DSPT v8 Compliance IT Services for Healthcare Organisations

Why DSPT v8 Is Different

The Data Security and Protection Toolkit has been the NHS’s primary data security assurance mechanism since it replaced the Information Governance Toolkit. But version 8 represents a real step change. Released on 1 September 2025 with a submission deadline of 30 June 2026, it brings healthcare data security requirements closer to the rigour expected of financial services regulation.

The key shift is from compliance as documentation to compliance as operational discipline. DSPT v8 doesn’t just ask whether you have policies — it asks whether a named senior officer actively owns your security approach, whether you can evidence regular security discussions at leadership level, and whether your incident detection and response capabilities are genuinely effective.

If you’ve been treating DSPT as an annual tick-box exercise, version 8 will require a fundamentally different approach. Our healthcare IT support is built around making compliance operational, not aspirational.

The 10 National Data Guardian Standards

The DSPT maps to the National Data Guardian’s 10 data security standards. Each standard has specific assertions that your organisation must evidence:

Leadership and Culture — A named senior officer must own data security. Staff must receive annual data security awareness training. Security must be discussed regularly at leadership level, not relegated to an IT function.

Data Security Processes — Access to patient data must follow the principle of least privilege. Role-based access controls must be implemented and reviewed. Data sharing must be lawful, appropriate, and documented.

Technology Controls — Firewalls, malware protection, secure configuration, patch management, and encryption must be in place. Multi-factor authentication is mandatory for remote access and privileged accounts. Backups must be encrypted, tested, and stored securely.

Incident Management — You must be able to detect, respond to, and report security incidents. Near-miss reporting must be encouraged. Lessons learned must feed back into your security improvement programme.

The Cyber Essentials Plus Dimension

NHS Supply Chain’s adoption of Procurement Policy Note 014 has added a parallel compliance requirement. Cyber Essentials Plus certification is now mandatory for suppliers who handle personal data or deliver IT and digital services to the NHS.

The five Cyber Essentials controls — firewalls, secure configuration, access control, malware protection, and software updates — overlap significantly with DSPT technical requirements. But achieving CE+ doesn’t exempt you from DSPT, and vice versa. Both must be completed separately.

The April 2026 update to Cyber Essentials Plus assessment criteria adds further considerations for organisations planning certification. We coordinate both certification pathways to avoid duplicated effort and ensure your organisation meets both requirements on schedule.

The Synnovis Wake-Up Call

The Synnovis ransomware attack in June 2024 was the most significant cyber attack on NHS infrastructure in recent years. A pathology services provider serving multiple London NHS trusts was compromised, disrupting laboratory services for months. Thousands of patient appointments were cancelled. Blood test results were delayed. Clinical decision-making was impacted.

DSPT v8 increases supply chain security requirements directly in response to incidents like Synnovis. Your organisation must now demonstrate that you assess the data security practices of your suppliers and that your incident response plans account for supply chain disruptions.

This isn’t theoretical risk. It happened in London, to NHS services, within the last two years.

How Nerdster Delivers DSPT-Ready IT

We don’t sell DSPT compliance as a consultancy project separate from your IT management. Compliance is built into how we run your infrastructure:

Your digital asset register is maintained automatically through our endpoint management and monitoring platform. MFA is deployed and enforced as standard. Patch management follows a documented cycle. Backups are encrypted, tested, and stored in geographically separated locations. Access controls follow least-privilege principles and are reviewed quarterly.

When your annual DSPT submission is due, the evidence already exists because it is a natural output of properly managed IT. We compile the submission, identify any gaps requiring attention, and coordinate the process with your Data Protection Officer or senior information risk owner.

For healthcare organisations that want data security to be an operational reality rather than an annual panic, we provide the infrastructure, the cybersecurity expertise, and the ongoing management to make that happen.