DSPT 4.5.6 Explained

The New MFA and Identity Federation Requirement for IT Suppliers

Short answer: Evidence item 4.5.6 is a new mandatory requirement for Category 2 IT suppliers under DSPT 2026-27. It requires that software you supply to health and care organisations supports multi-factor authentication (MFA) or identity federation to industry standards or, if it doesn't yet, that you have an approved, realistic, resourced plan to get there by 30 June 2027. It's one of five changed evidence items for Category 2 this cycle, and the only one with its own hard deadline written into the requirement text.

What 4.5.6 actually asks for

NHS England's evidence text for 4.5.6 reads: "Software provided to health and care supports identity federation or multi-factor authentication to industry standards, or you have an approved, realistic and resourced plan to achieve this not later than 30 Jun 2027."

Two things are worth separating immediately, because they get confused:

4.5.6 is about the software and products you supply to the NHS; does the product itself support MFA or identity federation for the people who use it?

4.5.3, an existing (and also updated) requirement, is about MFA on your own organisation's remotely accessible and privileged accounts, your internal IT, not your product.

You need both. A supplier with excellent internal MFA but a product with no MFA support hasn't met 4.5.6, and vice versa.

What counts as meeting the requirement

There are two routes to evidencing 4.5.6:

1. Already there. Your product supports MFA (an additional verification factor beyond username and password) or identity federation (letting the customer's own identity provider, such as their NHS smartcard or Microsoft Entra ID setup, handle authentication) to an industry-recognised standard. Document how, and be ready to show it in a demo or technical review.
2. Credible plan. If your product doesn't support this yet, you need an "approved, realistic and resourced plan" to get there by 30 June 2027, not a vague intention. In practice, that means: sign-off from whoever owns the decision (your CTO, product lead, or board), a realistic technical scope and timeline, and confirmation that the work is actually resourced a named team or budget, not "when we get to it."

A plan that's aspirational rather than resourced is unlikely to survive independent audit scrutiny, particularly since 4.5.6 sits inside the 102 mandatory Category 2 evidence items and your submission is independently audited, not self-assessed.

Why this has a harder deadline than most DSPT changes

Most DSPT evidence items are assessed against your current state at submission. 4.5.6 is unusual in writing a specific future date, 30th June 2027, into the evidence text itself, rather than relying on the toolkit's general annual deadline. That's a signal NHS England is treating supplier-side identity controls as a priority it wants locked in, not just evidenced as "in progress" indefinitely.

If your product roadmap doesn't currently include MFA or identity federation work, it's worth raising this with your product and engineering leads now rather than at submission time. Authentication and identity work, especially identity federation against standards like SAML or OIDC, routinely takes longer to design, test and roll out than teams initially expect, particularly across an existing customer base.

How this fits with the rest of DSPT 26-27

4.5.6 is one of five evidence changes for Category 2 this year, alongside the new Software Security Code of Practice requirement (9.5.11), the updated Supply Chain Charter item (9.5.10), the new Products and Services data collection, and two dropped requirements. We've covered the full picture in NHS DSPT 2026-27: The Complete Guide for Category 2 IT Suppliers.

What to do now

1. Confirm whether your product(s) currently support MFA or identity federation, and to what standard.
2. If not, get a resourced plan approved and, in writing, with a named owner and timeline that lands before 30 June 2027.
3. Keep evidence of both the current state and the plan itself, since an auditor will want to see the approval and resourcing, not just a statement of intent.
4. Cross-check against your Products and Services declarations. If a product doesn't support MFA or federation, that's exactly the kind of detail this year's new data collection is designed to surface.

How Periculo can help

If you need an independent view on whether your current authentication approach or a plan to get there, Get in touch to talk it through.

Related reading: NHS DSPT 2026-27: The Complete Guide for Category 2 IT Suppliers, DSPT 2026-27: The 12 Mandatory Audit Areas for IT Suppliers, CAF v4 in the DSPT, Does DSPT Require Penetration Testing?.

FAQs