NHS Data Security & Risk Assurance Review
A board-level, independent opinion on whether an organisation is genuinely safe to access NHS data.
Assurance work: we form an independent opinion. We do not implement what we assure.
Delivered by: ISO/IEC 27001:2022 Lead Implementer (BSI)
Scope
Independent assurance on whether an organisation is genuinely safe and appropriate to access NHS data. This is not a DSPT submission service. It is a defensible risk opinion for the decision makers responsible for NHS data access and data sharing. We do not implement the controls we review, which keeps the opinion independent.
What you get
- Assessment against NHS DSPT assertions and evidence expectations
- Review of UK GDPR Article 32 (security of processing)
- Evaluation of ISO/IEC 27001 controls where claimed or referenced
- Identification of residual risks where organisations technically pass but remain high risk
- Clear decision framing: proceed / proceed with conditions / do not proceed
Deliverables
A board-level assurance report with a clear statement of residual risk and accountability, suitable for procurement, data sharing, or partnership decisions
Price
£9,500-13,500
Set by scope, evidence volume and organisational complexity. Fee confirmed in the quotation after written scoping.
All prices exclude VAT. Work outside the stated scope is quoted separately.
Frameworks referenced
Readiness and assurance, kept separate
Where we have built or prepared evidence for a client, we do not also sell that client an independent assurance opinion on the same work. Independence is only worth anything if it is real, so we protect it rather than blur it.
Not sure if this is the right engagement?
Send us a short enquiry and we will tell you which service fits. If your position needs a closer look first, the Paid Scoping & Risk Diagnostic scopes it in one week for a fixed £1,250.