The outcomes it gives you evidence for.
Based on NHS England's CAF-aligned DSPT guidance for B2 identity and access control and C1 security monitoring.
| Outcome | What the guidance says | What Altiward gives you |
|---|---|---|
| B2.c Privileged user management | “You closely manage privileged user access to networks and information systems supporting your essential function(s).” Its evidence includes a procedure for issuing temporary, time-bound privileged access. | Temporary admin through SAP Privileges, with expiry enforced on each Mac and a record of every session: who, which Mac, the reason they gave, and when and how it ended |
| B2.c, logging privileged use | Privileged user actions should be logged so they can be independently reviewed and audited. | A record of each admin session, with what changed while they were admin, kept on your server and in your SIEM for someone other than the admin to review |
| C1.a Sources and tools for logging and monitoring | Lists host-based logs and user activity on individual devices among the sources to monitor. | Each Mac's admin sessions and findings, sent to Splunk, Microsoft Sentinel or any syslog receiver as OCSF events |
| C1.c Generating alerts | “Evidence of potential security incidents contained in your monitoring data is reliably identified.” | Findings when admin rights appear without a grant, an admin account is created, rights outlive their expiry, or an agent stops |
| C1.f Understanding user and system behaviour | Understand normal privileged account use and flag use outside expected patterns. | Time held against time allowed, and admin rights nobody granted, flagged on the Mac where they appear |
Health and care teams with Macs.
Assessed against the CAF-aligned DSPT
NHS organisations, and IT suppliers to health and care, completing the DSPT in its CAF-aligned form.
Managing Macs with an MDM
Mac fleets managed through an MDM such as Jamf or Intune, where people sometimes need admin and SAP Privileges is how they get it.
Keeping the record in-house
You run the Altiward server on your own infrastructure. Events go from your Macs to your server and on to your SIEM, not to us.
What security and IG leads ask.
Does Altiward make us DSPT compliant?
No tool can. Altiward gives you evidence for B2.c and C1 on your Mac devices.
Which version of the guidance is this based on?
NHS England's CAF-aligned DSPT guidance, as checked in October 2026. Check the current wording on the DSPT site before you rely on it.
Does the record leave our network?
No. The server, database and console run where you put them, and nothing phones home. You decide which SIEM the events go to.
Is Altiward linked to NHS England?
No. Altiward isn't affiliated with or endorsed by NHS England or the NCSC.
Altiward is in early access.
Early access is for Mac teams who already deploy SAP Privileges through an MDM such as Jamf or Intune.