NHS DSPT Independent Auditors

Free DSPT readiness checker

Find out in an instant if you need an audit and where your security posture stands

Answer seven short steps about your organisation and controls. You’ll get an instant verdict on whether an independent DSPT audit applies to you, plus a security score and the gaps to close before you submit.

Start the free assessment Takes about 3 minutes

Audit verdict

Find out straight away whether your organisation needs an independent DSPT audit this year.

Security score

See your security posture as a score out of 100, broken down across governance, data protection, cyber controls and incident response.

Your top priorities

Get the three gaps to fix first, so your DSPT submission and audit go smoothly.

WIN MORE WORK WITH NHS

Ensuring Compliance With DSPT Toolkit

Our auditors review your DSPT submission against NHS England's mandatory audit scope, test that your evidence reflects what actually happens in practice, and give you a clear, prioritised list of anything to fix before you submit.

Streamlined Process

We simplify the compliance process for digital health companies, ensuring smooth audits and certifications.

Expert Auditors

Our team of security specialists provides expert guidance and support throughout the compliance journey.

Ready to Get Started?

Join the digital health companies that trust us for their NHS DSPT compliance needs.

100% Success Rate
2-3 Day Audit Process
Expert NHS DSPT Auditors

Testimonials

“Periculo assisted with our DSPT audit requirements. They were able to quickly understand our needs, the proposal met the brief and a detailed project plan was produced.

The process was well supported by the team and we gained a successful outcome.”

MIKE // MULTI-HEALTH SYSTEMS

Why Choose Our NHS DSPT Auditor Process?

Enhancing Reputation

Build trust with NHS and healthcare partners
Demonstrate commitment to data protection
Enhance credibility in digital health sector
Meet regulatory compliance requirements

Gain Advantage in Tendering

Access NHS procurement opportunities
Meet mandatory tender requirements
Competitive advantage over suppliers without a Standards Met DSPT
Faster contract approval processes

What Our NHS DSPT Audit Covers

Data Security Standards

Auditing against the 12 mandatory assertions NHS England has set for 2026-27, from data protection transparency, staff training and security culture through to penetration testing, firewalls and supplier due diligence.

Staff Responsibilities

Audit of staff training records, role definitions, and accountability frameworks for data protection compliance.

Training & Awareness

Verification of mandatory training completion and ongoing awareness programs for all staff handling NHS data.

Managing Data Access

Assessment of user access management, privileged access controls, and data access monitoring systems.

Process Reviews

Evaluation of incident response procedures, business continuity plans, and supplier management processes.

Technical Security

Technical assessment of network security, vulnerability management, and protective monitoring capabilities.

FAQ’s

What is the NHS DSPT?

The Data Security and Protection Toolkit (DSPT) is NHS England's annual online self-assessment that every organisation with access to NHS patient data and systems must complete. The 2026-27 version (v9) is aligned to CAF v4.0 and must be submitted by 30 June 2027.

Who needs a DSPT independent audit?

Category 2 IT suppliers: organisations that supply digital goods or services to the NHS or care sector, have 50+ staff, and have £10m+ annual turnover. NHS Trusts, ICBs, ALBs, CSUs, OES and genomics organisations are also audited, under the CAF-aligned toolkit. Suppliers below the Category 2 thresholds self-assess without an audit. Check which applies to you.

What is DSPT evidence item 9.4.5?

The requirement for Category 2 IT suppliers to have their DSPT submission independently audited each year, also referred to as an independent assessment, rather than self-assessing.

What does the DSPT 2026-27 audit cover for IT suppliers?

12 mandatory assertions published by NHS England on 1 October 2026, with no self-selected element: 1.1 lawfulness, fairness and transparency; 2.2 staff contracts; 3.1 staff training and awareness; 3.2 security culture; 4.1 staff and role records; 6.2 anti-virus and email protection; 7.1 incident response; 8.1 supported software and hardware; 8.2 managing unsupported software and hardware; 9.2 penetration testing; 9.6 firewalls; and 10.2 supplier due diligence. See the full breakdown.

When is the DSPT 2026-27 deadline?

30 June 2027, for both the independent audit and the full submission.

How long does a DSPT independent audit take?

Our audits run as structured 2-3 day engagements: evidence review, staff interviews and technical validation. Most suppliers need three to six months of preparation beforehand.

Is DSPT a certification?

No. DSPT produces a published status, such as Standards Met, rather than a certificate. The audit verifies that your submission is accurate and backed by evidence.

What happens if a DSPT audit finds gaps?

You receive a report with findings and remediation actions. A Standards Not Met status is visible to NHS procurement teams, so closing gaps before submission matters. We can support remediation, penetration testing and Cyber Essentials Plus or ISO 27001 certification.

Who carries out Periculo's DSPT audits?

Periculo is a CREST-accredited penetration testing provider and IASME-licensed Certification Body based in Melksham, Wiltshire, specialising in digital health and NHS supplier assurance.