NHS DSPT

What penetration testing for healthcare involves, whether NHS suppliers must do it, how to scope a test around clinical systems and what to do with the report.

The NHS Data Security and Protection Toolkit now expects independent, evidenced penetration testing rather than a self-declared tick box. Here’s who it applies to and what a compliant report needs.