DSP and Pen testing for supporting agencies

e-Referral Service (e-RS) e-Referral Service FHIR API
1

We are a consultancy supporting a provider to integrate with e-RS.

The provider uses Salesforce as a platform.

Should the data security-type sections of the API applications be answered as Salesforce, or as the provider?

i.e. Should Salesforce be able to demonstrate their DSP Toolkit credentials, or the provider? Should Salesforce demonstrate a penetration test results, or the provider?

Are either of these examples applicable as a requirement for us, as the supporting implementation consultancy?

2

Hi Tim - It would be the integrating party in all cases, i.e. the supplier providing the software solution.

From what you’ve stated, this sounds like Salesforce.

3

Ok perfect thank you @zubeir.tai !

4

Tim, we’ve added some more guidance here too so you know what we’d expect you to receive from them and how we’ll help review it with our cyber colleagues https://digital.nhs.uk/services/e-referral-service/api/integration-process/stage-2-build section 2.5

1 Like