Every organisation that has access to NHS patient data and systems must complete the Data Security and Protection Toolkit (DSPT) each year, and since 2024 the largest NHS bodies have been assessed against a Cyber Assessment Framework (CAF) profile rather than a checklist. Getting the toolkit wrong has practical consequences: a result below "Standards Met" means an improvement plan, and only "Standards Met" or "Standards Exceeded" earns a certificate that customers and partners can check. This guide explains who completes which version of the DSPT for 2026-27 (version 9), how the CAF-aligned model works (objectives A to E, contributing outcomes, achievement levels and expected profiles), what evidence and independent audit are needed, and what suppliers in particular must do. It is for information governance leads, SIROs, security managers and supplier compliance teams. The cross-sector CAF itself is covered in the NCSC Cyber Assessment Framework (CAF) Guide.
Key takeaways
- Two views, one toolkit. Category 1 organisations (NHS trusts, ICBs, CSUs, arm's length bodies, genomics organisations and independent sector operators of essential services) see a CAF-aligned view; everyone else answers National Data Guardian (NDG) standards questions, mapped to a CAF profile in the background.
- Profiles, not perfection. CAF-aligned outcomes are rated Not Achieved, Partially Achieved or Achieved, and each organisation type has an expected profile; meeting it gives "Standards Met". Partially Achieved is often the proportionate target.
- Objective E is health-specific. The health and care overlay adds eight information governance outcomes (transparency, individual rights, use and sharing, records management) to the 39 standard CAF outcomes, 47 in total.
- Suppliers carry real obligations. Large IT suppliers (50 or more staff and £10m or more turnover) are Category 2 and must complete a DSPT audit to reach Standards Met, even with ISO/IEC 27001 or SOC 2.
- Version 9 adds policy requirements. The 2026-27 toolkit, released on 1 September 2026, adds a mandatory extended detection and response (XDR) policy, updated MFA policy wording for outcome B2.a, post-quantum cryptography questions and a products and services section for suppliers.
What it is and who it applies to
The DSPT is NHS England's online self-assessment tool for measuring performance against the National Data Guardian's ten data security standards. The toolkit states that all organisations that have access to NHS patient data and systems must use it, and the FAQ confirms the self-assessment is completed every year. A published assessment is visible at summary level through the toolkit's organisation search, and certificates are available for "Standards Met" or "Standards Exceeded" for the most recent year.
The 2026-27 organisation types decide which view you see and how much you must answer:
| Category | Organisation types (2026-27) | View |
|---|---|---|
| Category 1 | Arm's length bodies, integrated care boards, commissioning support units, NHS trusts (acute, ambulance, community, mental health), genomics organisations, independent sector operators of essential services | CAF-aligned |
| Category 2 | Large IT suppliers: external organisations providing digital goods or services to the NHS or care with 50 or more staff and £10m or more turnover | NDG standards, supplier questions |
| Category 3 | Dentists, local authorities, opticians, community pharmacies, social care providers, universities, and "Other" (charities, smaller suppliers, NHS business partners, primary care networks) | NDG standards, tailored subset |
| Category 4 | General practices | NDG standards, tailored subset |
Local authorities, universities, "Other" organisations and IT suppliers are assessed only on the health and care data they process. A single legal entity with one ICO registration and several sites can use one toolkit with headquarters functionality; separate legal entities generally need their own. Organisation types are reviewed annually, so confirm your category each year. GP practices should also see the Cyber Security for Dental and GP Practices Guide.
What version 9 changes for suppliers
The 1 September 2026 release added a question asking whether an organisation provides products or services, a page for listing and managing those products and services, and a notice about them within both CAF and NDG assessments; from 9 October 2026 that section appears by default for CAF organisations and IT suppliers. Organisations can also record an associated organisation that is not registered on the DSPT. Suppliers should keep this product list accurate, so it is clear which services the assessment covers.
Structure and key requirements
The CAF-aligned model
From September 2024 the DSPT adopted the NCSC CAF as the basis for cyber security and information governance assurance. The health and care overlay has five objectives:
| Objective | Name | Principles (2024-25 material) |
|---|---|---|
| A | Managing risk | Outcomes include A2.a risk management process and A4.a supply chain |
| B | Protecting against cyber attack and data breaches | B1 policies and processes; B2 identity and access control; B3 data security; B4 system security; B5 resilient networks and systems; B6 staff awareness and training |
| C | Detecting cyber security events | Monitoring and detection outcomes; see the Objective C guidance |
| D | Minimising the impact of incidents | Incident response and recovery outcomes; see the Objective D guidance |
| E | Using and sharing information appropriately | E1 transparency; E2 upholding individual rights (subject rights, consent, national data opt-out); E3 using and sharing information for direct care and other purposes; E4 records management and clinical coding |
Each contributing outcome has indicators of good practice, guidance and a required supporting statement. Some outcomes have a mandatory policy requirement (for example MFA, responding to a cyber alert and, from version 9, XDR): an outcome cannot be met without answering it. Version 9 imports a new CAF version, so outcome references may shift; check the toolkit's version 9 outcomes, assertions and evidence spreadsheet (published 2 October 2026) before relying on 2024-25 references.
Achievement levels, profiles and statuses
- Achievement levels: each outcome is Not Achieved, Partially Achieved or Achieved. NHS England states the CAF does not expect every outcome to reach Achieved.
- Expected profile: each organisation type has a profile setting the minimum level per outcome. The 2024-25 profile was built by mapping existing DSPT requirements to the CAF and raising some outcomes, such as A2.a risk management process and A4.a supply chain. Profiles can become stricter over time.
- Statuses: Standards Met, Approaching Standards and Standards Not Met; Standards Exceeded is available where an exceeded level is defined (version 9 adds it for genomics organisations). Organisations below Standards Met complete an improvement plan.
- Interim and final publication: CAF organisations publish an interim assessment by 31 December and the final assessment by the annual deadline, which was 30 June for 2024-25 (30 June 2025). As of 8 November 2026 the toolkit's news and release notes pages do not state the 2026-27 publication deadline, so confirm it on the DSPT site rather than assuming 30 June 2027. Confirm the version 9 dates in the toolkit news.
Identity and NHI requirements
Identity sits mainly in CAF principle B2 Identity and access control, which in the 2024-25 material has four contributing outcomes: B2.a identity verification, authentication and authorisation; B2.b device management; B2.c privileged user management; and B2.d identity and access management. B2.a carries the mandatory MFA policy requirement, reworded in version 9.
- MFA: document where MFA is enforced (remote access, cloud administration, email and privileged access first) and evidence it with identity provider reports, not policy text alone. See the MFA Guide.
- Privileged users (B2.c): separate administrative accounts, keep an inventory of privileged roles and review it. Shared or generic administrator accounts are hard to justify at Partially Achieved or above.
- Identity lifecycle (B2.d): evidence joiner, mover and leaver processes, including timely removal of leavers' access and periodic access reviews.
- Non-human identities: interface engines, integration accounts, supplier remote support accounts and API credentials into NHS systems all fall within "identity and access control" even though staff-focused evidence dominates. Give each one an owner, store its credentials in a vault, and include it in access reviews. NHS England's FAQ also tells organisations that submit data to NHS England systems via an API and fall to Standards Not Met to assess the risk and stop the API if necessary, so the status of a supplier's DSPT directly affects machine connections.
National identity services such as NHS smartcards and Care Identity Service have their own controls; see NHS Spine, smartcards and NHS identity security and the Healthcare Identity Security Guide.
Implementation steps
- Confirm your category and scope. Check the 2026-27 organisation types, decide whether a parent toolkit covers child sites, and for suppliers answer the new products and services questions accurately.
- Download the version 9 requirements. Use the outcomes, assertions and evidence spreadsheet to build a register of every outcome or assertion with an owner.
- Compare against the expected profile (Category 1). For each outcome record your current level, the profile level and the gap. Prioritise outcomes with mandatory policy requirements (MFA, XDR, cyber alert response), because they block the outcome outright.
- Write supporting statements early. Each CAF outcome needs a statement explaining how indicators of good practice are met. Draft them alongside evidence, not in June.
- Publish the interim assessment (Category 1). Use the December interim to surface gaps while there is time to close them.
- Arrange the independent audit. Agree scope with your auditor against the year's mandatory audit areas (published 1 October 2026 for version 9) and upload the audit through the toolkit.
- Brief leadership and publish. Brief the SIRO (or equivalent) on the result and residual risks before publication. If the result is below Standards Met, prepare the improvement plan straight away.
Decision guidance: small Category 3 and 4 organisations should keep evidence in a simple shared folder mirroring the evidence item numbers and use local IT providers' reports as evidence. Category 1 organisations and large suppliers benefit from a governance, risk and compliance register mapping each outcome to evidence, owners and audit findings across years, because profiles tighten over time.
Evidence and assessment
| Area | Typical evidence | Watch for |
|---|---|---|
| Training (B6) | Training needs analysis endorsed by senior leadership; completion KPIs (95% data security awareness can be acceptable when endorsed) | Auditors sample TNA entries and check delivery |
| Identity (B2) | MFA enforcement reports, privileged account inventory, leaver removal records, access review sign-offs | Mandatory MFA policy answer |
| Vulnerability management (B4.d) | Scan and patch reports, unsupported system register | Unsupported systems without a risk-accepted plan |
| Detection (C) | Monitoring coverage, XDR policy, alert response records | New mandatory XDR policy in version 9 |
| Supply chain (A4.a) | Supplier register, contract security clauses, suppliers' DSPT status | Raised profile level since 2024-25 |
| Information governance (E) | Privacy notices, subject rights log, national data opt-out process, disclosure log, records management policy | Opt-out applied to all relevant data flows |
Independent audit is part of national assurance alongside national sampling audits. For IT suppliers, NHS England's FAQ is explicit that a DSPT audit is needed to reach Standards Met even with ISO/IEC 27001 or SOC 2; existing ISO/IEC 27001 or Cyber Essentials Plus certification can reduce audit scope only if it covers all health and care data processing. Cyber Essentials Plus and ISO/IEC 27001 are not mandatory for the DSPT itself. See the Cyber Essentials Guide.
Useful measures for the year: outcomes at or above profile, mandatory policy requirements answered, supporting statements drafted by the interim deadline, audit findings closed before publication, and suppliers with a current Standards Met status.
Mapping to other frameworks
| DSPT area | NCSC CAF | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 |
|---|---|---|---|
| Identity and access control | B2 | A.5.15, A.5.16, A.5.18, A.8.2, A.8.5 | PR.AA-01, PR.AA-05 |
| Vulnerability management | B4.d | A.8.8 | ID.RA-01 |
| Supply chain | A4.a | A.5.19 to A.5.22 | GV.SC-05 |
| Detection | Objective C | A.8.16 | DE.CM-01 |
| Incident response and recovery | Objective D | A.5.24 to A.5.27 | RS.MA-01, RC.RP-01 |
| Using and sharing information | Objective E (health overlay) | A.5.34 | GV.OC-03 |
Objective E links closely to UK GDPR obligations and the common law duty of confidentiality, which is why it has no equivalent in the cross-sector CAF. The Healthcare Cyber Regulation Map shows how the DSPT sits beside NIS and other health rules.
Common pitfalls
- Choosing the wrong category: a supplier that meets the large supplier thresholds but registers as "Other" will answer the wrong questions and may face challenge from NHS customers.
- Aiming for Achieved everywhere: the profile sets the target; over-reaching on low-priority outcomes takes effort from mandatory ones.
- Policy without proof: mandatory policy requirements need to be answered, but auditors also test that MFA, XDR and alert response operate in practice.
- Leaving statements until June: supporting statements and audit evidence take months; the interim publication exists to avoid this.
- Forgetting machine access: integration accounts and supplier remote access are part of identity and access control and of supply chain outcomes.
- Using old outcome references: version 9 imports a new CAF version; map from the version 9 spreadsheet, not last year's evidence folder.
Practitioner checklist
- Confirm the 2026-27 organisation category, parent and child coverage and supplier status.
- Build an outcome or assertion register from the version 9 spreadsheet with owners and target levels.
- Answer every mandatory policy requirement (MFA, XDR, cyber alert response) with operating evidence.
- Evidence MFA coverage, privileged account separation and leaver removal for B2.
- Inventory integration, API and supplier remote access accounts with owners and vaulted credentials.
- Check that key suppliers hold a current Standards Met status and record it for A4.a.
- Publish the interim assessment by 31 December (Category 1) and agree audit scope early.
- Brief the SIRO before final publication and prepare an improvement plan if below Standards Met.
Standards and references
- NHS England: Data Security and Protection Toolkit
- NHS England: DSPT Organisation types 2026-27
- NHS England: DSPT changes (CAF-aligned DSPT)
- NHS England: DSPT release notes (version 9)
- NHS England: DSPT frequently asked questions
- NHS England: CAF-aligned DSPT overview and background (webinar slides)
- NHS England: DSPT Objective E, using and sharing information appropriately
- NHS England: DSPT Objective B, protecting against cyber attack and data breaches
Related NHI Mgmt Group resources: NCSC Cyber Assessment Framework (CAF) Guide · Healthcare Cyber Regulation Map · NHS Spine, smartcards and NHS identity security · HHS 405(d) HICP. This guide summarises the NHS Data Security and Protection Toolkit and is not legal advice.