Status: REGISTER v1, 2026-10-17. The single index of every policy the DSPT submission can point at. The policy text
lives in the website's CMS (veripath.co.uk/internal/policies/, 19 files) and is edited there; this register is the
evidence trail — who owns each policy, when it is due for review, which DSPT item it answers, and what we decided about it
during the review pass.
SIRO: Matthew, appointed 17 October 2026 — roles and responsibilities.
The four breach decisions in the incident register await his sign-off.
How to use it. Work down the table one policy at a time and set the Verdict to one of:
Links open the published policy (internal visibility — staff sign-in required).
| # | Policy (as titled) | File | Owner | Effective | Review | Status | DSPT items | Verdict |
|---|---|---|---|---|---|---|---|---|
| 1 | 1. Personal Confidential Data | personal-confidential-data.md |
admin | 2026-05-12 | 2027-05-31 | published | 1.1.2, 1.3.1, 1.3.13 | — to review |
| 2 | 1a. Staff Confidentiality Agreement & Acknowledgment Procedure | staff-confidentiality-agreement-acknowledgment-procedure.md |
admin | 2026-05-12 | 2027-05-31 | published | 2.2.1 | — to review |
| 3 | Data Security: Staff Acknowledgement Record | data-security-staff-acknowledgement-record.md |
admin | 2026-05-12 | 2027-05-31 | published (public) | 2.1.1 | — to review |
| 4 | 2. Data Security Policy | data-security-policy.md |
admin | 2026-05-12 | 2027-05-31 | published | 1.3.1, 2.1.1 | — to review |
| 5 | 4. Access Control Register | access-control-register-2.md |
admin | 2026-05-12 | 2027-05-31 | published | 4.1.1 | — to review |
| 6 | 4a. JML Process & Access Reviews | jml-process-access-reviews.md |
admin | 2026-05-12 | 2027-05-31 | published | 4.2.4 | — to review |
| 7 | 4b. Administrator Account Register | administrator-account-register.md |
admin | 2026-05-12 | 2027-05-31 | published | 4.3.1 | — to review |
| 8 | Appendix A: Role Access Matrix | appendix-a-role-access-matrix.md |
admin | 2026-05-12 | 2027-05-31 | published | 4.1.1, 1.3.1 | — to review |
| 9 | 5a. Data Processing Activities | data-processing-activities.md |
admin | 2026-05-12 | 2027-05-31 | published | 1.1.2 (ROPA) | — to review |
| 10 | 6. Data Security Incident Response Policy | data-security-incident-response-policy.md |
admin | 2026-05-12 | 2027-05-31 | published | 6.1.1 | supersede — its incident-log template is carried into the Incident Log; the procedure itself lives in the survivor |
| 11 | 6. Responding to Incidents | responding-to-incidents.md |
admin | 2026-05-12 | 2027-05-31 | published | 6.1.1, 6.1.3 | amend (survivor) — the one policy kept for Standard 6; needs the log reference and the 6.1.3 assessment step added, and its worked example kept |
| 12 | 6b Incident Response Policy | incident-response-policy.md |
— | 2026-05-26 | 2027-05-31 | draft | 6.1.1 | archive — draft that duplicates the survivor section for section |
| 13 | 7. Business Continuity Plan (BCP) | business-continuity-plan-bcp.md |
— | none | none | published | 7.1.2, 7.2.1 | — to review |
| 14 | 8. Unsupported Systems | unsupported-systems.md |
— | none | none | published | 8.1.4, 8.2.1 | — to review |
| 15 | 9a. IT Protection | it-protection.md |
— | 2026-05-26 | 2027-05-31 | published | 9.6.1 | — to review |
| 16 | 9b: Patching & Software Updates | patching-software-updates.md |
— | 2026-05-26 | 2027-05-31 | published | 8.3.5 | — to review |
| 17 | 9c: Encryption | encryption.md |
— | 2026-05-26 | 2027-05-31 | published | 9.5.2 | — to review |
| 18 | 9d: Anti-Malware Protection | anti-malware-protection.md |
— | 2026-05-26 | 2027-05-31 | published | 6.2.1 | — to review |
| 19 | 10. Accountable Suppliers | accountable-suppliers.md |
— | none | none | published | 10.1.2, 10.2.1 | — to review |
responding-to-incidents survives as the single policy — amended with thedata-security-incident-response-policy is superseded and unpublished, its incident-log template carried into6b draft is superseded too.tasks/ (now archived) linked to veripath.co.uk/policies/<slug>, which 404s. The live/internal/policies/<slug>; the links above are the corrected ones.