Security assurance, DSPT, backups, and cyber incidents

Security is part of data protection leadership. UK GDPR requires appropriate technical and organisational measures. Managers do not need to be cyber engineers, but they must know who is responsible for devices, updates, passwords, access, backups, supplier security, incident response, and continuity when digital systems fail.

In England and for work involving NHS systems, the Data Security and Protection Toolkit (DSPT) provides formal assurance for organisations that access NHS patient data, for social care providers under the NHS Standard Contract, and for other organisations where contract or service arrangements require it. Many adult social care providers also use it. The toolkit should support governance and improvement, not become an annual box-ticking exercise.

Security basics leaders should assure

• MFA: multi-factor authentication for remote access, administrator accounts, email, cloud systems, and high-risk supplier portals where available.
• Patch and update: devices, apps, operating systems, routers, and clinical or care systems kept supported and updated.
• Passwords and accounts: no shared administrator accounts, no reused weak passwords, prompt removal of leavers, and password managers where appropriate.
• Email and phishing: staff trained to report suspicious messages and managers prepared for invoice fraud, credential theft, and malicious links.
• Backups: regular, protected, monitored backups with tested restores, including electronic care records, finance, payroll, policies, and key business continuity documents.
• Business continuity: safe downtime procedures for care plans, medicines, emergency contacts, incident reporting, and staff rotas if systems are unavailable.
• Supplier assurance: contract terms, incident contacts, support access controls, vulnerability management, and recovery responsibilities understood.

Availability is a care risk

Data incidents include loss of availability. Ransomware or other failures that block access to electronic care records, eMAR, staff rotas, or emergency contacts can create immediate safety risks in a care setting.

Leaders should rehearse scenarios such as internet outages, a care record system failure, eMAR unavailability, printer failures, or supplier cyber incidents. Staff must have accessible downtime procedures rather than a policy stored only inside the affected system.

DSPT scope and evidence

Cyber resilience is care resilience. Backups, MFA, timely updates, supplier assurance, and tested downtime plans protect residents as well as records.