The DSPT, the DTAC, the ICB questionnaire. One set of approved records behind every answer.
If you sell software or services to the NHS, every buyer asks how you protect patient data, and each asks in a different format. ClearIMS helps you build and run an ISO 27001 information security management system (ISMS), so the policies, risks and evidence behind your answers already exist, are approved by your people and stay current.
20 minutes with the founder · video or phone · free. Founding places: £150 a month locked for 24 months, after a 30-day free trial with a worked example ISMS (AI drafting starts on a paid plan). No VAT charged.
What NHS buyers ask you for
The Data Security and Protection Toolkit
Organisations with access to NHS patient data and systems must use the DSPT to show they practise good data security. It asks about policies, training, access, incidents and suppliers.
DTAC, if you sell digital health technology
The Digital Technology Assessment Criteria cover data protection and technical security alongside clinical safety. Those sections are quicker when your ISMS already holds the answers.
ICB, trust and practice questionnaires
Integrated care boards, trusts and GP practices send their own supplier security questionnaires, often at renewal. They want answers that are consistent with each other and with what you actually do.
Proof that it’s run, not just written
Good supplier assurance asks when you last tested a restore, reviewed access or handled an incident. That evidence only exists if someone is running the system.
ISO 27001 doesn’t replace the DSPT. But an ISMS covers much of the same ground, so you answer each buyer from one set of approved records instead of starting again.
How ClearIMS helps a small team keep up
The AI drafts and does the admin. A named person in your organisation approves every record; the AI never approves anything.
Questionnaire answers drafted from your records
AI drafts answers to customer security questionnaires from your approved records, with sources, so you can check each answer against the policy it came from before it goes back.
A virtual ISMS manager in your inbox
ClearIMS emails owners about outstanding and overdue actions, and they reply in plain English to update them. Restore tests, access reviews and supplier checks don’t quietly slip.
Got 5 minutes or 5 hours? Start at the top
The Recommended tasks list puts the ISO 27001 work in order, most important first. Whenever someone has time, they work down it, and every task they finish moves your ISMS forward.
“Show me” goes straight to the line
Link a policy to a control in your Statement of Applicability and highlight the lines that relate to it. When an auditor asks “show me”, the link takes you straight to the highlighted part.
Bring your last NHS questionnaire to a 20-minute call.
We’ll show you how ClearIMS would handle it and give you a straight answer on whether it fits your team.
- 30-day free trial first, with a worked example ISMS. AI drafting starts on a paid plan.
- Then a founding place locks £150 a month for 24 months, or £1,500 a year upfront.
- One price for your organisation, unlimited users. No VAT charged.
FURTHER READING
What is a customer security questionnaire, and how do you answer one?
7 min read · UpdatedWhy customers send security questionnaires, what they ask, how to answer them quickly and honestly, and how ISO 27001 makes the next one easier.
ISO 27001 for software development companies
6 min read · UpdatedWhy clients ask software houses and agencies for ISO 27001, what the auditor looks at in a development team, and how to get there without slowing delivery.