October 7, 2026

DSPT 2026-27 Is Live: What's Confirmed, and What IT Suppliers Are Still Waiting On...

By Craig Pepper · 3 minute read

The Data Security and Protection Toolkit for 2026-27 went live on 4 September 2026. Version 9 is now aligned to the Cyber Assessment Framework (CAF) version 4.0, and organisations have until 30 June 2027 to complete their assessment.

If you're an IT supplier to health and care, here's the part worth knowing early: most of what's new for you this year has already been published — and as of 1 October 2026, so has the one piece that was still missing: the mandatory audit scope.

What's confirmed for DSPT 26-27

NHS England has published the updated Outcomes, Assertions and Evidence items for version 9, with downloadable spreadsheets covering NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics organisations, plus separate versions for IT Suppliers, dentists, GPs, local authorities, opticians, pharmacies, social care providers and universities.

The headline change is the shift from CAF v3.2 to CAF v4.0 — the security framework DSPT is built on. Alongside that, a changelog is available showing exactly what's moved between version 8 and version 9, so organisations can see precisely what's new before they start evidencing.

For Category 2 IT Suppliers specifically, the evidence requirements are already out, and there's a fair amount to get ahead of:

A new mandatory requirement (4.5.6) that software supplied to health and care organisations supports multi-factor authentication or identity federation to industry standards — or has a credible, resourced plan to get there — by 30 June 2027.
A new mandatory requirement (9.5.11) that software is developed in line with the government's Software Security Code of Practice.
An updated requirement (9.5.10) around signing the Supply Chain Charter.
A new "Products and Services" section, where suppliers declare each product or service they provide to health and care, along with its security controls, vulnerability management process, access controls, incident management process, and DTAC status.
Two requirements dropped entirely for Category 2 — around NDG training (2.1.1) and responding to a cyber alert (6.3.2) — a rare case of the toolkit asking for less.

There are 102 mandatory evidence items in total for Category 2 this cycle. Holding Cyber Essentials Plus covers 26 of them; ISO 27001 covers 20; PSN IA covers 9. Only one — the independent audit assertion itself (9.4.5) — is waived if you've already been through audit.

None of that depends on what comes next. It's confirmed, it's published, and it can be actioned now.

What IT suppliers were waiting on (now resolved)

When this piece first went up, NHS England had confirmed the mandatory audit scope for NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics organisations — 11 mandatory outcomes plus one of their own choosing — but had not yet said which areas IT Suppliers would be independently audited against.

That gap closed on 1 October 2026. NHS England confirmed the 12 mandatory assertions that make up the IT Supplier audit scope for 2026-27, following the same pattern as last year's cycle: a fixed list, with no self-selected element, covering governance and accountability, access and identity management, incident response, business continuity, technical controls (including the annual penetration test) and supply chain due diligence.

We've broken the full list down, assertion by assertion, in DSPT 2026-27: The 12 Mandatory Audit Areas for IT Suppliers — that's the piece to read next if you're mapping your audit evidence now.

What to do in the meantime

Waiting for other NHS England announcements isn't a reason to sit on the evidence you already have confirmed. If you supply software or services into health and care, it's worth using the run-up to June 2027 to:

Work through the changed evidence items in the Category 2 spreadsheet and flag which ones need new evidence, new processes, or a conversation with your development team, the MFA/identity federation requirement in particular has a hard deadline attached.
Cross-check your evidence plan against the 12 mandatory audit areas now that they're published, since that's what your independent auditor will actually test.
Draft your Products and Services entries now, while the detail is fresh, rather than leaving all of it until closer to submission.
If you haven't already, get a penetration test booked in and, if you're not currently Cyber Essentials Plus certified, look at getting it in place. A pentest is mandatory evidence in its own right (assertion 9.2) and one of the 12 areas under direct audit, slots book up well in advance of the June deadline, and Cyber Essentials Plus already covers 26 of the 102 Category 2 evidence items, so both are worth having sorted now.