DSPT (Data Security and Protection Toolkit)
The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems. It does not replace Cyber Essentials. In the 2026-27 version, a current Cyber Essentials Plus certificate exempts 26 of the 102 mandatory evidence items for IT suppliers. Basic Cyber Essentials gives no exemption.
- Term
- DSPT
- Also known as
- Data Security and Protection Toolkit, NHS DSPT
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term DSPT mean in Cyber Essentials?
The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
How does DSPT apply to Cyber Essentials?
In plain terms
If Cyber Essentials is a check of your locks and alarms, the DSPT is the NHS's wider questionnaire about how you look after patient data, not only the technical basics. It is the health service's own checklist, completed online each year against the National Data Guardian's 10 data security standards. The 2026-27 version is version 9, and its submission deadline is 30 June 2027.
How it relates to Cyber Essentials
The DSPT is an NHS requirement, separate from the Cyber Essentials scheme. NHS bodies also fall under PPN 014, so relevant NHS procurements from 24 February 2025 ask suppliers for Cyber Essentials as well. In the 2026-27 DSPT requirements, the requirements spreadsheet marks 26 of the 102 mandatory evidence items for IT suppliers (category 2) as exempt for Cyber Essentials Plus, and 3 mandatory items for other organisations (category 3) and GP practices (category 4). The spreadsheet has no exemption column for basic Cyber Essentials. Evidence item 10.2.1 asks organisations to make sure suppliers of IT systems that could affect care, or that process personal identifiable data, have the appropriate certification. Neither the NCSC requirements nor the Danzell question set mention the DSPT.
Common mistakes
Assuming one covers the other. A supplier that processes patient records usually needs both: Cyber Essentials, often Plus, for the contract and the DSPT for the data. The Cyber Essentials Plus exemptions change with each DSPT release, so check the current requirements spreadsheet for your organisation type rather than relying on last year's list. Checked against the version 9 category 2, 3 and 4 spreadsheet (v1.1) on 3 November 2026.
See Cyber Essentials for NHS suppliers and the DSPT, who needs Cyber Essentials and evidence.
Related terms
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- EvidenceEvidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.
- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- IASME Cyber AssuranceIASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
- ISO 27001ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
Frequently asked questions
The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.