NHS DSPT 2026-27 Guide for Category 2 IT Suppliers | Periculo

Short answer: if you supply digital products or services to the NHS or care sector and meet the Category 2 thresholds (50+ staff, £10m+ turnover), you need to evidence 102 mandatory items under DSPT version 9 for 2026-27, pass an independent audit against 12 of them, and submit by 30 June 2027. Five evidence items are new or reworked this year, two have been dropped, and a new "Products and Services" section asks you to declare every product you supply.

This guide walks through what's changed, what's required, and how to prepare.

What is Category 2 under DSPT?

Category 2 covers IT suppliers to health and care — organisations providing essential IT systems, platforms, infrastructure, or software used by the NHS. You fall into Category 2 if you meet all three of NHS England's criteria:

1. You supply digital goods or services to the NHS and/or care (SaaS platforms, cloud hosting, EHR systems, cyber security services, IT infrastructure, and similar).
2. You have 50 or more staff.
3. Your annual turnover is £10 million or more.

Meet all three and you're a supplier organisation on the larger, 102-item assessment, with an independent audit required. Miss any one of them and you complete the smaller "Other" assessment instead — see our separate guide, Does Your Organisation Need a DSPT Independent Audit?, if you're not sure which side of that line you sit on.

What's new in DSPT 26-27 for Category 2

Version 9 moves DSPT onto evidence refreshed against CAF v4.0. For Category 2, that shows up as five changed evidence items rather than a new framework to learn from scratch:

• 4.5.6 (new, mandatory): software you supply to health and care must support multi-factor authentication or identity federation to industry standards — or you need an approved, realistic, resourced plan to get there by 30 June 2027.
• 9.5.11 (new, mandatory): software you supply must be developed in line with the government's Software Security Code of Practice.
• 9.5.10 (updated): evidencing that you've signed the Supply Chain Charter.
• Products and Services (PS.1–PS.7, new): a data collection where you declare each product or service you supply to health and care, its documented security controls, vulnerability management process, access controls, incident management process, and whether it's been through a DTAC assessment.
• 4.5.3 and 6.3.3 (updated tooltips/evidence): the existing MFA-on-remote-access requirement and your monitoring solution evidence have both been refreshed for 26-27 — don't confuse 4.5.3 (MFA on your own remote/privileged accounts) with the new 4.5.6 (MFA/identity federation in the software you supply to the NHS). They're two separate requirements.

Two requirements have also been dropped for Category 2 this year: 2.1.1 (NDG training evidence) and 6.3.2 (responding to a cyber alert). If you were tracking either of those, you no longer need to.

The 102 mandatory evidence items, by the numbers

Category 2 organisations must evidence 102 mandatory items across ten Data Security Standards for 2026-27. Existing certifications shorten that list:

Cyber Essentials Plus exempts 26 of 102. ISO 27001 exempts 20 of 102. PSN IA compliance exempts 9 of 102. Already being independently audited exempts 1 (assertion 9.4.5 itself).

None of these exemptions stack to cover the independent audit requirement — they reduce the evidence you need to gather, not the audit itself. We've written a dedicated breakdown of exactly which evidence items each certification maps to, worth reading if you're deciding which certification to prioritise: Cyber Essentials Plus and ISO 27001: Which DSPT Evidence Items You Can Skip.

The independent audit: 12 mandatory areas

Category 2 suppliers don't self-assess their way through DSPT the way smaller organisations do. Your submission goes to an independent, accredited auditor, who tests your evidence against 12 mandatory assertions — no self-selected element, unlike the CAF-aligned toolkit used by NHS Trusts and ICBs. We've covered the full list in DSPT 2026-27: The 12 Mandatory Audit Areas for IT Suppliers.

In practice, auditors combine evidence review, staff interviews (senior leadership, information governance, technical and operational staff), and technical validation — configuration reviews, log analysis, and checking your penetration test results actually cover what they claim to. Generic, templated policies and documentation that doesn't match your actual NHS-facing services are the fastest way to fail.

Preparing for DSPT 26-27: a realistic timeline

Most Category 2 suppliers need three to six months of structured preparation ahead of their submission date. A practical approach:

1. Appoint a DSPT lead who understands both the NHS context and your own technical estate — this isn't a box-ticking exercise one person can do from a template.
2. Run a gap analysis against all 102 mandatory items, prioritising the five changed ones and anything tied to a hard deadline (4.5.6 in particular).
3. Close the gaps — policy work, technical changes, staff training, supplier documentation — with each item mapped to evidence an auditor can actually verify.
4. Draft your Products and Services declarations for every product or service in scope, while the detail around security controls and DTAC status is fresh.
5. Book your penetration test and any certification renewals early. CREST-accredited testers and certification bodies book up well before the pre-deadline rush, and a pentest with unresolved critical or high findings can hurt your submission more than not having one booked at all.
6. Run a pre-audit review to catch generic policies, implementation gaps, weak supplier assurance, or missing business continuity test evidence before your formal audit does.

Common reasons Category 2 submissions fail audit

• Generic or templated policies that don't reference your actual services or NHS relationships.
• Policy without practice — documentation with no training records, technical configuration, or monitoring output to back it up.
• Weak supply chain assurance — you're accountable for data security even where you rely on cloud providers or sub-processors, so auditors expect documented assurance covering all of them.
• Untested business continuity plans, or plans with no evidence of lessons learned from testing.
• Loosely managed privileged access — auditors specifically check whether administrative access is restricted, reviewed, and monitored.

How Periculo can help

Periculo is a CREST-accredited penetration testing provider and an IASME-licensed Certification Body, so we can support your DSPT 26-27 preparation end to end — gap analysis against the 102 mandatory items, your assertion 9.2 penetration test, Cyber Essentials Plus or ISO 27001 certification to cut down your evidence load, and independent DSPT audit. If 30 June 2027 is on your radar and you haven't started mapping evidence yet, get in touch to talk through scope and timing.

Related reading: DSPT 2026-27 Is Live: What's Confirmed, and What IT Suppliers Are Still Waiting On, DSPT 2026-27: The 12 Mandatory Audit Areas for IT Suppliers, Does Your Organisation Need a DSPT Independent Audit?, Does DSPT Require Penetration Testing?, CAF v4 in the DSPT.

Book a Call or Contact Us to find out more...

NHS DSPT Online Checker and Assessment

Take our NHS DSPT Online Checker and Assessment Tool today to quickly identify your current compliance level and uncover tailored actions to strengthen your data security. It only takes a few minutes — and gives you instant, actionable insight into how to improve your DSPT score and cyber resilience

Try the DSPT Checker now

FAQs