DSPT version 9: what changed for 2026-27 and the 30 June 2027 deadline

This page explains what changed in DSPT 2026-27 version 9, the current edition of the NHS Data Security and Protection Toolkit, and what suppliers need in place by the 30 June 2027 deadline. Naq is a UK compliance platform for organisations working towards the DSPT, Cyber Essentials and ISO 27001.

NHS England released version 9 on 1 September 2026. It adds no mandatory evidence items for suppliers. The work comes from two changes for IT Suppliers: a new set of questions about each product you supply, and evidence dates that now run from 1 July 2026, including a penetration test window that has moved on by two years.

You may see 2 October quoted as the release date. That is when NHS England republished the requirements spreadsheet as version 1.1, with a change to one evidence item for Categories 3 and 4. The toolkit itself opened a month earlier.

For the background, read what the NHS DSPT is and who needs it and how to comply with the NHS Data Security and Protection Toolkit.

Are you a Category 2 IT Supplier, or Category 3 (Other)?

Your category sets the size of the job, so settle it first. You select IT Supplier if your company meets all three of these tests:

• 50 or more staff
• turnover of £10 million or more
• you supply digital goods or services, software or physical, to the NHS or care

Miss any one of them and you select Other. NHS England adds two further instructions. A company delivering direct care through digital tools as a healthcare provider selects Other, and an organisation that is not sure which category applies should also select Other.

Three details are worth checking before you rely on last year's answer. NHS England's launch slides say the IT Supplier category is expanding to "include specific additional suppliers", without naming them in the material published so far. Its pages do not say whether staff means headcount or full-time equivalent. And a company that is a separate legal entity with its own ICO registration completes its own DSPT, even inside a group.

Whichever category you are in, the assessment covers your health and care data, and other parts of the business can stay out of scope. That applies to every evidence item, including training and the asset register.

What changed for IT Suppliers (Category 2)

NHS England describes the changes for IT Suppliers as minor overall: 13 wording changes and 10 pieces of improved guidance. No item changed between mandatory and non-mandatory, and the mandatory count fell from 103 to 102. Three changes still matter in practice.

Questions about each product and service

Version 9 asks IT Suppliers about each product or service they provide to health or care organisations, by name. For each one you answer questions on:

• documented security controls, which must align with the supplier charter
• how you identify, assess and fix vulnerabilities, including security updates and telling customers about them
• whether access to sensitive data and administrative functions is restricted to authorised people
• your incident management process, including promptly notifying customers
• whether you have completed a DTAC assessment, the NHS Digital Technology Assessment Criteria

These questions sit in the organisation profile and any administrator can complete them. The toolkit prompts for them at publication, and NHS England's advice is to do them early. They must be answered before you publish. A company with several products needs an answer for each, although an entry can be duplicated and edited.

Evidence dates now start at 1 July 2026

Several tooltips set the period your evidence must fall in, and the seven mandatory items below now all read 1 July 2026. Three moved on by a year. Four moved on by two, because their version 8 tooltips still said 1 July 2024.

The penetration test is the one to look at first. A test from early 2026 would have fitted the version 8 wording and falls outside the version 9 tooltip, so check the date on your last report before you plan anything else. One non-mandatory item, 4.1.2 on minimum access, moved from 1 July 2024 to 1 July 2026 as well.

One item removed, one replaced

Item 7.1.5, a plan for communicating incidents to customers, has gone. It was mandatory in version 8. Customer notification of incidents now appears in the per-product questions. Item 9.5.10 used to ask about the secure email standard and now asks whether you have signed the Supply Chain Charter. It is not mandatory.

One date is worth noting. Item 4.5.6, on identity federation or multi-factor authentication in the software you supply, still accepts an approved, realistic and resourced plan to get there "not later than 30 Jun 2027". That date has not moved, and it is now this cycle's deadline, so any plan relying on it has to finish by then.

What changed for Other (Category 3)

The Category 3 list grew from 76 to 80 evidence items, and the mandatory count stayed at 45. The four additions are all non-mandatory:

• 1.3.15: managing the risks when staff or contractors take devices outside the UK
• 7.1.7: testing or exercising your business continuity plan for a data or cyber incident in the last 12 months
• 10.2.6: policies and assurance covering non-IT suppliers, such as cleaning or facilities staff
• 10.2.7: risk assessment and governance where you or your suppliers process identifiable patient or service user information outside the UK

The rewording of existing mandatory items may ask more of you than the new items do. Item 7.1.2 now asks that your business continuity plan is regularly reviewed and tested. Item 10.2.1 used to ask whether your IT system suppliers hold a cyber security certification, and now asks whether you assure yourself that their cyber security arrangements are sound. This is the item NHS England updated in version 1.1 of the spreadsheet, so work from that version.

NHS England has also split out two groups within Category 3: CQC market oversight organisations (3a) and local authorities (3b). Each has an extra item on the Cyber Assessment Framework, non-mandatory for 3a and mandatory for 3b.

DSPT and CAF: what applies to suppliers

Version 9 is aligned to version 4.0 of the Cyber Assessment Framework (CAF), and that alignment applies to Category 1: NHS trusts, integrated care boards, commissioning support units, arm's-length bodies, genomics organisations and independent providers designated as operators of essential services. IT Suppliers and Other stay on the National Data Guardian's 10 data security standards.

The new policy requirements in NHS England's launch slides, on extended detection and response, post-quantum cryptography and phishing-resistant multi-factor authentication, are set out for the CAF-aligned toolkit. Neither the IT Supplier webinar nor the Category 3 and 4 webinar lists them among its changes. IT Suppliers keep their own multi-factor authentication items, 4.5.3 for accounts and 4.5.6 for software. A customer's own requirements can go further, so check your contracts as well as the toolkit.

What to submit by 30 June 2027

Every organisation completing the toolkit must publish at least one assessment by 30 June 2027. To reach Standards Met, you answer every mandatory evidence item and confirm every assertion that contains one. You can publish more than once, so an early publication can be updated if things change.

For an IT Supplier, the items that depend on other people set the timetable, so start with these:

1. Book the independent audit and agree its scope.
2. Commission a penetration test, with your Senior Information Risk Officer (SIRO) helping to scope it, and have the SIRO review the results and an action plan.
3. Test your incident response plan since 1 July 2026, with active board and business representation.
4. Answer the products and services questions for everything you supply.
5. Refresh the dated records in the table above, then work through the remaining mandatory items.

For an Other supplier, the list is shorter and there is no audit item. Check two mandatory items with a 12-month window first: a training needs analysis, and at least 95 per cent of staff, directors, trustees and volunteers trained. Item 7.1.2, also mandatory, asks that your business continuity plan is regularly reviewed and tested. The test of that plan in the last 12 months is item 7.1.7, which is non-mandatory.

The mandatory audit areas for 2026-27

IT Suppliers need an independent DSPT audit to achieve Standards Met. It must cover 12 assertions as a minimum: 1.1, 2.2, 3.1, 3.2, 4.1, 6.2, 7.1, 8.1, 8.2, 9.2, 9.6 and 10.2.

The DSPT keeps no list of approved auditors. Your auditor must be able to act independently and must follow the DSPT audit guidance. Your auditor uploads the audit details to the DSPT. If the report is not final on 30 June, NHS England says to upload a draft and update it after the deadline.

Holding ISO 27001 or Cyber Essentials Plus does not remove the audit. Either can reduce its scope where the certificate covers all the health and care data you process, so agree that with your auditor when you set the scope.

Reaching Standards Exceeded

Outside Category 1, Standards Exceeded means Standards Met plus a current Cyber Essentials Plus certification recorded in your organisation profile. It must cover all of your health and care data processing, and NHS England's webinars ask for certification in the 12 months before the date you publish.

What happens if you miss the deadline

Your status is the part a buyer sees. Anyone can look up an organisation's toolkit status through the DSPT's Organisation Search, although the content of your assessment stays private. A procurement team can therefore check whether a current publication exists before you know it has looked.

The NHS England Standard Conditions contract makes completion a contractual requirement for providers, and a supplier can take on the same duty through the contract it signs, so read yours. The toolkit is also needed to use national systems such as NHSmail and the e-Referral Service.

NHS England has not yet published improvement plan instructions for 2026-27. Last cycle's instructions covered Key IT Suppliers among others: they could publish Standards Not Met, submit an improvement plan and, if it was approved, move to Approaching Standards. Treat that as last year's process only. The one-off Approaching Standards assessment on the Overview page is for social care organisations.

See the DSPT in Naq

In Naq, the DSPT sits in one workspace with DTAC, DCB0129 and the other standards NHS buyers ask for, and one control can meet requirements in several frameworks.

If your organisation needs a Data Protection Officer or a Clinical Safety Officer for wider NHS work, you can use your own or a named expert from Naq's partner network. A Data Protection Officer advises and your organisation decides. A Clinical Safety Officer must be a registered clinician.

Book a 15-minute demo

Frequently asked questions

When was DSPT version 9 released?

NHS England released DSPT 2026-27 version 9 on 1 September 2026. The requirements spreadsheet was republished as version 1.1 on 2 October 2026, with a change to item 10.2.1 for Categories 3 and 4.

What is the DSPT deadline for 2026-27?

30 June 2027. Every organisation completing the toolkit must publish at least one assessment by that date.

Do I need an independent audit?

Yes if you are an IT Supplier: the audit is required for Standards Met. The Category 3 Other list has no audit item.

Does the Cyber Assessment Framework apply to suppliers?

The CAF-aligned toolkit is for Category 1 organisations. IT Suppliers and Other suppliers complete the toolkit under the National Data Guardian's 10 data security standards.

Can a penetration test from before July 2026 count?

The version 9 tooltip for item 9.2.1 says the test should be since 1 July 2026, so plan on a test dated on or after that day. Cyber Essentials Plus is listed as an audit exemption for 9.2.1 and 9.2.3 where its scope covers all your health and care data, so check this with your auditor if you hold it.