Why Our Certifications Matter: Reflecting on Our Latest Data Security and Protection Toolkit Assessment

We recently completed our annual assessment against the NHS Data Security and Protection Toolkit (DSPT) for 2025-26, achieving "Standards Exceeded" status. It is a routine milestone for us, but a useful moment to step back and set out what each of the certifications behind the Aridhia Digital Research Environment (DRE) actually covers, and why it matters to the organisations whose data we host.

Each certification answers a different question that a data steward, an information governance lead or a procurement team will reasonably ask of a Trusted Research Environment (TRE) provider. Taken together, they are why we describe the DRE as a fully certified, cloud-based Trusted Research Environment. The full list is on our certifications page.

NHS Data Security and Protection Toolkit

The DSPT is an online self-assessment that any organisation with access to NHS patient data and systems is expected to complete. It measures performance against the National Data Guardian's data security standards. Our 2025-26 certificate is published on our website.

In practice, a current DSPT submission is often a precondition for a data sharing agreement with an NHS trust or NHS-funded research programme, rather than a nice-to-have. Because it is renewed annually, it also shows that our controls are maintained over time rather than demonstrated once. That said, the DSPT is a self-assessment, which is why we hold it alongside the externally audited certifications below rather than in place of them.

ISO/IEC 27001:2022

ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). Certification is granted after an independent audit and confirms that risk assessment, access control, incident management, supplier oversight and continual improvement are run as a managed system rather than a set of ad hoc controls.

Because it is the most widely recognised security baseline worldwide, 27001 is the certification procurement teams ask for most often, particularly among our international customers.

ISO/IEC 27701:2019

ISO/IEC 27701:2019 extends ISO 27001 into a Privacy Information Management System (PIMS), covering how personal data is identified, processed and protected, and how the roles of controller and processor are handled.

The distinction is important, because security and privacy are related but not the same. A TRE can be very secure and still process personal data in ways a data controller would not accept. 27701 addresses that second question directly, and it maps well onto the obligations our customers carry under the UK and EU General Data Protection Regulation (GDPR).

HITRUST CSF

The HITRUST Common Security Framework (CSF) is a certifiable framework built specifically for healthcare. It harmonises requirements from sources including HIPAA (the US Health Insurance Portability and Accountability Act), NIST and ISO into a single assessed control set.

For US hospitals, research institutes and life sciences organisations, HITRUST plays much the same role that the DSPT plays in the NHS: it is often the expected evidence of health data security.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is a UK government-backed scheme, run by the National Cyber Security Centre (NCSC), covering five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus assesses the same controls, but through hands-on technical testing by an independent assessor rather than self-assessment.

Those five controls address the common attacks behind most real-world compromises. Cyber Essentials is also a requirement for many UK public sector contracts involving personal data, so for NHS and government-funded customers it is frequently a contractual requirement in its own right. The Plus level goes a step further, giving them independent evidence that the controls work in practice and not only on paper.

Working towards: ISO/IEC 42001

We are currently working towards ISO/IEC 42001, the international standard for an Artificial Intelligence Management System (AIMS).

As large language models move inside TREs, data custodians need assurance that AI is governed with the same discipline as data access and output checking. We expect 42001 to become the reference point for that, and it is a natural complement to the governance already built into our AIRA framework for secure, offline AI in the DRE.

Looking ahead

No single certification tells the whole story, and none of them is a substitute for a customer's own due diligence. What they offer together is independent, regularly renewed evidence across security, privacy, health-sector expectations in the UK and US, and, increasingly, AI governance. We will continue to renew each one on its cycle, and we will report on our progress towards ISO/IEC 42001 as it develops. More detail on how these controls are applied within the platform is on our Security and Compliance page.

Certifications are not the only way we hold ourselves to account. We also publicly score the DRE against open specifications for TRE provision, which look beyond security to the supporting services and governance a TRE needs. Our paper Assessing the Aridhia DRE against the SATRE specification for 2026 scores the platform against all four sections of the Standardised Architecture for Trusted Research Environments (SATRE) specification developed under Data and Analytics Research Environments UK (DARE UK), with a full breakdown in its appendix. We have since compared the DRE against the nine sections of the EOSC-ENTRUST TRE survey, run by the EU-funded project building a European network of TREs.

If you would like to know more about our certifications, or need supporting documentation for your own assurance process, please get in touch.