Understanding DSPT contributing-outcome mapping in Folelse

The NHS Data Security and Protection Toolkit (DSPT) is an online self-assessment tool that NHS organisations must complete annually. For 2025/26 (v8) it is aligned to the NCSC Cyber Assessment Framework (CAF). Folelse maps every CAF contributing outcome to the relevant data in your account, automatically linking evidence as you complete compliance activities.

How the DSPT is structured

The CAF groups contributing outcomes under five objectives (A–E). Each outcome is rated Achieved, Partially Achieved, or Not Achieved — replacing the older "Standards Met / mandatory assertions" model. For example, staff data security training sits under Objective B (protecting against cyber attack), and DPIAs and information-risk management sit under Objective A (managing risk).

How Folelse links to the contributing outcomes

• Your ROPA entries auto-populate Objective E (using and sharing information appropriately) evidence.
• Your policy acknowledgement and training data populate Objective B (staff awareness & training) outcomes.
• Your Information Asset Register populates Objective A (managing risk — asset management) outcomes.
• Your supplier due diligence records populate Objective A (managing risk — supply chain) outcomes.
• Your risk register entries populate Objective A (managing risk) outcomes.
• Your DPIA records populate Objective A (managing risk) and Objective E outcomes.

Viewing outcome completion

1. 1 Go to Dashboard → DSPT.
2. 2 Each of the five objectives (A–E) is shown with a completion summary.
3. 3 Click on an objective to expand it and see individual contributing outcomes.
4. 4 Achieved outcomes are green; Partially Achieved are amber; Not Achieved are red.
5. 5 Click on an outcome to see what evidence is linked and what is still needed.