---
title: "Compliance and Accreditations"
canonical: "https://wiki.patientsknowbest.com/space/IG/3510239352/Compliance%20and%20Accreditations"
format: markdown
---
> Macro (toc)
# **Cyber Essentials**
Cyber Essentials
# Cyber Essentials Plus
Cyber Essentials Plus
PKB has been tested against the [Cyber Essentials Scheme Test Specification](https://www.ncsc.gov.uk/cyberessentials/overview).
Certification date: 26th June 2025
Recommended re-assessment date: 26th June 2026
Certificate no.: **cc4b6d9t-5452-4f36-9098-ec34f5fcea1e**
Verification: [Cyber Essentials Certificate Validator](https://iasme.co.uk/cyber-essentials/ncsc-certificate-search/).
# ISO Standards
## ISO 27001 - Information Security Management (ISMS)
ISO 27001 - Information Security Management (ISMS)
**Google Cloud Platform (GCP)**
Our cloud hosting partner GCP is ISO 27001 certified. For full details on GCP’s compliance please see their [dedicated webpage](https://cloud.google.com/security/compliance/iso-27001).
> Macro (iframe)
**[Download certificate](https://drive.google.com/file/d/1_pnCsk4-PldikTG1A1YdasxGWy9dU0nF/view?usp=sharing)**** **
**PKB **
PKB is fully compliant with the ISO27001 standard, we have implemented an Information Security Management System and we maintain up-to-date policies, practices and documentation to support this.
**Please see:**
1. [PKB Information Security Management Plan EU](https://drive.google.com/file/d/1jJDHHzF8DN_VIDO2VgtQjCkJIbUKSVP8/view?usp=share_link)
2. [PKB Information Security Management Plan UK](https://drive.google.com/file/d/1UBnDKCeBovio-zD2Q5ix0-vHC11MyXEx/view?usp=sharing)
## ISO 27017 - Cloud Security
ISO 27017 - Cloud Security
Our cloud hosting partner Google Cloud Platform (GCP) is ISO 27017 certified. For full details on GCP’s compliance, please see their [dedicated webpage](https://cloud.google.com/security/compliance/iso-27017).
> Macro (iframe)
## ISO 27018 - Protecting PII in Public Clouds
ISO 27018 - Protecting PII in Public Clouds
ISO 27018 is the international standard for protecting personal information in cloud storage. Our cloud hosting partner Google Cloud Platform (GCP) is ISO 27018 certified. For full details on GCP’s compliance, please see their [dedicated webpage](https://cloud.google.com/security/compliance/iso-27018).
> Macro (iframe)
## ISO 27701 - Privacy Information Management
ISO 27701 - Privacy Information Management
ISO/IEC 27701 is a global privacy standard that focuses on the collection and processing of personally identifiable information (PII). Our cloud hosting partner Google Cloud Platform (GCP) is ISO 27701 certified. For full details on GCP’s compliance, please see their [dedicated webpage](https://cloud.google.com/security/compliance/iso-27701).
> Macro (iframe)
## ISO 9001 - Quality Management System
ISO 9001 - Quality Management System
ISO 9001 is the global standard, which companies implement to help ensure the quality of products brought to market. Patient Know Best’s quality management system is detailed [here](https://wiki.patientsknowbest.com/space/IG/3605987345/ISO+9001). Our cloud hosting partner Google Cloud Platform (GCP) is ISO 9001 certified. For full details on GCP’s compliance, please see their [dedicated webpage](https://cloud.google.com/security/compliance/iso-9001).
---
# **NHS Standards**
## DSPT - Data Security and Protection Toolkit
> Macro (excerpt-include)
## DTAC - Digital Technology Assessment Criteria
DTAC - Digital Technology Assessment Criteria
The Digital Technology Assessment Criteria for health and social care (DTAC) gives staff, patients and citizens confidence that the digital health tools they use meet our clinical safety, data protection, technical security, interoperability and usability and accessibility standards.
# Purpose and Scope
The DTAC brings together legislation and good practice across clinical safety, data protection, technical security, interoperability and usability and accessibility standards and is designed to be used by healthcare organisations to assess suppliers at the point of procurement or as part of a due diligence process, to make sure new digital technologies meet our minimum baseline standards.
Patients Know Best (PKB) passed NHS England’s DTAC assessment in February 2022. PKB have an ongoing commitment to developing and running the platform with the required security, governance and accessible standards for our users.
The DTAC is a living document and is reviewed periodically to ensure that the most up to date information is provided in relation to the five core components.
# Product Overview
Patients Know Best is a Personal Health Record system. PKB facilitates borderless, integrated care. The system connects information from primary, secondary, social and mental health care providers, to create a single, unified copy of patient data accessible by patients and their carers. Patients can also upload their own data to help them self-manage their health and wellbeing. This includes a symptom tracker and uploading measurements for patients to see their trends. Organisations can choose what data to release to patients, including diagnoses, allergies, medications, dynamic care plans, test results, measurements and documents.
The PKB platform does not suggest actions to patients, it is a data store to allow patients to both see and save their data securely. Where organisations choose to, asynchronous messaging allows a patient to contact their clinical teams for shared decision making.
# DTAC
PKB’s DTAC can be accessed here:
- [DTAC](https://docs.google.com/spreadsheets/d/1KUm0kAbnO6VS6BRl1RbZjzYP-KXSg_eQGrgqJpRYBOM/edit?gid=1511350482#gid=1511350482)
# Supporting Documentation
- B4 / D1.1: [User Journey](https://drive.google.com/file/d/1pK3CPdPodEQrTcaVuxCXqfQfyzcAZ557/view?usp=sharing) & [Data Flows](https://wiki.patientsknowbest.com/space/IG/3404529669/Dataflows)
- C1.2.3 / C1.2.4: - [Clinical Safety Case Report](https://drive.google.com/file/d/1JCL0I11kAl0C6daHK9IgZlADlHzsT6zs/view)
- C1.2.4: [Hazard Log](https://docs.google.com/spreadsheets/d/1o8rviDQ1DOHZopSttS4xQqyQ9N91vLtmUSGca_edj-o/edit?gid=682896354#gid=682896354)
- C2.1: [DSPT](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510239418)
- C2.2.1: [ICO registration](https://ico.org.uk/ESDWebPages/Entry/Z2704931)
- C2.2.2: [DPIA (UK / NHS)](https://wiki.patientsknowbest.com/space/IG/3523674162)
- C2.2.3: [Transparency information](https://wiki.patientsknowbest.com/space/IG/4062576855)
- C2.2.4: [Privacy Notice & User Agreements](https://wiki.patientsknowbest.com/space/IG/4062576855)
- C3.1: [Cyber Essentials Certification](https://wiki.patientsknowbest.com/space/IG/3510239380/Cyber+Essentials+Plus)
- C3.3: External Penetration Test Summary Report - available on request. A request can be made [here](https://patientsknowbest.com/contact-us/).
- D1.4.3: [Accessibility Statement](https://wiki.patientsknowbest.com/space/MAN/4062838951)
# Data Security and Protection Toolkit
[https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510239418](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510239418)
# SOC2
> Macro (include)
# Other Compliance
## NEN 7510
- [https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510501577](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510501577)
## ODS, ICO, etc.
- [https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510501509](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510501509)
## DCB0129 / DCB0160
- [https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3650879489](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3650879489)