Meeting the Data Security and Protection Toolkit (DSPT) requirements

You’re not alone. Many healthcare organisations, social care providers, and third-party suppliers working with or within the NHS find the DSPT a challenge. Limited internal resources, evolving requirements, and uncertainty around what evidence is required can make the process time-consuming and difficult to navigate.

We help remove the complexity and enable organisations to achieve the 10 data security standards within the DSPT, providing practical guidance, technical expertise, and structured support throughout the self-assessment process.

Complete the form and we’ll be in touch to help you navigate the DSPT.

Common DSPT challenges

There are many factors involved in DSPT seem to b:

• Limited resources – many organisations lack dedicated cyber or governance staff to manage the process.
• Complex requirements – DSPT covers cyber security, GDPR, training, incident management, and supplier assurance, making compliance difficult to interpret.
• Keeping up with evolving requirements – annual changes can be hard to track and implement.
• Evidence and documentation – policies and proof of compliance are often incomplete.
• Training management – tracking annual staff training and compliance evidence is operationally heavy.
• Supplier assurance – ensuring third-party suppliers meet DSPT standards can be challenging.
• Control Mapping – aligning existing organisational controls with DSPT assertions is not always straightforward, interpretation of requirements can be challenging even taking existing controls and matching them to DSPT requirements can be challenging for some organisations. Sometimes customers actually meet a DSPT requirement by having an aligned control but are oblivious to the mapping!

Our specialists provide structured guidance, technical expertise, and practical support to help organisations overcome these hurdles.

What is cyber resilience?

Cyber resilience is defined as:

The DSPT embeds cyber resilience throughout its framework, requiring organisations to demonstrate secure controls across multiple security domains.

Key DSPT-aligned cyber resilience requirements include:

• Development and testing of cyber security incident response plans.
• Strong data protection and recovery capabilities.
• Cyber security monitoring and alerting.
• Vulnerability management processes.
• Supply chain security considerations.
• Effective information governance.

Meeting these requirements can be challenging, particularly for organisations balancing operational pressures, evolving compliance expectations and complex IT environments. We support organisations in implementing the processes, controls and technologies required to meet these standards and strengthen long-term resilience.

In addition to providing bespoke and overarching support to help with your DSPT requirements, we have a full portfolio of cyber security services that can help you meet specific requirements, see below.