Service · NHS and the suppliers who hold its data
Know where you stand against the DSPT before you submit
The Data Security and Protection Toolkit is now two things. Trusts, integrated care boards, commissioning support units and arm's-length bodies submit against the CAF-aligned version — outcome-based, evidence-heavy, and signed off by the SIRO. Suppliers, GP practices and social-care providers submit against the standards-based version. Both are due by 30 June, both are increasingly checked, and both are usually completed by someone doing it alongside their real job. We do the independent work: where you stand against each outcome, what evidence is actually needed, and what to fix first.
The December interim point is close
CAF-aligned organisations (trusts, integrated care boards, commissioning support units and arm’s-length bodies) report interim ratings in December, ahead of the 30 June 2027 deadline. Our DSPT readiness sprint gives you an honest rating of every outcome against version 9, the eleven audit outcomes tested the way an auditor will test them, a prioritised gap list and a SIRO briefing, in three to five weeks, at a fixed fee agreed in writing before we start.
30 June
is the annual deadline; CAF-aligned organisations also report interim ratings in December, so the useful time to start is nowEvery year
5 objectives
in the CAF-aligned toolkit, each with contributing outcomes that need evidence rather than a tickA to E
Fixed fee
agreed in writing before we start, based on your category and the number of outcomes in scopePriced on scope
1 signature
the SIRO's, on a report that says what was tested and what was notWhat you receive
New for 2026-27: version 9 of the DSPT is aligned to NCSC CAF v4.0, with eleven mandatory audit outcomes. Read our complete guide to the DSPT 2026-27 and CAF v4.0: every outcome explained, the evidence auditors expect, and a month-by-month plan to 30 June 2027.
Who this is for
Two groups, and we work differently with each. NHS organisations submitting the CAF-aligned toolkit — trusts, ICBs, CSUs and arm's-length bodies — where the information-governance and cyber teams are small, the outcomes are many, and the SIRO is being asked to sign something nobody has independently checked. And the organisations that hold NHS data under contract — software suppliers, managed-service providers, diagnostics, care providers, GP federations — for whom the standards-based toolkit is a condition of doing business and a question on every procurement.
If you are a supplier being asked for your DSPT status by an NHS customer for the first time, start here. If you are a trust whose internal audit has flagged the toolkit, start here too.
What we actually do
For organisations preparing a submission. Where you stand, outcome by outcome, before the SIRO signs.
- Each outcome in scope assessed against the evidence you actually hold, not the evidence you intend to hold
- What is missing, what is out of date, and what is described in a policy but not happening
- Findings ordered by what to fix before 30 June, and what can honestly wait
- A report the SIRO can sign against, and the wording for the board
For NHS organisations whose submission must be independently assessed, and for suppliers whose customers want more than a self-declaration.
- An evidence-based assessment of the submission against the toolkit's own guidance
- A dated report stating what was tested, what was not, and the confidence in each outcome
- Delivered only where we have not advised on the submission — see the rule below
The standards-based toolkit, and the procurement questions that come with it.
- The standards-based assertions checked against what your organisation can produce
- The gap between your Cyber Essentials, ISO 27001 or SOC 2 evidence and what the toolkit asks for, mapped
- Answers you can reuse in NHS procurement questionnaires, with the evidence behind each
The independence rule, and why it matters here
NHS England expects the CAF-aligned submission to be independently assessed. That word means something. If we have carried out your readiness review — told you what to fix and helped you understand what the outcome wants — we will not then assess the same submission and call it independent, because it would not be. You choose one route or the other for each submission year, and we say so in the scoping letter. If you want both, we do the readiness work and introduce an assessor who has never advised you.
What it costs
The fee depends on which toolkit you submit, how many outcomes are in scope, and how many sites and systems sit behind them. It is agreed in writing before any work starts and does not change.
Priced on scopeFixed fee agreed before we start
As a guide, a standards-based review for a single-site supplier is in the same range as an independent assessment. A CAF-aligned review for a trust is scoped after a first conversation with the IG and cyber leads.
Most DSPT findings are about incident response and staff practice, not technology.
From £2,650 + VATFacilitated tabletop exercise
A facilitated tabletop exercise produces the dated incident-response evidence several outcomes ask for. The operating runbooks (£165 + VAT each) are the written procedures behind them.
What actually happens, and when
First conversation
No charge. Which toolkit, which category, where last year's submission landed, and whether you need readiness or assessment. We also check whether we have advised you before.
Within a week
A scoping letter with the fixed fee, the outcomes in scope, the route chosen and the evidence request, so your IG and cyber leads know exactly what will be asked for.
Your effort
For a supplier, one to two days across the engagement. For a trust, the IG and cyber leads should allow two to four days between them, mostly gathering evidence they will need for the submission anyway.
Three to five weeks
We assess each outcome against the evidence produced. Anything that would stop the SIRO signing is reported as soon as we see it.
Walkthrough
An hour with the IG and cyber leads, and twenty minutes with the SIRO. The report is issued that day, in time to act before 30 June if you started by March.
Afterwards
The findings are yours. On the readiness route we re-check the priority fixes before submission, included. On the assessment route the report stands as issued.
Questions we are usually asked
Is a DSPT audit mandatory for us?
For NHS trusts, integrated care boards, commissioning support units, arm's-length bodies, independent providers designated as operators of essential services, and genomics organisations: yes. NHS England requires the CAF-aligned submission to be independently assessed every year. For suppliers and others on the standards-based toolkit it is not generally required, but NHS customers increasingly want more than a self-declaration, and that is where an independent assessment earns its fee.
What does DSPT compliance actually mean?
Submitting the toolkit by 30 June is the minimum. Compliance is whether the evidence behind each answer would stand up to an independent assessor, an internal auditor or an NHS customer's procurement check. A submitted toolkit is a self-declaration; the question the SIRO is really signing is whether it is true.
We are a supplier. Do we need the CAF-aligned version?
Not unless NHS England has told you so. Most suppliers, GP practices and care providers submit the standards-based toolkit. If you are unsure which category you are in, tell us who your NHS customers are and we will check before the first conversation ends.
We already hold Cyber Essentials Plus and ISO 27001. Is the DSPT not just a formality?
The toolkit reuses much of that evidence, and we map it so you do not produce it twice. It also asks for things the certifications do not: national data opt-out compliance, staff training records at a set threshold, specific incident-reporting routes. Those are where suppliers with good certificates still fail.
Can you complete the submission for us?
No, and you should be wary of anyone who offers to. The submission is the organisation's own declaration and the SIRO signs it. We tell you where you stand and what to fix; your people submit it knowing what they are signing.
What if we cannot reach "standards met" by 30 June?
Then the report tells you that in March rather than June, with an improvement plan in the toolkit's own terms and the evidence of the work under way. An honest "approaching standards" with a credible plan is treated very differently from an unsupported "standards met".
Do you work with social-care providers?
Yes. The standards-based toolkit applies, the evidence is usually held on paper and in a few people's heads, and the work is mostly about getting it written down. The fee for a single-site care provider is at the lower end of the range.
There is no charge for the first conversation and no obligation at the end of it. If your submission is too close for the work to be useful this year, we will say so and plan for next year instead.