Status: v1, 2026-10-17. The written record of who is accountable for what under the DSPT. This page exists because the
evidence checklist asks for a named senior person with formally assigned responsibility (item 1.1.5) — a role described
only in a job title is not evidence; a dated assignment with named duties is.
|
|
| Name |
Matthew |
| Role |
SIRO — Senior Information Risk Owner for VeriPath |
| Appointed |
17 October 2026, by his own decision as owner and operator of the platform |
| Applies to |
the whole platform: the application layer, the central reference data, the client-vps estate, and the supplier relationships |
| Deputy |
not appointed — see "Open points" below |
Why the SIRO is the platform owner here. VeriPath is a small organisation and the same person builds, operates and
answers for the platform. That is acceptable for DSPT Category 3 provided the accountability is written down and exercised
— which is what this page does. It is not acceptable for the SIRO's decisions to be taken by a tool or by an agent: the
agents in our estate detect, summarise and draft; the SIRO decides and signs.
- The DSPT submission itself — that the assertions are true, evidence-backed, and published on time; and signing it.
- Policy — that every policy exists, has an owner and a review date, is reviewed, and is actually followed.
- Incidents — that every incident and near miss is reported, investigated, recorded in the
incident register, and that the breach notification
decision (ICO and affected individuals) is taken and recorded.
- Risk — accepting or rejecting residual risk on the risk register,
using the severity and likelihood scales.
- People — that staff are inducted, trained, and bound by confidentiality; that leavers lose access; that
administrators are held to a higher standard.
- Suppliers — that the suppliers handling personal information are listed, assured, and contracted with.
- Evidence — that every DSPT assertion can be produced on request, and that this tree stays the single place it is
found in.
| Date |
Decision |
Record |
| 2026-10-17 |
Accepted the SIAAS technical specification as the technical basis for the service agreement |
Technical specification |
| 2026-10-17 |
Procurement and handover model: client-vps set up on the client's behalf, handed over, our access removed and verified |
§5.1 of the same, and the specimen agreement |
| 2026-10-17 |
Standard 6 consolidated: one policy, one log register |
Policy register |
| 2026-10-17 |
Appointed himself SIRO |
this page |
| Role |
Who |
Scope |
| Platform owner / operator |
Matthew |
Builds and runs the estate: application, app engine, primary server, client-vps estate |
| Incident reporting |
anyone who notices |
Reports through the application's incident channel or directly to the SIRO; the procedure is Responding to Incidents |
| System administrators |
Matthew (sole holder) |
Holds the administrator accounts listed in 4b. Administrator Account Register; bound by the higher-standard agreement at item 4.3.1 |
| Data Protection Officer |
not appointed |
See "Open points" |
- No deputy SIRO. One person is the whole accountability chain and a single point of failure for a submission deadline.
Whether to name a deputy is a decision for the SIRO.
- Data Protection Officer not appointed. As a processor of client data, a DPO is not automatically required; as an
organisation that designs and operates clinical systems it is worth a deliberate decision rather than an omission. Record
whichever way it goes.
- "All staff" is currently one person. The items that assume staff — induction, 95% training, confidentiality
acknowledgements, leavers — should be written so they are proportionate to a one-person organisation now and still
valid when the first employee or contractor joins.
- The SIRO's own administrator work. The same person is the SIRO and the sole system administrator. DSPT tolerates
that at this size, but the audit trail should show the SIRO reviewing what the administrator did, not only doing it.
| Item |
How |
| 1.1.5 — senior responsibility assigned to a named person |
named, dated, with duties and a decision log |
| 4.3.1 — administrators held to a higher standard |
names the administrator and the register holding the agreement |
| 2.x / 3.x — responsibilities, induction and training |
the accountability for them is assigned here; the records themselves are still owed (see the workspace map §3) |