What Data Security and Protection Toolkit is
The NHS self-assessment, organised by the National Data Guardian’s ten data security standards. NHS trusts now use a CAF-aligned version; use the NCSC CAF report for those.
Who asks for it: NHS suppliers and organisations handling NHS patient data.
What Microsoft 365 can show
8 standards evidenced by 156 checks. A check maps to a standard only where its result is genuine evidence for it, so a standard is listed only when a tenant setting can show it.
Outside Microsoft 365
Staff responsibilities and training (standards 2 and 3), and most of process reviews and continuity planning, are evidenced outside Microsoft 365.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every standard and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- NCSC Cyber Assessment Framework: The NCSC’s outcome-based framework for essential services, the NHS and their suppliers.
- Cyber Essentials: The UK government-backed baseline: five technical controls for every organisation.
- Cyber Essentials Plus: Cyber Essentials, verified by an assessor’s technical tests.
- NCSC 10 Steps: The NCSC’s guidance for boards and organisations, in ten steps.