Listen to this Post
Introduction:
The UK healthcare sector is undergoing a fundamental paradigm shift in how it approaches data security and cyber resilience. Since September 2024, the NHS Data Security and Protection Toolkit (DSPT) has been transitioning from the National Data Guardian’s 10 data security standards to the National Cyber Security Centre’s (NCSC) Cyber Assessment Framework (CAF). This evolution represents far more than a bureaucratic framework change—it marks a decisive move from a “tick-box” compliance culture to an outcome-based resilience model where organisations must demonstrate that their security controls actually work when it matters most.
Learning Objectives:
- Understand the structural and philosophical differences between the legacy DSPT and the CAF-aligned framework
- Master the five CAF objectives and their 47 contributing outcomes for NHS organisations
- Implement practical technical controls across Linux, Windows, and cloud environments to meet CAF requirements
- Develop robust incident response, supply chain security, and AI governance capabilities aligned with CAF v4.0
1. Understanding the CAF-Aligned DSPT: Beyond Compliance
The CAF is a structured, outcome-based framework created by the NCSC to help organisations understand, measure, and improve their cyber resilience. Unlike the previous DSPT approach—which essentially asked “Do you have this control in place?”—the CAF-aligned DSPT asks “Is your security effective in practice?”. This shift is rooted in the Department of Health and Social Care’s Cyber Security Strategy for Health and Social Care 2023-2030, which committed to adopting the CAF as the principal cyber standard.
The CAF-aligned DSPT comprises 47 contributing outcomes—the original 39 CAF outcomes plus 8 additional health-specific information governance outcomes covering data protection, confidentiality, and clinical coding. Organisations self-assess against each outcome using Indicators of Good Practice (IGPs), with achievement levels rated as “Not Achieved,” “Partially Achieved,” or “Achieved”.
The Five CAF Objectives:
| Objective | Focus Area |
|–||
| A – Managing Risk | Governance, accountability, and risk management processes |
| B – Protecting Against Cyber Attack | Controls to prevent or reduce the impact of attacks |
| C – Detecting Cyber Security Events | Monitoring and detection of abnormal activity |
| D – Minimising Impact | Resilience, response, and recovery capabilities |
| E – Using and Sharing Information Appropriately | NHS-specific data protection and IG (added by NHS England) |
2. Step-by-Step Guide to CAF-Aligned DSPT Implementation
Step 1: Define Your Scope and Essential Functions
The first critical task is scoping your essential functions and critical systems. Your CAF-aligned DSPT return must cover all essential functions and the systems that support them. This includes IT systems, Operational Technology (OT), medical Internet of Things (IoT)/Internet of Medical Things (IoMT) devices, and cloud environments.
Step 2: Map CAF Objectives to Existing Controls
Create a mapping matrix that aligns your current security controls against the CAF’s 47 outcomes. Evidence collected for one objective often supports multiple DSPT assertions. Use the NHS England mapping documents to understand where legacy DSPT requirements overlap with CAF outcomes.
Step 3: Formalise Governance and Assurance Structures
Establish regular cyber risk board reviews and document CAF responsibilities in job descriptions. The Senior Information Risk Owner (SIRO) must approve the organisation’s scoping of essential functions and the final toolkit submission. Independent assessments must be conducted by qualified assessors experienced in the CAF.
Step 4: Conduct Technical Controls Gap Analysis
Review your current technical controls against CAF requirements:
Linux: Audit system configuration against CIS benchmarks
sudo apt-get install cis-audit Debian/Ubuntu
sudo yum install cis-audit RHEL/CentOS
sudo audit-system --profile cis_level1_server
Windows: Use PowerShell to check security configurations
Get-MpComputerStatus Check Windows Defender status
Get-WindowsFirewallRule | Where-Object {$<em>.Enabled -eq $True} List enabled firewall rules
Get-Service | Where-Object {$</em>.StartType -eq 'Automatic' -and $_.Status -1e 'Running'} Find failed services
Step 5: Complete Self-Assessment and Arrange Independent Audit
Submit your self-assessment through the DSPT portal, then commission an independent audit to validate your CAF-aligned submission. The deadline for 2025/2026 DSPT submissions is 30 June 2026.
- Technical Controls for CAF Objective B: Protecting Against Cyber Attack
Objective B focuses on implementing proportionate security measures to protect networks and information systems supporting essential functions. This encompasses identity and access management, data security, system security, and resilient networks.
Identity and Access Control (Principle B2)
CAF-aligned DSPT requires that all activities can be traced back to specific individuals, with technical and procedural controls ensuring accountability. Initial identity verification is now a requirement for organisations moving to the CAF-aligned DSPT.
Implementation Commands:
Windows: Enforce MFA and audit privileged access Check for local admin accounts Get-LocalGroupMember -Group "Administrators" Enable advanced audit logging auditpol /set /category:"Logon/Logoff" /subcategory:"Special Logon" /success:enable /failure:enable auditpol /set /category:"Policy Change" /subcategory:"Authentication Policy Change" /success:enable /failure:enable Review privileged access assignments Get-ADGroupMember -Identity "Domain Admins" | Select-Object Name
Linux: Harden SSH and manage sudo access Restrict SSH to specific users and disable root login sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sudo systemctl restart sshd Review sudoers for least privilege sudo visudo Add: %admin ALL=(ALL) ALL Only admin group can use sudo Enable and configure auditd for access monitoring sudo auditctl -w /etc/passwd -p wa -k identity_changes sudo auditctl -w /etc/sudoers -p wa -k sudo_changes
Network and System Security
CAF expects organisations to demonstrate how firewalls, network segmentation, and secure configurations protect essential services. Patch management schedules with evidence of execution must be available.
Linux: Network segmentation and firewall configuration List all listening ports and associated services sudo ss -tulpn | grep LISTEN sudo netstat -tulpn | grep LISTEN Configure UFW (Uncomplicated Firewall) for basic segmentation sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow from 10.0.0.0/8 to any port 443 Allow only internal subnet to HTTPS sudo ufw enable Check for unnecessary services sudo systemctl list-unit-files --type=service --state=enabled | grep -v "@"
Windows: Network security configuration Enable Windows Firewall with advanced security Set-1etFirewallProfile -Profile Domain,Public,Private -Enabled True Configure Windows Defender Firewall rules New-1etFirewallRule -DisplayName "Block SMB from Untrusted Networks" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block -RemoteAddress "192.168.0.0/16" Enable Windows Defender Credential Guard $CredGuard = Get-WindowsOptionalFeature -Online -FeatureName CredentialGuard Enable-WindowsOptionalFeature -Online -FeatureName CredentialGuard -All
4. Detection and Monitoring (CAF Objective C)
Objective C requires organisations to detect abnormal activity and cyber incidents. CAF-aligned assessments look for evidence that organisations have visibility across their entire estate, including IoMT, operational technology, and cloud environments. CAF v4.0 (released August 2025) added improved coverage of AI-related cyber risks, secure software development, and enhanced threat hunting requirements.
SIEM and Logging Configuration:
Linux: Configure rsyslog to forward logs to SIEM sudo cat >> /etc/rsyslog.conf << EOF Forward all logs to SIEM server . @@SIEM_SERVER_IP:514 EOF sudo systemctl restart rsyslog Linux: Hunt for suspicious processes ps aux | grep -E '(sh|bash|curl|wget|python|perl|nc|ncat)' | grep -v grep Check for unusual cron jobs sudo cat /etc/crontab sudo ls -la /etc/cron.d/ for user in $(cut -f1 -d: /etc/passwd); do sudo crontab -u $user -l 2>/dev/null; done
Windows: Enable advanced audit policies
auditpol /set /category:"Detailed Tracking" /subcategory:"Process Creation" /success:enable /failure:enable
auditpol /set /category:"Logon/Logoff" /subcategory:"Logon" /success:enable /failure:enable
Windows: Monitor for suspicious processes (Key Event IDs)
4624 - Successful logon
4625 - Failed logon
4688 - Process creation
1102 - Audit logs cleared
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} -MaxEvents 50 |
Select-Object TimeCreated, @{N='Process';E={$<em>.Properties[bash].Value}},
@{N='CommandLine';E={$</em>.Properties[bash].Value}}
Windows: Enable PowerShell script block logging
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -1ame "EnableScriptBlockLogging" -Value 1 -Type DWord
5. Incident Response and Resilience (CAF Objective D)
CAF-aligned DSPT emphasises preparedness before an incident, not just reports after one. Organisations must have updated incident response plans grounded in thorough risk assessments that cover a range of incident scenarios. NHS England has published a national incident response plan that provides a useful reference point.
Incident Response Playbook Template:
NHS CAF-Aligned Incident Response Playbook <ol> <li>Preparation <ul> <li>Maintain up-to-date asset inventory with criticality classification</li> <li>Document essential functions and dependencies (refer to scoping exercise)</li> <li>Establish communication tree with 24/7 contact details</li> <li>Define roles: Incident Commander, SIRO, IG Lead, Technical Lead, Communications Lead</li> </ul></li> <li>Identification <ul> <li>Alert sources: SIEM, EDR, IDS/IPS, user reports, NHS Digital threat intelligence</li> <li>Triage criteria: Patient impact, data breach likelihood, service disruption</li> <li>Escalation thresholds: P1 (Critical - patient safety risk), P2 (High - significant disruption), P3 (Medium - contained)</li> </ul></li> <li>Containment <ul> <li>Short-term: Isolate affected systems (network segmentation)</li> <li>Long-term: Apply patches, rotate credentials, implement additional monitoring</li> </ul></li> <li>Eradication <ul> <li>Remove threat actor access, malware, and backdoors</li> <li>Verify integrity of critical systems</li> </ul></li> <li>Recovery <ul> <li>Restore from verified backups</li> <li>Validate system functionality before returning to production</li> </ul></li> <li>Lessons Learned (Principle D2) <ul> <li>Conduct post-incident review within 30 days</li> <li>Update playbook based on findings</li> <li>Report to SIRO and Board
Backup and Recovery Verification:
Linux: Verify backup integrity sudo restic check --read-data-subset=5% If using Restic sudo borg check --verify-data If using BorgBackup Linux: Test restoration in isolated environment sudo mkdir /mnt/restore_test sudo mount /dev/backup_volume /mnt/restore_test Validate critical files ls -la /mnt/restore_test/var/lib/clinical_data/
Windows: Test backup and system state recovery Verify Volume Shadow Copy Service (VSS) writers vssadmin list writers Check backup status (Windows Server Backup) Get-WBBackupSet Test system state restore (in non-production environment) wbadmin start systemstaterecovery -version:<Backup_Version> -machine:<MachineName>
6. AI Governance and Supply Chain Security
AI Governance in the CAF Context
CAF v4.0 now includes explicit coverage of AI-related cyber risks. As AI adoption accelerates across the NHS—from clinical decision support to ambient voice technology—organisations must govern AI systems with the same rigour as traditional IT systems. The National Cyber Security Centre has warned that large language models “do not enforce a security boundary between instructions and data inside a prompt,” creating direct patient safety risks.
AI Risk Assessment Checklist:
- Has the AI system been included in the essential functions scoping exercise?
- Are data flows between AI systems and clinical records documented and secured?
- Has prompt injection risk been assessed and mitigated?
- Does the AI system have appropriate access controls (least privilege)?
- Is AI system activity included in SIEM monitoring and log retention?
Supply Chain Security (Principle A4)
Under the CAF-aligned DSPT framework, organisations must obtain assurance that all third-party connections to their network meet security and IG requirements. This includes considering data security and protection incidents that might arise in the supply chain. IT suppliers to the NHS must now demonstrate Cyber Essentials Plus certification and undergo independent CAF-aligned audits.
Supplier Security Verification Commands:
Linux: Audit third-party connections
sudo ss -tulpn | grep ESTABLISHED | grep -v "127.0.0.1" | awk '{print $5}' | sort | uniq -c
Check for unexpected outbound connections
sudo netstat -tulpn | grep ESTABLISHED | grep -v "127.0.0.1"
Review installed packages from third-party repositories
sudo apt list --installed | grep -v "ubuntu" | grep -v "canonical" Debian/Ubuntu
sudo yum list installed | grep -v "redhat" | grep -v "centos" RHEL/CentOS
What Undercode Say:
- The CAF transition is a mindset shift, not just a framework update. Moving from compliance verification to outcome-based resilience requires cultural change across NHS organisations. Security teams must now think in terms of “does our security work?” rather than “do we have the policy?”
-
AI governance is no longer optional—it’s a regulatory requirement. CAF v4.0’s inclusion of AI-related cyber risks signals that the NHS must treat AI systems as critical infrastructure components requiring the same security rigour as traditional clinical systems. The NCSC’s warnings about prompt injection and LLM security boundaries must be taken seriously in healthcare contexts where patient safety is at stake.
-
Technical controls must be validated, not just documented. The CAF-aligned DSPT demands evidence that security controls are effective in practice. Regular testing, tabletop exercises, and independent audits are now mandatory requirements. The era of the “checkbox” compliance approach is definitively over.
-
Supply chain security is a shared responsibility. With NHS organisations increasingly reliant on external suppliers for digital services, the CAF’s focus on supply chain security means organisations must actively manage third-party risks rather than assuming suppliers are secure.
-
Clinical safety is a cyber outcome. As the Health and Social Care Cyber Strategy’s Pillar 4 acknowledges, cyber security is a clinical safety issue. The CAF framework recognises this by tying cyber resilience directly to the continuity of essential functions and patient care.
Prediction:
-
+1 The CAF-aligned DSPT will drive significant improvement in NHS cyber resilience over the next 3-5 years, with measurable reductions in successful ransomware attacks and data breaches as organisations move from reactive to proactive security postures.
-
+1 AI-specific security requirements will become a distinct component of future CAF versions, with dedicated AI governance controls and assessment criteria emerging by 2027 as the NHS scales AI deployment across clinical and administrative functions.
-
-1 Smaller NHS organisations and independent providers may struggle with the resource demands of CAF compliance, potentially creating a two-tier security landscape where larger trusts achieve resilience while smaller practices lag behind.
-
-1 The complexity of the CAF-aligned DSPT—with 47 contributing outcomes and independent audit requirements—may lead to “compliance fatigue” and superficial implementation unless accompanied by adequate training, funding, and simplified guidance.
-
+1 The integration of CAF with the NHS Digital Technology Assessment Criteria (DTAC) will create a unified assurance framework that streamlines procurement and reduces duplication for suppliers and NHS organisations alike.
-
-1 AI supply chain risks—particularly around large language models and third-party AI vendors—will become an increasingly prominent attack vector, requiring continuous monitoring and updated threat models that current CAF guidance may not fully address.
The journey from DSPT to CAF is a challenging but necessary evolution. As Nahida Rahman noted, it represents a fundamental shift from proving compliance to understanding and managing real-world cyber risk. The frameworks are changing—and so must the mindset of everyone responsible for protecting NHS data and systems.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Nahida Rahman – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
