-5.3 | Standard 5 — Information asset register and data flow mapping | |
| NDG-5.4 | Standard 5 — Records of processing activities (ROPA) | |
| NDG-6.1 | Standard 6 — Incident response plan for cyber attacks and data breaches | |
| NDG-6.2 | Standard 6 — Data breach notification to ICO | |
| NDG-6.3 | Standard 6 — Major incident (CareCERT) reporting | |
| NDG-6.4 | Standard 6 — Root cause analysis and lessons learned | |
| NDG-7.1 | Standard 7 — Business continuity planning for data security | |
| NDG-7.2 | Standard 7 — Disaster recovery | |
| NDG-7.3 | Standard 7 — Backup and restore testing | |
| NDG-7.4 | Standard 7 — Critical clinical system availability | |
| NDG-8.1 | Standard 8 — Unsupported system management and end-of-life planning | |
| NDG-8.2 | Standard 8 — Vulnerability patching within 14 days | |
| NDG-8.3 | Standard 8 — IT asset inventory | |
| NDG-9.1 | Standard 9 — Cyber security strategy | |
| NDG-9.2 | Standard 9 — Firewalls and network segmentation | |
| NDG-9.3 | Standard 9 — Malware protection | |
| NDG-9.4 | Standard 9 — Email security (DMARC, SPF, DKIM) | |
| NDG-9.5 | Standard 9 — Web filtering | |
| NDG-9.6 | Standard 9 — Encryption in transit and at rest | |
| NDG-9.7 | Standard 9 — Mobile device management | |
| NDG-9.8 | Standard 9 — Annual penetration testing | |
| NDG-9.9 | Standard 9 — Vulnerability scanning | |
| NDG-10.1 | Standard 10 — IT supplier security assessments | |
| NDG-10.2 | Standard 10 — Data processing agreements | |
| NDG-10.3 | Standard 10 — Sub-processor controls | |
| NDG-10.4 | Standard 10 — Supply chain security |