In short: The NHS DSP Toolkit is an annual online self-assessment that every organisation with access to NHS patient data and systems must complete. Cyber Essentials is a separate certificate covering five technical controls. They overlap technically but are not interchangeable, and NHS bodies buying under PPN 014 can require Cyber Essentials from suppliers.
What the DSP Toolkit is
The Data Security and Protection Toolkit (DSPT) is the NHS's online self-assessment for data security. Organisations use it to measure themselves against the National Data Guardian's ten data security standards and publish an assessment each year. The DSPT website states that every organisation with access to NHS patient data and systems must use it, so it reaches well beyond hospitals to GP practices, care providers, charities and the IT suppliers that support them.
The toolkit is versioned each year:
- 2025-26 was version 8, with its outcomes, assertions and evidence items published on 18 September 2025.
- 2026-27 is version 9. The outcomes, assertions and evidence items were published on 2 October 2026, and the areas of mandatory audit for NHS trusts, ICBs, ALBs, CSUs, operators of essential services, genomics organisations and IT suppliers were published on 1 October 2026.
- Interim publications. During the 2025-26 cycle, organisations completing the CAF-aligned toolkit were reminded to publish an interim assessment by 31 December, so expect milestones during the year as well as the final submission.
Check the DSPT site for the current deadlines and guidance for your organisation type, because they change between versions.
Two versions of the toolkit
Since the 2024-25 assessment, the toolkit has had two distinct forms:
| CAF-aligned DSPT | DSPT for other organisations | |
|---|---|---|
| Who completes it | Large NHS organisations (trusts, integrated care boards (ICBs), arm's length bodies (ALBs) and commissioning support units (CSUs)) since 2024-25, joined in 2025-26 by independent providers designated as operators of essential services and genomics organisations | Other organisations with access to NHS data and systems, including many smaller providers and suppliers |
| Basis | The NCSC Cyber Assessment Framework: outcome-based objectives and contributing outcomes | A separate set of standards and evidence items suited to smaller organisations |
| Assurance | Self-assessment, with independent audit of the mandatory areas | Self-assessment; check the current audit guidance for your organisation type |
| Frequency | Annual | Annual |
The CAF-aligned version moves large NHS organisations away from a compliance checklist towards demonstrating outcomes, in line with how the NCSC approach is used for essential services more widely.
How DSPT and Cyber Essentials differ
The two are often confused because both are annual and both cover security, but they answer different questions:
| NHS DSP Toolkit | Cyber Essentials | |
|---|---|---|
| Purpose | Shows an organisation handles NHS data and systems securely and lawfully | Shows an organisation has five baseline technical controls in place |
| Coverage | Broad: governance, staff responsibilities, training, data handling, incident response, continuity and technical security | Narrow and technical: firewalls, secure configuration, security update management, user access control, malware protection |
| Who checks it | Self-assessment, with independent audit for some organisations | Marked by an assessor at an IASME-licensed Certification Body; Cyber Essentials Plus adds hands-on testing |
| What you get | A published toolkit assessment status | A certificate valid for 12 months, searchable on IASME's site |
| Who asks for it | NHS organisations whose data or systems you access | Buyers, including NHS bodies under PPN 014, and other customers |
Completing one does not give you the other. Do not assume a toolkit assessment will be accepted in place of a Cyber Essentials or Cyber Essentials Plus certificate, or the reverse: treat them as separate requirements unless the current toolkit guidance or your contract says otherwise.
Where the two overlap
The technical parts of the toolkit and the Cyber Essentials requirements cover a lot of the same ground. Work done for one usually helps with the other:
- Asset inventory. Both expect you to know which devices, software and cloud services you use. Cyber Essentials needs it to define scope; the toolkit asks about it directly.
- Patching. Cyber Essentials requires critical and high-risk updates within 14 days and removal of unsupported software. The same records evidence your update management in the toolkit.
- Access control and MFA. Unique accounts, removal of leavers, separate admin accounts and MFA on cloud services appear in both.
- Malware protection and firewalls, evidenced by the same configuration screenshots and reports.
- Staff training and backups. These are toolkit topics but not Cyber Essentials technical requirements, although the NCSC strongly recommends backups. Plan them separately; see security awareness training.
A practical approach is to run the Cyber Essentials work first, because it is tightly defined, then reuse its evidence for the technical items in your toolkit submission.
NHS buyers and PPN 014
NHS bodies are among the in-scope organisations under PPN 014. That means an NHS trust or ICB buying services that involve personal data, or ICT systems that store or process data at OFFICIAL, can require suppliers to hold Cyber Essentials or Cyber Essentials Plus before award and renew it every year of the contract, on top of any toolkit requirement.
If you supply the NHS, expect to be asked for both: a current DSPT assessment because you access NHS data or systems, and a Cyber Essentials certificate because the procurement requires it. Read each tender carefully for the level and timing it asks for.
How we help health and care organisations
Forever Systems helps NHS suppliers, care providers and other health organisations get Cyber Essentials and Cyber Essentials Plus in place in a way that also strengthens their toolkit evidence. We start with a gap analysis, fix issues across devices, Microsoft 365 or other cloud services and user accounts, and support you through assessment with an IASME-licensed Certification Body, which issues the certificate. We do not complete or submit your toolkit assessment for you, but the records we leave you with are designed to be reused.
Costs depend on your size and starting point, so ask us for a quote. Contact us to plan your Cyber Essentials work around your toolkit deadline.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does the DSP Toolkit replace Cyber Essentials?
No. The DSP Toolkit is the NHS's annual data security self-assessment; Cyber Essentials is a separate certificate for five technical controls. Completing one does not give you the other, although much of the technical evidence overlaps.
Who has to complete the DSP Toolkit?
Every organisation with access to NHS patient data and systems. Large NHS organisations such as trusts, ICBs, ALBs and CSUs complete a CAF-aligned version; other organisations, including many suppliers and smaller providers, complete a different version.
Do NHS suppliers need Cyber Essentials?
Often, yes. NHS bodies are in scope of PPN 014, so they can require Cyber Essentials or Cyber Essentials Plus from suppliers on contracts involving personal data or certain ICT services. Check each tender for the level required.
What is the current version of the DSP Toolkit?
The 2026-27 toolkit is version 9, with its outcomes, assertions and evidence items published on 2 October 2026. The 2025-26 toolkit was version 8. Check the DSPT website for the deadlines that apply to your organisation type.
Is Cyber Essentials Plus equivalent to the DSP Toolkit?
No. They are different assurances: the toolkit covers governance, people and data handling as well as technical security, while Cyber Essentials Plus tests five technical controls. Treat them as separate requirements unless the current toolkit guidance or your contract explicitly says otherwise.