The annual assessment every organisation touching NHS patient data must complete. It is now aligned to the NCSC Cyber Assessment Framework, which changed what a submission has to prove.
What is the DSPT?
The Data Security and Protection Toolkit is an online annual self-assessment operated by NHS England. Every organisation with access to NHS patient data or NHS systems must complete it, which includes suppliers as well as NHS bodies themselves. Submissions are due by 30 June each year.
The significant change is that the DSPT is now aligned to the NCSC Cyber Assessment Framework. Organisations are measured against the CAF, or against the National Data Guardian\u2019s ten data security standards, depending on which route applies to them. The 2026 submission is aligned to CAF version 3.4. This moved the toolkit away from ticking a checklist and towards demonstrating outcomes, which is a materially harder submission to make and a materially more useful one to hold.
It is no longer purely self-declared either. NHS bodies, designated Operators of Essential Services, genomics organisations and relevant IT suppliers must now have an independent CAF-aligned audit validating their self-assessment. If you already hold a CAF assessment for NIS Regulations purposes, most of that work counts here, which is the single biggest saving available on this toolkit.
Compliance requirements
Assessed against the CAF objectives, or the National Data Guardian standards, depending on your route.
CAF Objective A. Governance, risk management, asset management and supply chain, evidenced rather than asserted.
CAF Objective B. Access control, data security, system security, resilient networks and staff awareness.
CAF Objective C. Security monitoring and proactive discovery, which is where most first CAF-aligned submissions score lowest.
CAF Objective D. Response and recovery planning, and demonstrable lessons learned.
NHS bodies, designated OES, genomics organisations and relevant IT suppliers need an independent CAF-aligned audit validating the self-assessment.
The toolkit is an annual cycle, not a one-off. Evidence has to be current at submission, which means collecting it through the year.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We confirm which DSPT route applies to you, CAF-aligned or the National Data Guardian standards, and whether an independent audit is required.
We assess you against the applicable CAF objectives and contributing outcomes, reusing any existing CAF work, which is the largest available saving.
An outcome-based assessment needs evidence gathered across the year, not assembled in June. We set up the collection so the submission is a formality.
Your compliance manager closes the gaps, with attention to detection and monitoring where CAF-aligned submissions most often fall short.
We complete and submit the toolkit on your behalf, ahead of the 30 June deadline.
Where an independent CAF-aligned audit is required, we prepare you for it and manage the auditor relationship.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone