Browse tools

NHS DSPT Readiness Checker

Get ready for your NHS Data Security and Protection Toolkit (DSPT) assessment. Pick your category, work through the 2026-27 evidence items that apply to you, see which mandatory items are still missing and keep your notes in a log book you can save, share with your IT provider and print.

Start a DSPT readiness log book

Choose your DSPT category and work through the evidence items that apply to you, grouped by the 10 data security standards. Category 3 organisations get about 80 items, GP practices about 50 and suppliers about 120. You can stop and come back.

Your answers are saved automatically in this browser and never leave it unless you choose to save online.

Open a log book

Files saved from this tool can be imported.

Who completes this version

  • Category 2: IT suppliers to health and care.
  • Category 3: care homes and home care providers, dentists, opticians, pharmacies, universities, charities and other organisations, plus 3a (care providers in the CQC market oversight scheme) and 3b (local authorities).
  • Category 4: GP practices.
  • Not covered here: NHS trusts, integrated care boards, commissioning support units, arm's length bodies and other organisations that use the CAF-aligned version of the toolkit. Use the official Data Security and Protection Toolkit directly.

Every organisation with access to NHS patient data and systems is expected to complete the toolkit each year.

Deadline and statuses

  • Deadline: the 2026-27 toolkit (version 9, published 2 October 2026) must be completed and published by 30 June 2027.
  • Standards Met: every mandatory evidence item for your category is met.
  • Approaching Standards: not everything is met yet, but you're on the way. Category 3 organisations that meet a smaller set of key items (we label them "Approaching Standards item") can usually publish at this level with an improvement plan. Other organisations may get it once an improvement plan is approved.
  • Standards Not Met: mandatory items are missing. You'll normally be asked for an improvement plan.

Exemptions

The official spreadsheet marks some evidence items as exempt for organisations that use NHSmail, hold a current Cyber Essentials Plus certificate, hold ISO 27001 certification or have PSN compliance. Tick what applies to you and we'll mark those items as covered. For IT suppliers, Cyber Essentials Plus alone covers 26 mandatory items. The toolkit asks for certificate details and decides for itself, so make sure each certificate is current and covers the systems you use for health and care.

How to use it

  • Answer for the whole organisation, as things are now, and record where the evidence is kept.
  • If an item doesn't apply to you, choose "Doesn't apply to us" and say why in the notes: the toolkit asks for "Not applicable" in the comments.
  • Read the readiness report and work on mandatory gaps first.
  • When you're ready, complete and publish your assessment on dsptoolkit.nhs.uk. This tool is unofficial and doesn't submit anything for you.
Is this the official toolkit?

No. It's an unofficial readiness checker made by osir. The evidence items are the official 2026-27 wording, but your status only comes from the assessment you publish on the DSPT website. The "what this means" guidance under each item is our own plain-English explanation, not official advice.

Where are my answers stored?

In your browser, automatically. If you choose "Save online", an encrypted copy is stored on our server under a private access code. We keep only a scrambled fingerprint of the code, so we can't read your log book, and online copies are deleted after 24 months without changes. Never put passwords or patient details in the log book.

Does Cyber Essentials help?

Yes. Many of the technical items (firewalls, secure configuration, updates, malware protection and user access) are the same controls Cyber Essentials checks, and a current Cyber Essentials Plus certificate exempts some items. Our Cyber Essentials Checker takes you through them.

What if I'm not sure of my category?

Your category is set when your organisation registers on the DSPT website and appears in your organisation profile there. If it looks wrong, contact the DSPT helpdesk before you start.

Evidence items reproduced from the NHS Data Security and Protection Toolkit 2026-27 (version 9), Crown copyright, from www.dsptoolkit.nhs.uk. Our guidance is not official and isn't endorsed by NHS England.

More free tools