Skip to main content

NHS & HealthTech Assurance

NHS DSPT Readiness & Assurance

Understand the DSPT requirements relevant to your organisation, address material gaps and prepare supporting evidence for the applicable submission.

View relevant evidence — View Relevant Evidence

When this service fits

When this service fits

  • A first DSPT submission is required for an NHS contract

  • Last year’s submission relied on thin or ageing evidence

  • The CAF-aligned view of the toolkit applies to you for the first time

  • An independent DSPT assessment is expected

  • Ownership of DSPT evidence is spread across teams

  • The submission is approaching and the gap is unclear

The service

What the DSPT is

The Data Security and Protection Toolkit is the NHS England online self-assessment that organisations with access to NHS patient data and systems use to demonstrate good data security and the proper handling of information. For organisations in the applicable CAF-aligned category, the DSPT uses the NCSC Cyber Assessment Framework as the basis for cyber security and information-governance assurance. Requirements vary by organisation type: NHS trusts, ICBs, CSUs, arm’s-length bodies and designated operators of essential services follow the CAF-aligned version, while IT suppliers and other categories complete a different set of assertions. The DSPT is a self-assessment, not a certification; the organisation makes its own declarations and submission. It sits alongside — but is not the same as — DTAC, clinical safety (DCB0129/DCB0160), privacy and cyber governance requirements, each of which is scoped on its own merits.

What changes for your organisation

Outcomes the service is built to deliver

  • Readiness assessment

    A clear view of where current evidence meets, partially meets or misses the requirements that apply to you.

  • Evidence planning

    A prioritised plan assigning owners and the evidence each requirement needs.

  • Policy and control support

    Support to close governance, policy and control gaps identified in the assessment.

  • Submission review

    Senior challenge of the evidence and assertions before submission.

  • Audit preparation

    Preparation for independent DSPT audit where required.

Where are you now?

DSPT readiness path

  1. Assess

    Review the current position against applicable DSPT requirements.

  2. Plan Evidence

    Identify required evidence, gaps, owners and priorities.

  3. Remediate

    Address agreed gaps and strengthen the supporting evidence.

  4. Challenge

    Senior pre-submission review of completeness, consistency and supportability.

  5. Prepare for Submission

    Finalise the evidence position for the organisation’s own DSPT submission.

Any separately commissioned independent DSPT assessment or assurance sits outside this readiness pathway. The organisation remains responsible for its own DSPT submission. Delivered within IG-Smart’s wider Assess → Build → Manage → Assure → Improve approach.

What each stage produces

  1. Assess

    Readiness gap register

  2. Plan Evidence

    Evidence tracker

  3. Remediate

    Remediation plan

  4. Challenge

    Assurance summary

  5. Prepare for Submission

    Final evidence position

What you receive

The working records this service produces

Illustrative examples of the registers, records and executive reporting that may support the engagement.

DSPT Readiness Dashboard · Submission yearIllustrative data — not client data
Overall positionAmber — on track
Mandatory evidence items met
88 / 108
▲ 14 this period
Open evidence gaps
9
▼ 5 vs last review
Data security training
On track
No change
Incidents under review
1
No change

Gaps by priority

  • High2
  • Medium3
  • Low2

Evidence complete

81%

Overdue actions
3
Policies awaiting approval
2
Matters for escalation
1

Illustrative output

DSPT Readiness Dashboard

Readiness at a glance

A recurring view of DSPT evidence progress, so mandatory items are met and gaps are visible before the submission deadline.

What it helps you see

  • Mandatory evidence position
  • Open gaps by priority
  • Training and incident status
  • Actions due before submission

Likely format

Dashboard / reporting view · Supporting registers and evidence records · Executive PDF summary where agreed

Readiness gap registerIllustrative data — not client data
Illustrative Readiness gap register
Requirement areaCurrent evidenceStatusOwner
Requirement area APolicy in place, not signedPartly metHR lead
Requirement area BRecords incompleteNot metIG lead
Requirement area CTested this yearMetIT lead

Illustrative output

Readiness gap register

Readiness position

Where evidence meets, partly meets or misses requirements.

What it helps you see

  • Requirements met, partly met or missed
  • Evidence behind each position
  • Priority gaps
  • Owner

Likely format

Evidence trackerIllustrative data — not client data
Illustrative Evidence tracker
Evidence itemOwnerDueState
Evidence item 1IG leadWeek 3In progress
Evidence item 2IT leadWeek 4Not started
Evidence item 3Security leadWeek 2Ready

Illustrative output

Evidence tracker

Evidence plan

Each item, its owner and its due date.

What it helps you see

  • Each evidence item
  • Owner
  • Due date
  • Status

Likely format

Remediation planIllustrative data — not client data
Illustrative Remediation plan
GapActionPriorityTarget
Gap ATargeted refreshHighBefore submission
Gap BContract reviewMediumMonth 2
Gap CUpdate ownersMediumMonth 1

Illustrative output

Remediation plan

Gaps to closure

Gaps closed in priority order.

What it helps you see

  • Gaps in priority order
  • Agreed actions
  • Owners and dates
  • Progress to closure

Likely format

Assurance summaryIllustrative data — not client data
Illustrative Assurance summary
AreaConfidenceResidual concernRecommendation
GovernanceHighNoneSubmit
Technical controlsMediumPatch evidenceAdd evidence
PeopleMediumTraining recordsComplete first

Illustrative output

Assurance summary

Pre-submission view

A senior view before you submit.

What it helps you see

  • Overall evidence position
  • Remaining gaps
  • Matters for senior attention
  • Readiness to submit

Likely format

Illustrative structure — not a client document. Exact outputs and formats depend on the agreed scope.

Scope boundaries

What is included, and what is scoped separately

Included in the core service

  • Readiness assessment and gap analysis
  • Prioritised evidence and remediation plan
  • Senior review and challenge before submission

Separately scoped where required

  • Technical security testing
  • Large-scale remediation delivery
  • Ongoing managed information governance

Scope, deliverables and assumptions are agreed in writing before work begins.

Relevant evidence

Relevant evidence

Explore all case studies →Request HealthTech Assurance Evidence →

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

  • Subject-matter expert

    Michael Abtar

    LLB (Hons), PG.Dip.Law, Cert. DPO

    Michael Abtar’s experience includes governance and assurance work involving more than 100 million consumer records.

    View profile

  • Subject-matter expert

    Shaista Peart

    BA (Hons), CIPP/E

    View profile

  • Subject-matter expert

    Dr Bright Mawudor

    PhD

    View profile

  • Client & programme contact

    Julia Andrade

    Coordinates scope, practitioners, delivery and stakeholder communication.

    View profile

Buyer decisions

Questions before you engage

Do you submit the toolkit on our behalf?

No. The submission remains your organisation’s responsibility. We help you prepare, evidence and challenge it so the assertions you make are defensible.

Can IG-Smart prepare us and also carry out the independent assessment?

Readiness and remediation support is distinct from independent assessment. We help you prepare and evidence your position. Where an independent assessment is required, it is separately scoped to preserve independence, and IG-Smart will not independently assess work for which it held management or implementation responsibility.

We are a supplier, not an NHS trust. Does this apply?

Often, yes. Many suppliers with access to NHS patient data or systems need a DSPT submission. Requirements depend on organisation type, which we confirm during scoping.

Will this guarantee a particular DSPT status?

No. We help you understand the requirements and strengthen your evidence; the status reflects your organisation’s own declarations and, where applicable, independent assessment. The DSPT is not a certification and our work does not imply NHS endorsement.

Does DSPT readiness cover DTAC or clinical safety?

No. They are separate requirements that share some evidence. Where relevant, DTAC readiness and clinical safety support are scoped separately.
HealthTech Governance overview

Investment

Starting investment: £7,500 + VAT

Typical investment: £10,000–£25,000+ + VAT. Delivered as a defined-scope engagement; scope, deliverables, assumptions and fees are agreed in writing before work begins.

A typical engagement can cover

  • Readiness assessment and gap analysis
  • Evidence planning with named owners
  • Prioritised remediation plan
  • Senior review and challenge before submission
  • Audit preparation where required

Procurement or supplier-assurance review?

Visit our Trust Centre

Ready to move forward?

Need a defensible DSPT position before submission?

Not sure which service applies? Find the Right Service

  • Still defining your requirement?

    Discuss DSPT Readiness

    Discuss the requirement, risk, scope and the right engagement model with an experienced practitioner.

    Discuss DSPT Readiness

  • Have a defined scope, tender or RFP?

    Submit a DSPT Requirement

    Share a defined requirement, RFP, tender, statement of work or existing scope for senior review.

    Submit a DSPT Requirement

  • Procurement or supplier assurance

    Prepare for Procurement Review

    Access company, security and assurance information for supplier review, with controlled evidence available on request.

    Open Trust Centre