NHS DSPT Evidence Preparation & Assurance Checklist

IG-Smart practical guides | NHS assurance Edition: 24 October 2026 | Audience: DSPT leads, NHS organisations, suppliers and health or care providers

Use this guide to make a better-evidenced decision. This is general information and an original working aid, not a client-specific legal opinion, certification, clinical safety authorisation or regulatory approval. Apply the relevant jurisdiction, current requirements and competent professional review to your circumstances. Examples are illustrative unless expressly attributed.

1. Confirm the organisation category and current portal requirements.
2. Map each requirement to an owner, current evidence and verification record.
3. Check cycle-specific assurance requirements before agreeing an audit or submission decision.

A 2026–27 version 9 practitioner guide to applicability, evidence ownership, assertions, audit readiness and defensible submission

Executive proposition: Data Security and Protection Toolkit (DSPT) readiness is not achieved by uploading a large folder of policies. It requires an organisation-specific answer to the applicable outcomes, assertions and evidence, supported by current proof of control operation, accountable owners and explicit treatment of gaps.

For: NHS trusts, ICBs, relevant NHS suppliers, health and social care organisations, DSPT leads, IG managers, DPOs, CISOs, internal audit, assurance committees and accountable executives. Scope: a readiness and evidence governance aid, not an NHS-issued checklist, official assessment, auditor opinion or guaranteed standards-met submission.

The DSPT is an online self-assessment used by organisations with access to NHS patient data and systems. Requirements differ by organisation category, so a trust, key IT supplier and smaller care provider should not rely on the same generic evidence inventory. [S1]

Current cycle: The DSPT portal provides 2026–27 version 9 category-specific requirements and states a 30 June 2027 submission deadline. Use the requirements and applicable framework assigned to your organisation, rather than a single generic worksheet. [S2]

Category-specific assurance sources: DSPT 2026–27 is version 9, with a 30 June 2027 submission deadline. The Independent Assessment Guides landing page mixes current IT-supplier materials valid to 30 June 2027 with legacy CAF attachment descriptions valid to 30 June 2026; its “2025–26 (version 9)” sentence is internally inconsistent. Use the 2026–27 mandatory-audit notice and current NHS England CAF audit guidance for the relevant organisation category. Record the exact attachment title, version, category and validity period; do not apply an older CAF attachment merely because it appears on that landing page. [S3][S5][S6]

The aim is not “pass on the first try” marketing. It is to create a defensible, current record: applicable requirement → accountable owner → operational evidence → independent challenge where required → resolved or managed exception → authorised submission.

The DSPT portal publishes category-specific requirements, including outcome/indicator material for relevant NHS bodies and assertion/evidence items for other sectors and supplier categories. Confirm how your organisation is registered and which current worksheet applies. Do not paste an older-year response set onto this cycle without reconciling changes.

Essential distinction: a supplier's DSPT return does not automatically discharge a deploying trust's obligations. Likewise, ISO/IEC 27001 certification may support relevant evidence but cannot be treated as universal proof that every DSPT assertion has been met.

This chain is original IG-Smart working guidance, not the official DSPT assertion list and not a substitute for it.

A policy establishes intent. Strong assurance additionally requires evidence that the control works within the correct service and review period. A privileged-access policy, for example, should be supported where appropriate by relevant identity-system settings, access review samples, exceptions and accountable approval. An incident-response plan should be supported by a realistic exercise, after-action report and completed remediation—not only a document bearing the latest year.

Evidence verification rubric

Do not assign numerical confidence values as if they were official DSPT scoring criteria. Use the portal's prescribed assessment method for formal submissions.

This is an IG-Smart planning overlay, not a reproduction of the official v9 assertions. Map each field to actual current DSPT requirement IDs before final use.

Use a stable record ID to join these two views. Keep the official requirement ID and category alongside the evidence; the example is a structure, not a real submission or claim of conformity.

View A - requirement and source

View B - verification and decision

Do not treat a source link as verification. Identify what was examined, what it establishes and what remains unknown. Keep access-controlled records outside the public website and do not place patient data in a general worksheet.

Wrong version: evidence mapped to the prior year's assertions or an inapplicable category. Owner ambiguity: policies signed by the IG lead despite implementation belonging to another team. Policy-as-proof: comprehensive wording without logs, tests or exceptions. Historical tests: a prior-year restore reused despite material infrastructure change. Supplier blind spot: treating an assurance certificate as proof of the exact NHS-hosted service. Scope drift: changing subsidiaries, services or data flows without reassessment. Unresolved remediation: logging an issue as complete without a verified outcome. Inconsistent claims: published answers contradicting other operational records.

A readiness review should mark these as traceable problems with a named owner and resolution condition—not rewrite the narrative until it sounds compliant.

The DSPT portal publishes category-specific independent-assessment materials and a 2026–27 mandatory-audit notice. CAF outcomes and IT-supplier assertions are distinct requirements; do not transpose one category's audit scope into another. Check the exact current-cycle attachment, organisation profile, eligibility and terms of reference before agreeing scope and independence. Readiness support is not automatically an independent assessment, and not every registered organisation has identical audit obligations. [S3][S5][S6]

Before an audit: reconcile control ownership; confirm auditor eligibility/competence; agree evidence access and sampling; disclose conflicts; verify whether mandatory v9 audit areas apply; preserve findings without suppressing open gaps.

Audit-ready evidence pack structure

• 00 — Scope and requirement version: registration details, category, dated framework extract.
• 01 — Governance: accountabilities, approvals, audit programme.
• 02 — Control evidence: one indexed record per relevant requirement.
• 03 — Testing: samples, exercise results and scope limits.
• 04 — Gaps: risks, exceptions, remedial actions and retests.
• 05 — External dependency: supplier evidence and contracts.
• 06 — Submission record: responses, reviewer challenge and approval.

NHS trust with legacy device support. Evidence states all servers are patched, but clinical legacy devices run under an authorised exception. Readiness should expose the actual residual risk, compensating controls, governance approval and current plan instead of erasing the exception.

Key software supplier. It has ISO/IEC 27001 certification but outsourced incident support and privileged cloud support are not included in the evidence supplied. The assurance team checks entity, scope and current v9 category obligations rather than assuming certification proves every requirement.

Health charity with NHS data access. Its internal spreadsheet uses NHS trust requirements instead of the organisation's applicable DSPT category. Correct the applicability record and map evidence to the officially assigned worksheet before claiming submission readiness.

Organisation and profile: __; DSPT 2026–27 v9 applicability source: __; deadline and internal submission date: __; requirement owner completion: __; material evidence gaps: __; independent assessment applicability: __; unacceptable unmitigated risks: __; remediation budget and owners: __; submission approver: __; decision: submit / conditional preparation / defer and remediate; re-review trigger: __.

A submitted self-assessment should be represented accurately. An internal readiness checklist, a portal submission, an independently audited assessment and a published DSPT outcome are distinct events.

1. Which exact organisation profile and category applies?
2. Are we using the latest requirements for the current cycle?
3. Have we reviewed changes from the preceding version?
4. Who is authorised to approve the submission?
5. Who owns implementation for every requirement?
6. Does the evidence show operation rather than policy intent?
7. Is its scope exactly the covered legal entity and service?
8. Is evidence within an appropriate review period?
9. What control assumptions rely on critical suppliers?
10. Which exceptions are material and still active?
11. Can issues be retested and closed objectively?
12. Does the applicable category require independent assurance?
13. Can we provide evidence without exposing sensitive information?
14. Have internal challenge and executive review occurred?
15. What changes after submission will require monitoring?

Is DSPT a certification of the software product? No. The DSPT is an organisation-focused assessment; check its actual subject and publication status.

Are all v9 requirements identical for NHS trusts and suppliers? No. Refer to the current category-specific requirements.

Does ISO 27001 replace DSPT? No. Certification within a scope can support some evidence but does not complete the organisation's DSPT duties.

What is the 2026–27 deadline? The official DSPT portal states 30 June 2027 as of this edition; verify current portal status before publication or use.

Can an organisation submit despite gaps? Submission rules and representations depend on current official requirements; gaps must never be hidden or falsely represented.

Does a successful portal result prove every control works? No. The assessment has a defined method and evidential limitations; manage ongoing cyber/privacy risks continuously.

Next step: Submit a Requirement identifying organisation type, current DSPT version/category, intended submission date and most material evidence gaps.

• [S1] DSPT official portal dsptoolkit.nhs.uk/
• [S2] DSPT, *2026–27 version 9 outcomes, assertions and evidence* (current category-specific release) dsptoolkit.nhs.uk/News/169
• [S3] DSPT, *Independent Assessment Guides — verify each attachment's category, cycle and validity* dsptoolkit.nhs.uk/Help/Independent-Assessment-Guides
• [S4] NHS England, *Data Security and Protection Toolkit overview* digital.nhs.uk/services/data-security-and-protection-toolkit
• [S5] DSPT, *Mandatory audit requirements 2026–27* dsptoolkit.nhs.uk/News/170
• [S6] DSPT, *Updated CAF audit guidance 2026–27* dsptoolkit.nhs.uk/News/audit-guidance-2026-27