In short
The Data Security and Protection Toolkit (DSPT) is the NHS's annual self-assessment, which every organisation with access to NHS patient data and systems must complete. The current 2026-27 version is version 9. Larger organisations use a CAF-aligned version, which asks about security monitoring, threat hunting, incident response and lessons learned.
Get a quote for DSPT security monitoring
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the DSPT is
The Data Security and Protection Toolkit (DSPT) is an online self-assessment run for the NHS. Organisations use it to measure their performance against the National Data Guardian's 10 data security standards and publish an assessment each year. According to the toolkit's own site, every organisation with access to NHS patient data and systems must use it, so it reaches well beyond hospitals to GP practices, care providers, charities and the IT suppliers that support them.
The toolkit is versioned each year. The current version is DSPT 2026-27 (version 9):
- Its outcomes, assertions and evidence items were published on 2 October 2026.
- The areas of mandatory audit for NHS trusts, ICBs, ALBs, CSUs, operators of essential services, genomics organisations and IT suppliers were published on 1 October 2026.
Deadlines vary by organisation type and have changed between versions, so check the DSPT website for the submission date that applies to you.
The CAF-aligned DSPT
Since 2024-25 the toolkit has had two forms. Large NHS organisations (trusts, integrated care boards, arm's length bodies and commissioning support units) complete a version aligned to the NCSC Cyber Assessment Framework, and from 2025-26 independent providers designated as operators of essential services and genomics organisations joined them. Other organisations, including many smaller providers and suppliers, complete the standard version of the toolkit.
The CAF-aligned version is outcome-based, which changes the conversation about security monitoring. Instead of ticking that monitoring exists, organisations have to show it achieves something. The CAF's detection and response objectives are where managed services matter most:
| CAF principle (v4.0) | What you need to show in outline | Managed service that helps |
|---|---|---|
| C1 Security monitoring | You monitor the systems that support your essential functions and detect events that indicate an incident | Vendor MDR or managed SOC watching endpoints, identities, Microsoft 365, email and network |
| C2 Threat hunting | You look proactively for activity that evades standard defences | Threat hunting included in vendor MDR services |
| D1 Response and recovery planning | You have plans and the capability to contain and recover | Agreed response permissions and an incident response retainer |
| D2 Lessons learned | You learn from incidents and improve | Case reports and root cause analysis reviewed with you |
The audit areas for the CAF-aligned toolkit are set each year, so check which outcomes are in your mandatory audit before deciding where to focus. If you are not sure which version applies to you, check the guidance on the DSPT site or ask the NHS organisation you work with.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Logging, monitoring and incident response in practice
Whichever version you complete, three capabilities come up again and again in the technical sections.
Logging. You need records that show who accessed what and when, particularly for systems holding patient data. A SIEM as a service collects logs from Microsoft 365, identity, endpoints, servers and firewalls into one place with a retention period you set.
Monitoring. Logs only help if someone looks at them. A vendor SOC in services such as Sophos MDR, Check Point MDR, WatchGuard MDR or Blackpoint MDR watches alerts around the clock, investigates and takes the containment actions you have approved, such as isolating a device or disabling an account. See cyber security monitoring services for what can be covered.
Incident response and reporting. The toolkit expects incidents to be managed and, where required, reported. Vendor case reports give you the facts quickly, and a retainer gives you specialist help for serious incidents. Personal data breaches that pose a risk also need reporting to the Information Commission within 72 hours where feasible under UK GDPR.
Forever Systems does not run its own security operations centre. The 24/7 monitoring and response comes from the vendor services we resell, such as Sophos MDR, Check Point MDR or WatchGuard MDR; we recommend one, set it up, manage it and handle escalation with you.
Suppliers to the NHS
IT and service suppliers face the toolkit from two directions: their own DSPT assessment, and the security expectations of the NHS organisations they serve. NHS England's cyber security charter for suppliers asks signatories to commit to, among other things, meeting the DSPT standard and to effective 24/7 cyber monitoring and logging of their critical IT infrastructure. Our page on cyber security for NHS suppliers covers the charter in detail.
Many NHS contracts also ask for Cyber Essentials. The two are separate assurances that overlap technically; DSP Toolkit Cyber Essentials explains how they fit together. Staff training is part of the toolkit too, and is covered by security awareness training for healthcare.
Is DSPT security monitoring the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What we do and do not do
We can help you put the technical capability behind your toolkit answers: recommending vendor MDR, SIEM and incident response options, setting them up, connecting your log sources, agreeing response permissions and escalation contacts, and reviewing reports with you so you have evidence to hand.
We do not complete, sign or submit your toolkit assessment, and we do not act as your DSPT auditor. Those stay with your organisation and the auditor you appoint. What we can give you is a service description and regular reports that make the monitoring and response answers easier to evidence. Scope is confirmed at quote, and pricing depends on users, devices and data volumes, so ask us for a quote.
Contact us to strengthen the monitoring and response behind your DSPT assessment.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is the Data Security and Protection Toolkit?
The DSPT is the NHS's online annual self-assessment of data security and protection. Every organisation with access to NHS patient data and systems must complete it and publish its assessment.
What is the current version of the DSPT?
DSPT 2026-27, version 9. Its outcomes, assertions and evidence items were published on 2 October 2026, and the areas of mandatory audit for larger organisations and IT suppliers on 1 October 2026.
What is the CAF-aligned DSPT?
A version of the toolkit based on the NCSC Cyber Assessment Framework, completed by large NHS organisations since 2024-25 and by independent providers designated as operators of essential services and genomics organisations from 2025-26. It asks organisations to show outcomes rather than tick controls.
Does the DSPT require security monitoring?
The CAF-aligned toolkit includes the CAF's security monitoring and threat hunting principles, and every version asks about incident management. How much monitoring you need depends on your version, your audit areas and your risk.
Can an MSSP complete our DSPT for us?
No. The assessment is your organisation's own. A managed security service can provide the monitoring, logging and incident response that your answers describe, plus reports you can use as evidence.
Still have a question about DSPT security monitoring?
Ask us and a member of our team will reply by email.