<?xml version="1.0"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.2 20190208//EN" "JATS-journalpublishing1.dtd"[]>
<article xml:lang="en" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:mml="http://www.w3.org/1998/Math/MathML" dtd-version="1.2" article-type="research-article">
<front>
<journal-meta>
<journal-id journal-id-type="publisher-id">IJPDS</journal-id>
<journal-title-group>
<journal-title>International Journal of Population Data Science</journal-title>
<abbrev-journal-title>IJPDS</abbrev-journal-title>
</journal-title-group>
<issn pub-type="epub">2399-4908</issn>
<publisher>
<publisher-name>Swansea University</publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id pub-id-type="doi">10.23889/ijpds.v11i5.3474</article-id>
<article-id pub-id-type="publisher-id">11:5:3474</article-id>
<article-id pub-id-type="pii">S2399490821034741</article-id>
<article-categories>
<subj-group subj-group-type="heading">
<subject>Population Data Science</subject>
</subj-group>
</article-categories>
<title-group>
<article-title>Aligning TRE Assurance Frameworks in the UK: A SATRE-Based Control Alignment Approach</article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author"><name><surname>Johnston</surname><given-names initials="J">Jenny</given-names></name><xref ref-type="aff" rid="affil-1"><sup>1</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Sheane</surname><given-names initials="S">Symone</given-names></name><xref ref-type="aff" rid="affil-1"><sup>1</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Billins</surname><given-names initials="T">Tom</given-names></name><xref ref-type="aff" rid="affil-2"><sup>2</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Higgins</surname><given-names initials="D">Daniel</given-names></name><xref ref-type="aff" rid="affil-3"><sup>3</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Almond</surname><given-names initials="E">Emily</given-names></name><xref ref-type="aff" rid="affil-3"><sup>3</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Hagen</surname><given-names initials="J">Jo-Anna</given-names></name><xref ref-type="aff" rid="affil-4"><sup>4</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Nadin</surname><given-names initials="R">Rhys</given-names></name><xref ref-type="aff" rid="affil-5"><sup>5</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Whiting</surname><given-names initials="A">Anne</given-names></name><xref ref-type="aff" rid="affil-6"><sup>6</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Milligan</surname><given-names initials="G">Gordon</given-names></name><xref ref-type="aff" rid="affil-1"><sup>1</sup></xref></contrib>
<contrib contrib-type="author"><name><surname>Cole</surname><given-names initials="C">Chris</given-names></name><xref ref-type="aff" rid="affil-1"><sup>1</sup></xref></contrib>
<aff id="affil-1"><label>1</label><institution>University of Dundee, Dundee, United Kingdom</institution></aff>
<aff id="affil-2"><label>2</label><institution>Health Innovation East, Cambridge, United Kingdom</institution></aff>
<aff id="affil-3"><label>3</label><institution>Department of Health and Social Care, London, United Kingdom</institution></aff>
<aff id="affil-4"><label>4</label><institution>UK Stats Authority, London, United Kingdom</institution></aff>
<aff id="affil-5"><label>5</label><institution>Office of National Statistics, London, United Kingdom</institution></aff>
<aff id="affil-6"><label>6</label><institution>EPCC, University of Edinburgh, Edinburgh, United Kingdom</institution></aff>
</contrib-group>
<pub-date date-type="pub" publication-format="electronic"><day></day><month></month><year></year></pub-date>
<pub-date date-type="collection" publication-format="electronic"><year></year></pub-date>
<volume>11</volume>
<issue>5</issue>
<elocation-id>3474</elocation-id>
<permissions>
<license license-type="open-access" xlink:href="https://creativecommons.org/licenses/by-nc-nd/4.0/">
<license-p>This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.</license-p>
</license>
</permissions>
<self-uri xlink:href="https://ijpds.org/article/view/3474">This article is available from the IJPDS website at: https://ijpds.org/article/view/3474</self-uri>
<abstract>
<p>Trusted Research Environments (TREs) are a core part of the UK’s sensitive data research infrastructure. There is an unclear assurance landscape for operators, however. Currently, organisations can rely on different overlapping frameworks such as ISO 27001, the Digital Economy Act, the NHS England Data Security and Protection Toolkit, Cyber Essentials, and a draft NHS Secure Data Environment (SDE) Accreditation, each with its own language and level of detail. As a result, TREs are often required to evidence the same controls multiple times, and data controllers struggle to judge whether different assurance routes are genuinely equivalent. The Standardised Architecture for TREs (SATRE) specification is a community-developed definition of the capabilities that TREs should have to ensure safe and secure management of sensitive data for the purposes of research. Here, we describe a SATRE-centred alignment method that maps controls from the major UK frameworks into a single Control Alignment Table (CAT). The aim was to create a common structure that makes alignment clearer and reduces duplication. The CAT will help TRE operators organise evidence more consistently, simplify audit preparation, and provide data controllers with a transparent basis for assessing governance and risk. Case studies from the Health Informatics Centre (University of Dundee) and East of England SDE show how the CAT supports continuous improvement, highlights gaps, and demonstrates the maturity of TRE operations. The SATRE-based Control Alignment Table provides a practical path to make assurance more coherent and reusable for TRE operators and data controllers in the UK and, potentially, internationally.</p>
</abstract>
</article-meta>
</front>
</article>