NHS · DSPT 2026-27 · CAF v4.0
The NHS guide to the CAF-aligned DSPT, 2026-27
Everything a DSPT lead, SIRO or board needs for version 9 of the Data Security and Protection Toolkit, now aligned to version 4.0 of the NCSC Cyber Assessment Framework. Every outcome in plain English, the evidence an auditor will ask for, this year’s eleven mandatory audit outcomes, and a month-by-month plan to 30 June 2027.
2026-27 at a glance
Board brief: the DSPT in five lines
- What changed: DSPT version 9 (published 8 September 2026) is aligned to NCSC CAF version 4.0, with new outcomes on threat understanding, secure software and threat hunting.
- When: final submission by 30 June 2027; CAF-aligned organisations also report interim ratings in December.
- Where the risk is: the eleven mandatory audit outcomes, especially the asset register, privileged and supplier access, and executive-level incident exercising.
- What to ask: which outcomes are below the NHS England profile, who owns each one, and when did the executive team last rehearse a cyber incident?
- Next step: an honest readiness rating before December, then an improvement plan the SIRO can sign with confidence.
New this year
What has changed for 2026-27
Version 9 of the toolkit moves the CAF-aligned DSPT from the previous CAF baseline to CAF v4.0. The NCSC released v4.0 in August 2025 because, in its words, the threat to critical services “has continued to increase”. For NHS organisations the changes land in four places.
- Understanding the threat (A2.b). A new outcome asks whether you understand who is likely to attack you, how and why, and whether that understanding shapes your risk decisions. A generic “ransomware is a risk” line on the risk register will not be enough.
- Secure software development and support (A4.b). New. It covers software you build, and software you commission or buy. For most trusts that means asking suppliers of clinical systems, integrations and apps how they develop and support their products, and keeping the answers.
- Detection is sharper. Security monitoring (C1) now expects you to understand normal user and system behaviour and to use threat intelligence. Principle C2 is now plainly threat hunting: looking for attackers who have not tripped an alert.
- AI risk runs throughout. CAF v4.0 builds AI-related risk into existing outcomes rather than adding a separate objective. If staff use AI tools, or AI sits inside clinical or administrative systems, expect questions about it under governance, data, supply chain and monitoring.
The toolkit itself also changed on 1 September 2026:
- a new mandatory Extended Detection and Response (XDR) policy question, and updated questions on multi-factor authentication and post-quantum cryptography;
- independent auditors can now upload audit reports directly into the toolkit;
- “IT supplier” is now simply “supplier”, with a new page for recording the products and services you provide;
- support for providers under CQC Market Oversight.
NHS England published a change log for version 9 alongside the outcomes spreadsheets on 8 September 2026. It sits behind the toolkit login. Read it before you roll last year’s evidence forward, because some outcome wording has moved.
Start here
Which toolkit do you complete?
There is one toolkit with two views. Large NHS bodies and operators of essential services complete the CAF-aligned view, rating themselves against CAF outcomes. Everyone else completes the standards-based view, built on the National Data Guardian’s standards, with a CAF mapping applied behind the scenes.
| Organisation | Toolkit view | Independent audit | Improvement plan agreed with |
|---|---|---|---|
| NHS trusts and foundation trusts | CAF-aligned (since 2024-25) | Yes, mandatory | Regional Security Lead |
| Integrated care boards | CAF-aligned (since 2024-25) | Yes, mandatory | Regional Security Lead |
| Commissioning support units and arm’s length bodies | CAF-aligned (since 2024-25) | Yes, mandatory | Regional Security Lead (CSUs) |
| Independent providers designated as operators of essential services | CAF-aligned (since 2025-26) | Yes, mandatory | NHS England Joint Cyber Unit |
| Genomics organisations nominated by DHSC | CAF-aligned (since 2025-26) | Yes, mandatory | NHS England Joint Cyber Unit |
| Larger suppliers (Category 2) | Standards-based | Not mandated by the toolkit; your customers may ask | – |
| Medium-risk organisations (Category 3) | Standards-based | No | – |
| GP practices (Category 4) | Standards-based | No | – |
| Social care providers and others with NHS data access | Standards-based | No | – |
Not sure of your category? It is shown on your organisation’s toolkit profile. If it looks wrong, raise it with the DSPT helpdesk before you start, not in June.
The mechanics
How the CAF-aligned DSPT works
The framework has four layers. Once you see them, the toolkit stops feeling like a questionnaire and starts reading like a description of a well-run organisation.
| Layer | What it is | Example |
|---|---|---|
| Objective | Five broad aims, A to E | B: Protecting against cyber attacks and data breaches |
| Principle | What good looks like within the objective | B2: Identity and access control |
| Contributing outcome | The unit you rate yourself on | B2.c: Privileged user management |
| Indicators of good practice | Statements describing Not achieved, Partially achieved and Achieved for each outcome | “Privileged user access is reviewed regularly…” |
The five objectives
- A. Managing risk: governance, risk management, assets and supply chain.
- B. Protecting against cyber attacks and data breaches: policies, access, data, systems, resilience and people.
- C. Detecting cyber security events: monitoring and threat hunting.
- D. Minimising the impact of incidents: response, recovery and learning.
- E. Using and sharing information appropriately: the NHS’s own addition, covering transparency, individuals’ rights, information sharing and records.
With CAF v4.0, objectives A to D contain 41 contributing outcomes and Objective E adds 8, 49 in all (our count from the published frameworks).
Ratings, the NHS profile and your status
You rate each outcome Not achieved, Partially achieved or Achieved by matching your evidence to the indicators of good practice. You do not need Achieved everywhere. NHS England sets a profile: the minimum level expected for each outcome, by type of organisation. Your overall status then follows:
- Standards met: you meet the profile level on every outcome.
- Approaching standards: you fall short on one or more outcomes, but have an improvement plan agreed with your Regional Security Lead (or the Joint Cyber Unit for OES and genomics).
- Standards not met: you fall short and have no agreed plan.
An improvement plan must list each unmet outcome and open audit action, with milestones, resources, named owners, target dates and the matching risk register reference. It is uploaded when you publish and updated during the year. Treat it as a management tool, not a form: auditors and regional leads can tell the difference.
The reference
Every outcome, explained
For each contributing outcome: what it is really asking, the evidence an independent assessor will expect to see, and where NHS organisations most often fall short. Audit 26-27 marks the eleven outcomes every CAF-aligned organisation must have independently audited this year. New in v4 marks outcomes added by CAF v4.0. Evidence must show a control operating, not just a policy saying it should.
Objective A: Managing risk
A1 Governance
- A1.a Board direction
- The board owns data security and cyber risk and sets direction. Evidence: board or committee minutes that discuss it, a Board Assurance Framework entry, an annual report to the board, a named executive lead (usually the SIRO). Common gap: reports that go to committee but never reach the board itself.
- A1.b Roles and responsibilities Audit 26-27
- The right roles exist, are filled, have deputies and have time to do the job: SIRO, DPO, Caldicott Guardian, security lead, information asset owners. Evidence: governance chart, job descriptions, terms of reference, information asset owner register with training records. Common gap: asset owners named on paper who do not know they are asset owners.
- A1.c Decision-making
- Security decisions are taken at the right level, by people with the authority to take them, and risk acceptance is written down. Evidence: scheme of delegation, risk acceptance records, escalation route. Common gap: exceptions granted by email with no record of who accepted the risk.
A2 Risk management
- A2.a Risk management process
- A working method for identifying and managing risks to your essential functions, joined up with the corporate risk register. Evidence: risk methodology, cyber risks with owners and review dates, data protection impact assessments. Recommended optional audit outcome for critical national infrastructure. Common gap: a single “cyber attack” risk that never changes score.
- A2.b Understanding threat New in v4
- You understand who might attack your services, how and why, and it shapes your decisions. Evidence: a threat assessment for your organisation (ransomware against pathology, EPR and supplier platforms, for example), use of NHS England cyber alerts and threat intelligence, and at least one decision you can show it changed. Common gap: threat described generically, with nothing specific to your services or suppliers.
- A2.c Assurance
- You test whether controls actually work, and act on what you find. Evidence: an assurance map, penetration test and internal audit reports, remediation tracked to closure. Common gap: pen test findings still open from two years ago.
A3 Asset management
- A3.a Asset management Audit 26-27
- You know what you have: hardware, software, systems, data and connected medical devices supporting your essential functions, with owners, kept current. Evidence: asset register or CMDB with owners, reconciliation against network discovery, a list of unsupported software with risk decisions. Common gap: medical devices, departmental systems and cloud services missing from the register.
A4 Supply chain
- A4.a Supply chain
- You know which suppliers support your essential functions and hold them to security requirements you can check. Evidence: supplier register ranked by criticality, contract security clauses, supplier DSPT status and Cyber Security Charter commitments, exit and continuity plans. Common gap: assurance done at procurement and never again.
- A4.b Secure software development and support New in v4
- Software you build, commission or buy is developed and supported securely, for as long as you rely on it. Evidence: supplier attestations against the government Software Security Code of Practice, secure development practice for in-house development and integrations, support end dates in the asset register. Common gap: no idea when a clinical system’s underlying platform goes out of support.
Objective B: Protecting against cyber attacks and data breaches
B1 Service protection policies, processes and procedures
- B1.a Policy, process and procedure development
- Security policies that are current, owned and relevant to how the organisation really works. Evidence: policy suite with owners, approval and review dates. Common gap: policies overdue for review.
- B1.b Policy, process and procedure implementation
- The policies are followed. Evidence: compliance checks, an exceptions register, spot-check results. Common gap: no evidence beyond the policy document itself.
B2 Identity and access control
- B2.a Identity verification, authentication and authorisation
- Only verified, authorised people and systems get access, with multi-factor authentication where it matters. Evidence: MFA coverage for remote access, email, cloud and administrators; joiner and mover process; smartcard and NHS CIS2 arrangements. Common gap: MFA exemptions that nobody reviews.
- B2.b Device management
- Only known, managed devices connect to your systems. Evidence: device management compliance reports, network access control, bring-your-own-device rules. Common gap: unmanaged devices on clinical networks.
- B2.c Privileged user management Audit 26-27
- Administrator accounts are few, separate from everyday accounts, protected with MFA, monitored and reviewed. Evidence: privileged account list compared with staff lists, separate admin accounts, review records, break-glass arrangements. Common gap: supplier and legacy admin accounts nobody owns.
- B2.d Identity and access management Audit 26-27
- Accounts are managed across their life: created correctly, changed on moves, removed promptly on leaving, and recertified. Evidence: leaver-timeliness reports (for example ESR to directory), dormant and shared account reports, access recertification. Common gap: leavers still active weeks later, and generic ward accounts.
B3 Data security
- B3.a Understanding data Audit 26-27
- You know what data supports your essential functions, where it lives, how sensitive it is and where it flows. Evidence: information asset register, data flow maps, record of processing activities. Common gap: data flows to suppliers and research partners not mapped.
- B3.b Data in transit
- Data moving between systems and organisations is protected. Evidence: encryption standards, secure email (NHSmail or accredited), secure transfer tools. Common gap: legacy integrations sending data unencrypted.
- B3.c Stored data
- Stored data is protected from unauthorised access, including backups. Evidence: encryption at rest, access restrictions, database security. Common gap: file shares with broad access to sensitive data.
- B3.d Mobile data
- Data on laptops, phones and removable media is protected. Evidence: encryption compliance, remote wipe, removable media controls. Common gap: unencrypted USB use in clinical areas.
- B3.e Media and equipment sanitisation
- Equipment is wiped or destroyed securely before disposal or reuse, including leased and medical equipment. Evidence: sanitisation standard, destruction certificates, disposal contracts. Common gap: returned leased devices and medical equipment.
B4 System security
- B4.a Secure by design
- Systems and networks are designed to limit the damage an attacker can do. Evidence: architecture diagrams, network segmentation (especially for medical devices), design authority records. Common gap: flat networks.
- B4.b Secure configuration
- Systems are built and kept to a hardened standard. Evidence: configuration baselines, compliance reporting, drift detection. Common gap: servers built by hand and never compared with a baseline.
- B4.c Secure management Audit 26-27
- Systems are administered securely: from protected devices, over secure routes, with change control. Evidence: privileged access workstations or jump hosts, a separated management network, change records, supplier remote access controls. Common gap: administration done from everyday laptops, and always-on supplier remote access.
- B4.d Vulnerability management
- You find and fix vulnerabilities in time, and manage what you cannot patch. Evidence: patch compliance, vulnerability scan trends, responses to NHS England cyber alerts, a register of unsupported systems with mitigations. Common gap: high-severity alerts acknowledged but not closed.
B5 Resilient networks and systems
- B5.a Resilience preparation
- You understand how your essential functions would fail and have plans for it. Evidence: business impact analysis, continuity plans with cyber scenarios, downtime procedures that clinicians know. Common gap: plans that assume IT is available to read the plan.
- B5.b Design for resilience
- Architecture avoids single points of failure and contains spread. Evidence: resilience design, failover arrangements, segmentation. Common gap: a single identity platform with no recovery plan.
- B5.c Backups
- Backups of what matters exist, cannot be altered by an attacker, and restores are tested against target times. Evidence: backup coverage, immutable or offline copies, restore test records with actual times. Recommended optional audit outcome for OES and genomics. Common gap: restores tested for single files, never for a whole clinical system.
B6 Staff awareness and training
- B6.a Cyber security culture Audit 26-27
- Leaders encourage people to report concerns and mistakes without fear, and security is seen as part of safe care. Evidence: leadership messages, reporting trends, phishing-report rates, staff survey results, just-culture approach. Common gap: training figures offered as proof of culture.
- B6.b Cyber security training Audit 26-27
- Staff get training suited to their role, and those with privileged or specialist roles get more. Evidence: completion by staff group, role-based training for administrators and asset owners, phishing exercises. Common gap: good overall completion hiding poor rates in bank and temporary staff.
Objective C: Detecting cyber security events
C1 Security monitoring
- C1.a Sources and tools for logging and monitoring
- Logs are collected from the systems that matter. Evidence: log source list reconciled against the asset register, endpoint detection and response coverage (note this year’s XDR policy question), integration with NHS England’s national security operations service where used. Common gap: cloud and clinical systems not logging at all.
- C1.b Securing logs
- Logs are protected from tampering and kept long enough to investigate. Evidence: retention settings, access controls on the logging platform. Common gap: retention too short to investigate a slow attack.
- C1.c Generating alerts
- Monitoring produces meaningful alerts. Evidence: detection rules or use cases, tuning records. Common gap: default rules only.
- C1.d Triage of security alerts
- Alerts are looked at promptly by someone who can act. Evidence: triage process, response times, tickets, out-of-hours arrangements. Common gap: alerts land in a mailbox nobody watches at weekends.
- C1.e Personnel skills for monitoring tools and detection Audit 26-27
- The people doing monitoring, in-house or through a provider, have the skills and capacity. Evidence: training records, rota, provider contract and service levels, skills assessment. Common gap: one person who knows the tools.
- C1.f Understanding behaviour, and threat intelligence
- You know what normal looks like for users and systems, and use threat intelligence to spot what is not. Evidence: baselines, use of NHS England alerts and threat feeds, examples of intelligence-led detection. Common gap: intelligence received but never turned into detection.
C2 Threat hunting
- C2.a Threat hunting
- You look for attackers who have not triggered an alert, using what you know about current threats. Evidence: hunt records with the hypothesis, what was searched and what was found, whether in-house or by a provider. Common gap: no hunting at all, or hunting nobody writes down.
Objective D: Minimising the impact of incidents
D1 Response and recovery planning
- D1.a Response plan
- An incident response plan that covers cyber incidents with clinical consequences and links to emergency preparedness and business continuity. Evidence: plan and playbooks (ransomware, supplier compromise, data breach), contact lists held offline, reporting routes to NHS England and the ICO. Recommended optional audit outcome for trusts, ICBs, ALBs and CSUs. Common gap: the plan lives only on the network it is meant to recover.
- D1.b Response and recovery capability
- You have the people, tools, suppliers and priorities to respond and recover. Evidence: incident response retainer or support arrangements, agreed recovery order for clinical systems, offline copies of key information. Common gap: no agreed order of recovery.
- D1.c Testing and exercising Audit 26-27
- You rehearse the plan, including with executives, and fix what the exercise exposes. Evidence: exercise reports, attendance, actions tracked to completion. Common gap: technical tests only, with no executive or clinical participation.
D2 Lessons learned
- D2.a Post incident analysis
- You find the root cause after incidents and near misses. Evidence: post-incident reviews. Common gap: reviews only for major incidents.
- D2.b Using incidents to drive improvements
- Lessons turn into changes. Evidence: actions tracked from reviews and exercises, trend reporting. Common gap: the same finding in three consecutive reviews.
Objective E: Using and sharing information appropriately
E1 Transparency
- E1.a Privacy information
- Patients, service users and staff can find out clearly how their information is used. Evidence: current, accessible privacy notices, including the national data opt-out. Common gap: notices that do not mention newer uses such as AI tools or shared care records.
E2 Upholding the rights of individuals
- E2.a Managing data subject rights
- Requests under UK GDPR are handled properly and on time. Evidence: request log, timeliness figures, redaction process. Common gap: backlogs of subject access requests.
- E2.b Consent
- Where you rely on consent, it is valid and recorded. Evidence: consent records and processes. Common gap: consent used where another lawful basis applies.
- E2.c National data opt-out
- You apply the national data opt-out where required. Evidence: compliance statement and process. Common gap: opt-out not applied to new data releases.
E3 Using and sharing information
- E3.a For direct care
- Information is shared confidently and appropriately to care for people. Evidence: sharing arrangements, staff guidance, Caldicott principles in practice. Common gap: staff unsure what they may share, so they don’t.
- E3.b For other purposes
- Sharing beyond direct care has a lawful basis and proper approval, with the Caldicott Guardian and DPO involved in novel or contentious cases. Evidence: data protection impact assessments, sharing agreements, approvals. Common gap: research and analytics uses without a documented basis.
E4 Records management
- E4.a Managing records Audit 26-27
- Records are kept, retained and destroyed in line with the Records Management Code of Practice. Evidence: retention schedule, disposal records, records audits, arrangements for paper and legacy systems. Common gap: nothing is ever destroyed, including data you should no longer hold.
- E4.b Coded clinical data
- Clinically coded data is accurate. Evidence: clinical coding audit results and improvement actions. Common gap: coding audits not linked to the DSPT evidence.
Outcome names follow NCSC CAF v4.0 and NHS England’s Objective E guidance. Always rate yourself against the indicators of good practice in the toolkit itself. Where the wording there differs from ours, the toolkit wins.
Independent assessment
The 2026-27 independent audit
Every CAF-aligned organisation (trusts, ICBs, ALBs, CSUs, OES and genomics organisations) must have its DSPT independently assessed. For 2026-27 NHS England has set eleven mandatory outcomes, plus one of your choice:
| Outcome | What the auditor is testing |
|---|---|
| A1.b Roles and responsibilities | That named people really hold the roles, have deputies and time, and know what they are accountable for. |
| A3.a Asset management | That the asset register is complete and current. Expect sampling from the network back to the register. |
| B2.c Privileged user management | Who holds admin rights, why, and whether it is reviewed. |
| B2.d Identity and access management | Leavers, dormant accounts, shared accounts and recertification. |
| B3.a Understanding data | That you know where your important data is and where it goes. |
| B4.c Secure management | How systems are administered, including by suppliers. |
| B6.a Cyber security culture | Whether people report problems and leaders encourage it. |
| B6.b Cyber security training | Role-appropriate training and completion across all staff groups. |
| C1.e Monitoring skills | Whether the people watching your alerts can act on them. |
| D1.c Testing and exercising | Whether you have rehearsed your response, including with executives, and acted on the results. |
| E4.a Managing records | Retention, disposal and records management in practice. |
Recommended choices for your twelfth outcome: D1.a Response plan for trusts, ICBs, ALBs and CSUs; B5.c Backups for OES and genomics organisations; A2.a Risk management process for critical national infrastructure. The mandatory list is longer than 2025-26, which had nine for trusts and ICBs plus three chosen.
How the auditor reports
Under NHS England’s assessor guidance, the auditor gives an overall risk rating (Very high, High, Moderate, Low or Very low), driven by how many outcomes fall below the expected level. They also give a confidence rating (High, Medium or Low) on how far your self-assessment can be relied on. A low confidence rating hurts even when your scores are good, because it tells NHS England your self-assessment cannot be trusted. Under the 2025-26 guidance, the draft report follows within two weeks of the closing meeting and the final report within a week of management responses. Auditors can now upload the report directly to the toolkit. NHS England expects to publish updated 2026-27 audit guidance in early October 2026.
Choosing an auditor
NHS England recommends assessors under the NCSC’s Cyber Resilience Audit scheme or equivalent, and requires conflicts of interest to be managed. In practice: the firm that helped you prepare should not be the firm that audits you in the same year. Internal audit providers can do it if they have the specialist skills. Ask any prospective auditor whether they have assessed against the CAF before, who will actually do the fieldwork, and how they test operation rather than read policies.
Planning
Your year, month by month
| When | What happens | What you should be doing |
|---|---|---|
| September 2026 | Version 9 released (1 September); outcomes published (8 September); mandatory audit areas published (10 September); webinars begin (22 September) | Read the change log. Confirm your SIRO, DSPT lead and outcome owners. Roll forward last year’s improvement plan. |
| October 2026 | Updated audit guidance expected; supplier webinars from 13 October, primary care from 20 October | Scope your essential functions with the SIRO. Appoint your independent assessor and agree dates now, before diaries fill. |
| November 2026 | – | Honest first-pass rating of all 49 outcomes. Test the eleven audit outcomes hardest. |
| December 2026 | Interim assessment point for CAF-aligned organisations (31 December in NHS England guidance; confirm the 2026 date); improvement plan updates | Submit interim ratings. Take the gap list to your executive team with costs. |
| January–March 2027 | – | Audit fieldwork for most organisations. Run the exercise that evidences D1.c if you have not already. Remediate. |
| April–May 2027 | – | Final audit report and management responses. Draft the improvement plan. Brief the board. |
| June 2027 | Deadline 30 June 2027 | SIRO approval, upload the audit and improvement plan, publish. Aim for mid-June, not the last afternoon. |
Accountability
SIRO, board, DPO and Caldicott Guardian
The SIRO approves the submission, including how your essential functions are scoped. The board owns the risk (outcome A1.a) and should see the position before the SIRO signs, not after. The DPO and Caldicott Guardian are the escalation points for information use that is novel, contentious or beyond direct care (outcome E3), and their involvement should be visible in the evidence.
Five questions for a SIRO before signing
- For every outcome below the NHS England profile, is there an improvement plan line with an owner, a date and a risk register reference?
- What confidence rating did the auditor give our self-assessment, and if it was not High, why not?
- Which of our essential functions depend on a single supplier, and when did we last test recovering without them?
- When did the executive team last rehearse a cyber incident, and which actions from it are still open?
- Is anything in this submission true on paper but not in practice?
For a model of what the board should receive, see our one-page sample board report.
From experience
Where organisations fall short
- Policy offered as proof. The CAF rates what happens, not what is written. Pair every policy with evidence that it operates: a report, a sample, a record.
- The asset register. Almost every weakness downstream (patching, monitoring, backups, supplier access) traces back to not knowing what you have. A3.a is on the audit list for a reason.
- Privileged and supplier access. Admin accounts that grew for years and supplier remote access that is always on. B2.c and B4.c are both audited this year.
- Leavers. Accounts still active after people leave, especially bank, locum and honorary staff.
- Backups never restored at scale. A successful file restore says nothing about recovering an EPR or a pathology system.
- Exercises without executives. A technical test is useful. D1.c asks whether the people who make the decisions have practised making them.
- Rolling evidence forward. Last year’s evidence against this year’s CAF v4.0 wording, especially for A2.b, A4.b and C1.f, which are new or changed.
- Optimistic self-assessment. A self-assessment the auditor cannot rely on earns a low confidence rating, which is worse than an honest Partially achieved.
Suppliers
If you supply the NHS
Suppliers complete the standards-based view of the toolkit, usually as Category 2 if you are a larger IT supplier. Version 9 now calls you a “supplier” rather than an “IT supplier” and asks you to record the products and services you provide. Your NHS customers are being audited on supply chain (A4.a) and, new this year, on secure software development and support (A4.b), so expect sharper questions about:
- your DSPT status (Standards met is the expectation);
- the Cyber Security Charter for Suppliers to the NHS: supported and patched systems, DSPT Standards met, MFA, round-the-clock monitoring, immutable backups, board-level exercises, incident reporting and secure development under the government’s software security code of practice. Over 800 suppliers have signed. Signatures are declarations, not verified, so customers increasingly ask for the evidence behind them;
- how you administer their systems remotely, and how you would tell them about an incident, and how fast.
The Cyber Security and Resilience Bill (see below) is also expected to bring medium and large managed service providers into regulation.
Smaller organisations
GP practices and social care
GP practices (Category 4), social care providers and other smaller organisations with access to NHS data complete the standards-based toolkit. The questions are simpler, but the risks are real, and smaller organisations are often targeted precisely because they are connected to larger ones. The most useful things you can have are a short incident plan everybody can find without a computer, multi-factor authentication on email and remote access, tested backups, and a clear list of who to call. Our first hour guide and operating runbooks were written for exactly this.
The bigger picture
NIS, the new Bill and the 2030 strategy
NIS Regulations 2018
In health, DHSC is the competent authority under the Network and Information Systems Regulations, supported by NHS England. Designated operators of essential services include NHS trusts and foundation trusts, ICBs and some independent providers. For them, the CAF-aligned DSPT with independent audit is the route to showing compliance. Penalties under NIS can reach £17 million.
Cyber Security and Resilience Bill
The Bill that will update NIS completed its Commons stages in June 2026 and completed House of Lords committee stage on 7 September 2026; Lords report stage is scheduled for 26 October 2026 (checked 30 September 2026). It is not yet law. As introduced, it brings medium and large managed service providers and data centres into scope, lets regulators designate critical suppliers, and requires significant incidents to be reported within 24 hours with a fuller report within 72 hours. DHSC remains the regulator for health. When the government introduced it, it cited the 2024 Synnovis attack: more than 11,000 appointments and procedures disrupted, at an estimated cost of £32.7 million.
Cyber security strategy for health and adult social care to 2030
The national strategy aims for the sector to be resilient to cyber attack by 2030, through five pillars: focus on the greatest risks and harms; defend as one; people and culture; build secure for the future; and exemplary response and recovery. The DSPT is how progress against it is measured, organisation by organisation.
Working with us
How we can help
We work with NHS trusts, ICBs, CSUs, independent providers and suppliers. Every piece of work is priced in writing before it starts. Details, prices and booking are on our NHS DSPT services page.
DSPT readiness review
An honest rating of all 49 outcomes against version 9, with the eleven audit outcomes tested as an auditor would test them. You get a prioritised gap list and a draft improvement plan, in time for the December interim point.
Fixed price, agreed before we start
Independent assessment
The mandatory DSPT audit for CAF-aligned organisations, following NHS England’s assessor guidance, with risk and confidence ratings and a report ready to upload. Only where we have not advised on the work being assessed.
Fixed price by organisation size
Executive cyber exercise
A realistic incident rehearsal for your executive team and clinical leaders: ransomware, supplier failure or a data breach. It gives you the evidence D1.c asks for, and an action list worth having.
From £2,650 + VAT
Board and SIRO briefing
A focused session so the board and SIRO understand what they are signing, what the gaps mean for patients and services, and what to ask (outcomes A1.a and A1.b).
Fixed price per session
Improvement plan support
Turning audit findings and unmet outcomes into a plan your Regional Security Lead will agree: owners, milestones, resources and risk register links.
Fixed price, agreed before we start
Runbooks and virtual CISO
Ready-to-use operating runbooks for incident response, access reviews and backup testing. Or a virtual CISO or DPO for organisations without one in post.
Runbooks · Virtual CISO and DPO
Runbooks from £165 + VAT each
Our independence rule
We never assess work we have advised on, and we never sell the fix for anything we assess. We never assess any organisation where a member of our team is employed. We do not sell the technology that would close the gaps we find. That is what makes our findings worth relying on.
FAQ
Questions we are asked
Which version of the CAF does the 2026-27 DSPT use?
Version 9 of the DSPT, published on 8 September 2026, is aligned to NCSC CAF version 4.0.
When is the 2026-27 DSPT deadline?
30 June 2027. CAF-aligned organisations also have an interim assessment point, which NHS England guidance sets at 31 December. Confirm the 2026 date on the toolkit.
Do we have to achieve every outcome?
No. NHS England sets a profile with the minimum level for each outcome by organisation type. Meet the profile everywhere and you are Standards met. Fall short with an agreed improvement plan and you are Approaching standards.
Which outcomes will the auditor look at in 2026-27?
Eleven mandatory outcomes (A1.b, A3.a, B2.c, B2.d, B3.a, B4.c, B6.a, B6.b, C1.e, D1.c and E4.a) plus one you choose. NHS England recommends D1.a for trusts, ICBs, ALBs and CSUs, B5.c for OES and genomics organisations, and A2.a for critical national infrastructure.
Can the firm that helped us prepare also do our audit?
NHS England requires conflicts of interest to be managed. We think it should never happen, and we will not audit work we have advised on.
We are a supplier. Do we complete the CAF-aligned version?
No. Suppliers complete the standards-based view, usually as Category 2, with a CAF mapping applied behind the scenes. Your NHS customers will still ask about CAF topics, particularly supply chain and secure software development.
What is new in CAF v4.0 that affects us?
Understanding the threat (A2.b), secure software development and support (A4.b), stronger monitoring with threat intelligence (C1.f) and threat hunting (C2.a), and AI risk throughout the framework.
Does the Cyber Security and Resilience Bill change our DSPT?
Not yet. It is still before Parliament. When enacted, it will tighten incident reporting (24 hours, then 72 hours) and bring managed service providers into scope. DHSC remains the regulator for health, and the DSPT is expected to stay the route for evidencing compliance.
Sources
Primary sources
- DSPT 2026-27 version 9: outcomes, assertions and evidence items (NHS England, 8 September 2026)
- DSPT audit 2026-27: areas of mandatory audit (NHS England, 10 September 2026)
- DSPT system changes and release notes (NHS England)
- Changes to the DSPT for OES and genomics organisations (NHS England)
- Update for NHS trusts, CSUs, ALBs and ICBs: status definitions (NHS England)
- Improvement plans (NHS England)
- CAF-aligned DSPT guidance, including Objective E (NHS England)
- Guide for CAF-aligned DSPT independent assessors (NHS England)
- Cyber Assessment Framework and CAF v4.0 release (NCSC)
- Cyber Security Charter for Suppliers to the NHS (NHS England)
- NIS Regulations 2018: guide for the health sector in England (DHSC)
- Cyber Security and Resilience Bill: stages (UK Parliament) and summary of the Bill (DSIT)
- Cyber security strategy for health and social care: 2023 to 2030 (DHSC)
- Synnovis ransomware cyber attack (NHS England London)