Independent audit · Leeds
Every year someone asks you to show that patient and client data is protected. We answer it once, evidence it properly, and keep the answer current all year.
No charge. No obligation. No access to your systems.
Without DMARC there is no instruction to receivers about what to do with spoofed mail, and no reporting, so an impersonation campaign against your patients could run without you ever knowing.
What to doPublish a DMARC record at p=none with an rua address, review the reports, then move to p=quarantine and p=reject.
The situation
It arrives in different envelopes, but it is always the same: can you show us the personal data you hold is protected, and can you prove it.
| Who asks | When | What a weak answer costs you |
|---|---|---|
| NHS England, via the DSPT | Every year, 30 June | Your NHS contract is put at risk |
| Your insurer | At renewal | Higher premium, added exclusions, or cover declined |
| Local authority commissioners | Every tender | Scored down or removed from the process |
| CQC or Ofsted | At inspection | A finding recorded against you |
| A patient or family member | Without warning | A complaint that escalates to the ICO |
| The ICO, after an incident | Rarely, but it happens | A reprimand, or a penalty |
The DSP Toolkit moved to outcome-based evidence. Holding a policy is no longer enough; you have to show the control described in it actually operates, and produce the records that prove it. Read our plain-English DSPT guide →
What we check
26 automated technical checks and 59 documentation review criteria, covering all ten National Data Guardian standards behind the DSPT and all five Cyber Essentials controls.
Everything about your organisation reachable from the internet, assessed without any access to your systems.
We load your site in a real browser and record what happens before anyone agrees to anything.
The half no scanner reaches, and where most of the real risk sits.
Assessed on evidence your IT provider produces. We check it against the standard and write it up.
What you receive
Written to be read by a practice manager, not an IT specialist, and presentable to an insurer, a commissioner or an inspector.
Every issue rated by severity and effort, with a named owner: you, your IT provider, or us.
Each finding tied to the DSPT standard, Cyber Essentials control or UK GDPR article it affects.
Your supporting documentation assembled, indexed and kept current against expiry dates.
What to do, in what order, and roughly how long each item takes.
Written confirmation of everything resolved since. Your record of action taken.
One page your partners or trustees will actually read.
How it works
Thirty minutes. What you hold, who asks you to prove it, what deadline you are working to. No charge and no obligation.
We assess your public web and email presence and send you the findings. You see the quality of the work before you spend anything.
Before anything active happens we agree exactly what will be tested, when, and how to stop it. Nothing proceeds until you have signed.
Two to three weeks. Technical assessment, documentation review and evidence assembly.
We talk you through it in plain terms, with your IT provider present if that helps.
Re-test at 60 days. On a retainer we then keep the evidence current and handle the annual submission.
Scope
We assess and evidence. Your IT provider implements. That division is deliberate, and it is why IT providers tend to welcome us: we take the governance paperwork off their desk and leave them the technical work.
Where a client needs penetration testing we introduce them to a CREST-registered partner rather than stretching our own scope.
Investment
No hourly rates. We quote a fixed fee once we know the size of your organisation and which standards apply to you.
Assessment of your public web and email surface, delivered as a written report.
All four components, evidence pack, remediation plan, and a re-test at 60 days.
Everything above, plus DSPT or Cyber Essentials evidence assembly and support through to submission.
Continuous monitoring, quarterly re-assessment, evidence kept current, annual submission handled.
Where you move from an audit onto ongoing assurance, the first months of the retainer are discounted against the audit fee.
Start here
No charge, no obligation, and no access to your systems. You see the quality of the work before you commit to anything.