Get DSPT-ready and pass your CAF-aligned audit with confidence

The DSPT now follows the NCSC Cyber Assessment Framework, whose outcomes on testing and vulnerability management expect an independent penetration test by an accredited provider. We deliver a CREST test and a report written for your DSPT submission. Get a fixed quote.

The DSPT shifted from a checklist to an outcome-based model. Instead of asserting that controls exist, you now show evidence that they work, including testing your systems and demonstrating you act on the findings. That makes independent penetration testing and clear remediation evidence far more important.

In practice, yes, for any organisation that handles NHS patient data or connects to national NHS systems. A completed DSPT with a satisfactory standard is a common condition of NHS contracts and data-sharing agreements, so failing to complete it can stop you from winning or keeping the work.

NHS organisations and the suppliers and processors that handle NHS patient data complete the DSPT annually. Many suppliers and higher-risk organisations also face an independent audit on an annual cycle.

The DSPT is an annual assessment, so you complete and submit it once a year. Because the CAF-aligned outcomes expect testing and vulnerability management on an ongoing basis, most suppliers commission a penetration test at least once a year to keep their evidence current.

Cyber Essentials remains a baseline expectation, with Cyber Essentials Plus often required for higher-risk systems and certain contracts. We are a certification body for both and will advise honestly on the level you need.

Think of it like driving in the UK. The DSPT is your driving licence: it assures that you, the organisation, are fit to handle NHS patient data, and you renew it every year. DTAC is the MOT for a specific vehicle: it assures that one product is fit for purpose before an NHS buyer adopts it. So the DSPT applies if your organisation handles NHS patient data, DTAC applies if you are putting a specific digital product in front of an NHS buyer, and both apply if you are doing the two together. They overlap on security evidence, and each expects an independent penetration test. We support suppliers with both. See our NHS DTAC penetration testing page.

Those are clinical risk management standards covering clinical safety, which is a separate discipline from cyber security. Our remit is the technical security evidence, penetration testing and Cyber Essentials. We are happy to point you in the right direction for clinical safety support.