DSPT Independent Audit for Category 2 IT Suppliers: What You Need to Know for 2026/27

Overview

IT suppliers providing digital services to the NHS face a mandatory independent audit requirement as part of their Data Security and Protection Toolkit (DSPT) submission.

For Category 2 IT suppliers — organisations with 50+ employees and £10 million+ annual revenue — comprehensive external verification of security practices is mandatory, with the deadline for the 2026-27 cycle set for 30 June 2027.

Category 2 IT supplier classification

You qualify as a Category 2 IT supplier if your organisation meets three criteria: you supply digital goods or services to NHS or care entities (including SaaS platforms, cloud hosting, EHR systems, cyber security services, or IT infrastructure); you employ 50 or more staff; and your annual turnover exceeds £10 million. Not sure which side of that line you fall on? Our separate guide, Does Your Organisation Need a DSPT Independent Audit?, walks through the three-question check NHS England uses.

The independent audit requirement under sub-assertion 9.4.5 has applied to Category 2 suppliers since the 2024/25 DSPT cycle and continues through 2026/27, reflecting NHS England's ongoing commitment to robust assurance for suppliers handling health and care data. Noncompliance can result in contract exclusion, loss of system access, and reputational harm.

Audit scope: 12 mandatory assertions

The DSPT independent audit examines both documentation and actual practice across 12 mandatory assertions. We've published the full, numbered breakdown in DSPT 2026-27: The 12 Mandatory Audit Areas for IT Suppliers at a high level, the areas cluster into:

Governance and accountability

Demonstrating data protection and security accountability structures with board-level oversight and documented governance frameworks.

Access control and identity management

Identity and access management for networks and systems processing NHS data, with particular focus on privileged user access and administrative controls over essential NHS services.

Incident management

Confidential breach reporting systems and evidence of vulnerability response based on NHS guidance, with documented lessons learned driving continuous improvement.

Business continuity and disaster recovery

Regular, documented testing of continuity and disaster recovery plans, alongside demonstrated capability to run incident response while limiting impact on NHS services.

Technical security controls

Supported systems receiving current security patches, vulnerability management that doesn't disrupt essential services, and properly configured, monitored firewalls, plus the annual penetration test required under assertion 9.2.

Supply chain security

Identifying all suppliers, the products and services they deliver, and contract durations, critical for IT suppliers relying on multiple sub-processors.

Audit process structure

At Periculo, the DSPT independent audit runs as a structured 2-3 day engagement combining evidence review and technical validation with comprehensive reporting.

Evidence review: auditors verify documentation accuracy, version control, and direct alignment with DSPT requirements. Generic policies or outdated materials don't meet the standard.

Interviews: senior leadership (board accountability), information governance leads, technical implementation staff, and operational personnel handling NHS data.

Technical validation: increasingly standard for IT suppliers, configuration reviews of NHS-facing systems, security monitoring log analysis, and review of penetration test results, focused on active compliance demonstration rather than documentation alone.

Preparation timeline and steps

Most IT suppliers need three to six months of structured preparation. Key steps:

• Appoint a dedicated DSPT lead with NHS-specific knowledge and cyber security expertise.
• Systematically gather evidence mapped to all 12 mandatory assertions, with consistent version control.
• Close gaps through policy development, technical work, staff training, testing, and supplier documentation.
• Run a pre-audit review to catch issues before the formal assessment.

Common audit failures

Generic policies. Templates unrelated to your specific services or NHS relationships raise concerns immediately, auditors expect contextualised policies.

Implementation gaps. Comprehensive policies mean nothing without demonstrable implementation: training records, technical configurations, and monitoring outputs.

Weak supply chain assurance. You remain accountable for data security even when using cloud providers or managed services. Auditors expect documented assurance for all sub-processors, including data protection contracts, equivalent security standards, and regular compliance reviews.

Incomplete business continuity testing. Missing documented test results, lessons learned, and demonstrated incident response capability is a frequent failure point.

Inadequate privileged access management. Auditors examine whether administrative access is appropriately restricted, regularly reviewed, and comprehensively monitored.

How Periculo can help

Periculo's DSPT independent audits are structured 2-3 day engagements examining all 12 mandatory assertions, combining technical validation with reporting that meets NHS England's Independent Assessment Framework. We also offer pre-audit gap analysis, identifying compliance gaps months ahead of formal audit, assessing your current state against the mandatory assertions, and providing a prioritised, audit-ready remediation roadmap.

If you're a Category 2 supplier working towards the 30 June 2027 deadline, get in touch to talk through scope and timing before the pre-deadline rush.

Related reading: NHS DSPT 2026-27: The Complete Guide for Category 2 IT Suppliers, DSPT 2026-27: The 12 Mandatory Audit Areas for IT Suppliers, Does Your Organisation Need a DSPT Independent Audit?, Does DSPT Require Penetration Testing?.

FAQs