Status: EXECUTED 2026-10-17. The tree below exists and holds what this page says it should; the duplicates are archived
(not deleted) and the policy register is built. The policy review pass has not started — that is the next work, one
standard at a time (§5).
Written 2026-10-17 (session 88), after reviewing
the evidence checklist, the website policy library
(veripath.co.uk/internal/policies/, 19 files), the existing policies/ wiki tree, and the DSPT work products sitting in
/tasks/ and /security/.
One place for the DSPT submission and everything behind it:
compliance/governance-compliance/
├── dspt-workspace ← this page: map, status, plan
├── dspt_evidence_checklist ← the 10 standards / 27 evidence items (already here)
├── dspt-standards/ ← the working analysis, per standard group (already here)
├── policies/ ← the policy set, one page per policy
├── evidence/ ← the technical evidence: assessments, statements, logs
├── guides/ ← the operational how-tos (monitoring, patching, encryption setup)
└── registers/ ← the registers the standards ask for (assets, staff, suppliers, access)
The rule for the tree: a page lives here if it answers a DSPT item. Anything that is really a project, a plan or a
build record stays where it is and is linked.
| Location | What it is | Count | Disposition |
|---|---|---|---|
veripath.co.uk/internal/policies/ (site CMS) |
The policy library: 19 files with effective/review dates, owner, status, visibility | 19 | Keep as the published copy — see decision 1 |
policies/ (wiki) |
Copies of most of the above, unevenly named (standard_1a, standard_4b, standard_9d_anti_malware…) |
17 live + 1 archived | Archive — duplicates of the CMS set (verified: policies/standard_9 is the same document as it-protection.md) |
compliance/governance-compliance/dspt-standards/ |
The three working standards pages: 1–3 governance, 4–6 operations, 7–10 technical (~133 KB) | 3 | Keep — this is the maintained copy |
infrastructure/compliance/ |
A second, earlier set of the same three standards pages (~63 KB) plus categories/risk/severity pages | 6 | Merge then archive the three standards duplicates; keep the risk and severity pages as registers/ |
tasks/ |
The DSPT work products: Standard 9 summary, firewall & boundary assessment, evidence statement, patching assessment, patching log, anti-malware assessment, encryption assessment — plus a duplicate evidence checklist (13.5 KB vs the 6.1 KB version here) | 8 | Move 7 to evidence/; archive the duplicate checklist after comparing |
security/ |
Four DSPT operational guides: monitoring, operations, quick reference, security setup | 4 | Move to guides/ |
compliance/dspt-deadline-submissions |
Submission deadlines and republishing guidance | 1 | Keep at the top of the tree |
Left alone because they are business material, not compliance evidence: business_plan/post-dspt/* and its archived twin
(four pages about what happens after accreditation), and tasks/multi-tenant-architecture.
The checklist is 10 standards and 27 evidence items. This is the honest map — "not found" means I could not find an
artefact for it anywhere in the estate, not that nobody has ever done it.
| Standard | Evidence item | Artefact we can point at today | Status |
|---|---|---|---|
| 1 Personal confidential data | Physical controls (1.3.13) | none — no premises-control record | not found |
| Senior responsibility assigned (1.1.5) | Roles & Responsibilities — SIRO appointed 17 Oct 2026 | present | |
| IAR + ROPA, reviewed in 12 months (1.1.2) | data-processing-activities.md (ROPA); no IAR |
partial | |
| Data protection & cyber policies current (1.3.1) | the 19-policy library, effective May 2026 | needs review | |
| 2 Staff responsibilities | Induction covers data security (2.1.1) | none | not found |
| Contracts carry data security requirements (2.2.1) | staff-confidentiality-agreement-acknowledgment-procedure.md |
partial | |
| 3 Training | 95% completed in 12 months (3.2.1) | none — no training log | not found |
| 4 Managing data access | Staff/roles record (4.1.1) | access-control-register-2.md, administrator-account-register.md, appendix-a-role-access-matrix.md |
present |
| Leavers/role changes reliable (4.2.4) | jml-process-access-reviews.md |
present | |
| Administrators signed a higher-standard agreement (4.3.1) | register exists; signed agreements not evidenced | partial | |
| 5 Process reviews | Post-incident process review (5.1.1) | incident records exist (infrastructure/security/incidents/*) but no process-review record |
partial |
| 6 Responding to incidents | Breach reporting system + log (6.1.1) | resolved 17 Oct — one policy (responding-to-incidents, amended) plus the incident register; the superseded pair is unpublished |
present |
| Risk assessment + notification decision (6.1.3) | the register carries the two judgements per event and policy §8 sets the decision rule; four decisions await SIRO sign-off | present | |
| Anti-malware everywhere (6.2.1) | anti-malware-protection.md + tasks/antimalware-assessment |
present | |
| 7 Continuity | BCP covers data/cyber (7.1.2) | business-continuity-plan-bcp.md — no effective or review date |
needs review |
| Reviewed and tested in 12 months (7.2.1) | infrastructure/SIAAS/cold_standby describes posture; no test record |
partial | |
| 8 Unsupported systems | Support status of everything (8.1.4/8.2.1) | unsupported-systems.md — no dates; no asset register with OS versions |
needs review |
| Updates installed promptly (8.3.5) | patching-software-updates.md + patching log + the live maintenance record view |
present | |
| 9 IT protection | Device encryption (9.5.2) | encryption.md + tasks/encryption-assessment |
present |
| Boundary firewalls (9.6.1) | firewall assessment + evidence statement | present | |
| 10 Accountable suppliers | Supplier list with what they handle (10.1.2) | accountable-suppliers.md — no dates |
needs review |
| Supplier cyber assurance (10.2.1) | none held (Fasthosts ISO 27001 is claimed in it-protection.md) |
partial | |
| Contracts/DPAs with security requirements | the new specimen service agreement covers our clients; supplier-side DPAs not held | partial |
Headline, after the first review pass (17 October 2026): 9 rows are now credibly covered, 11 need review or are
partial, and 3 are not found at all — physical premises controls (1.3.13), induction (2.1.1) and training records (3.2.1).
The pattern has not changed: the gaps are in the "people" standards (1, 2, 3, 5), not the technical ones, which is what you
would expect from an estate built by engineers.
missing nine are all in the "people" standards (1, 2, 3, 5) rather than the technical ones, which is exactly what you would
expect from an estate built by engineers.
policies/ tree is a stale copy ofpolicies/ tree (17 pages) as duplicates. Confirm — it is a delete-from-nav move, reversible.compliance/governance-compliance/dspt-standards/* ~133 KB versusinfrastructure/compliance/dspt-standards-* ~63 KB): keep the larger, newer set and archive the other. Confirm I shouldAll fourteen work products moved into evidence/, guides/ and registers/; five duplicate artefacts archived under
archive/; the policy register created from the CMS
frontmatter. Every action was a move, so each is reversible, and nothing was deleted.
policies/, evidence/, guides/, registers/ under this tree.tasks/ → evidence/; 4 guides from security/ → guides/; the risk andinfrastructure/compliance/ → registers/.policies/ tree (17 pages); the duplicate checklist (after comparing the 13.5 KB and 6.1 KB