Get your IT and evidence ready for DSPT 2026–27
We help healthcare teams understand the gaps, organise the technical work and prepare their evidence, with a clear scope and responsibilities.
Nerdster supports healthcare organisations with the IT controls and evidence behind their Data Security and Protection Toolkit submission. Version 9 covers 2026–27, with a published deadline of 30 June 2027. We agree the applicable scope and work alongside the person responsible for your organisation's submission.
Meet the requirements you will be assessed against
The right toolkit for your organisation
Start with your organisation category and the current toolkit year. A GP practice, an IT supplier and an NHS trust do not all complete the same assessment.
Clear ownership
Agree who owns the submission, who supplies technical evidence and who approves policies and declarations. We work with your responsible officer and existing advisers.
An accurate asset list
Reconcile devices, software, accounts and key suppliers so the evidence reflects the systems you actually use.
Practical security controls
Review access, updates, endpoint protection and backup arrangements against the evidence items that apply to your organisation.
A usable evidence pack
Bring together records of technical controls, checks and agreed improvements. Identify missing evidence early enough for the responsible person to review it.
A plan beyond submission
Agree how records, training and technical controls will be maintained during the year, rather than rebuilding the evidence each June.
Start with the current toolkit year
Version 9 applies to 2026–27, with a deadline of 30 June 2027. NHS England has published the current outcomes, assertions and evidence items. Use the requirements for your organisation category, rather than copying last year’s answers. Check the official version 9 publication.
The published material separates the requirements for different organisation types. It also identifies alignment with the NCSC Cyber Assessment Framework version 4.0. Your starting point is the category and assessment shown in your toolkit account.
What Nerdster can help with
We focus on the technology and evidence behind your answers:
- Understand the setup: devices, applications, access, networks and suppliers.
- Review gaps: compare the technical evidence you have with the applicable requirements.
- Plan the work: identify owners, dependencies, costs and a realistic timetable.
- Implement agreed changes: work on access controls, updates, protection and recovery where needed.
- Organise evidence: make the technical records clear enough for your responsible officer to review.
- Keep it current: agree ongoing checks and records as part of your support scope.
Policies, staff processes and declarations also need attention. We work alongside the people responsible for those areas and make the division of responsibilities clear.
What to prepare for the first conversation
Tell us your organisation type, the toolkit year you are working on and whether you have submitted before. It helps to know who looks after your IT, how many sites you operate and which areas are causing concern.
You do not need to send patient records, passwords or a full evidence pack through the website form. If further information is needed, we will agree a suitable way to share it.
DSPT and Cyber Essentials are separate
A customer or contract may ask for Cyber Essentials or Cyber Essentials Plus alongside DSPT. Check the exact requirement, scope and deadline with the buyer. We can help coordinate the technical work while keeping the assessments and approvals distinct.
Keep the evidence useful after June
An asset list, access review or recovery test is useful only while it reflects the current environment. We can build agreed checks into managed IT support and backup and recovery planning, with records you can reuse for the next assessment.
We support healthcare providers, pathology laboratories and dental practices. Start with a short enquiry and we will explain the next step and costs before work begins.
Last updated:
FAQ
Frequently asked questions
Who needs to use the DSPT?
NHS England says organisations with access to NHS patient data and systems must use the toolkit. Check your organisation category, contracts and access arrangements to establish the assessment that applies to you.
Which version and deadline apply now?
The current 2026–27 toolkit is version 9. NHS England lists 30 June 2027 as the submission deadline. Version 8 covered the previous 2025–26 year. Check your toolkit account and current NHS guidance before submission.
Is DSPT the same as Cyber Essentials Plus?
No. DSPT is a separate assurance process. Cyber Essentials or Plus may also be required by a customer or procurement contract. We review the actual requirement and reuse relevant evidence where appropriate; one does not automatically replace the other.
Can you work with our existing IT provider?
Yes. We can review gaps and help organise technical evidence alongside your provider, internal IT team and responsible officer. The proposal sets out who will implement and verify each action.
How long does preparation take?
It depends on your organisation category, systems, evidence and gaps. We agree a timetable after the initial review. Remediation, supplier responses and internal approvals can affect the schedule, so start before the deadline becomes urgent.
Will you submit and approve the toolkit for us?
We can support preparation and the submission process within the agreed scope. Your organisation remains responsible for the accuracy of its answers, declarations and approval. Support is not a guarantee of a particular assessment outcome.
Talk to our team about this standard
Tell us where you are with this standard. A London-based engineer replies the same business day.
Message sent
Thanks for getting in touch. We will reply by email during business hours, Monday to Friday, 8am–6pm. If you need to add anything, email [email protected].
Contact details
0330 043 7414
Mon-Fri 8am-6pm
hello@nerdster.co.uk
We reply the same business day
71-75 Shelton Street
Covent Garden, London WC2H 9JQ
What happens next?
We read your enquiry and reply by email. If a call or a closer look at your setup would help, we will arrange that with you.
- A reply from our team, in plain English
- Any questions needed to understand the work
- Scope and pricing agreed before paid work starts
- A call only if it would be useful to you
Related compliance services
Find out where you stand today
Book a compliance review. We assess your readiness against the current requirements and give you a priority order for closing the gaps.
- Published prices
- No-obligation assessment