On this page · 12 sections
- What changed for 2026-27, and the dates that matter
- CAF-aligned or not: which DSPT an IT supplier completes
- The 12 mandatory audit areas for IT suppliers in 2026-27
- How the scope rotates: 2024-25, 2025-26 and 2026-27
- What software suppliers must evidence beyond the audit
- Audit mechanics: who audits and what happens on 30 June
- Statuses, improvement plans and what NHS buyers see
- Worked example: a 40-person health-tech SaaS supplier
- Decision table: what to do based on where you start
- Implementation checklist
- How eCorpIT can help
- References
Summary. NHS England released version 9 of the Data Security and Protection Toolkit (DSPT) on 1 September 2026 and set the deadline at 30 June 2027, which is 229 days from 13 November 2026. Version 9 is aligned to version 4.0 of the NCSC Cyber Assessment Framework (CAF), but IT suppliers (Category 2) still answer numbered assertions under the National Data Guardian's 10 standards. On 1 October 2026 NHS England named the 12 assertions an independent auditor must test for IT suppliers: 1.1, 2.2, 3.1, 3.2, 4.1, 6.2, 7.1, 8.1, 8.2, 9.2, 9.6 and 10.2. Only 9.6 carries over from the 2025-26 audit scope, so last year's pack will not do. The 2026-27 supplier audit framework is already on the toolkit. Software suppliers also face mandatory evidence items on the government Software Security Code of Practice and product MFA, plus a products and services section. Book the penetration test and the auditor now, and plan to publish in early June 2027.
About this article. This is for UK and overseas software and IT service companies that supply NHS organisations. We checked dates, assertion numbers and evidence items against the DSPT news pages, the version 9 Category 2 spreadsheet, NHS England's 2026-27 supplier assurance framework and webinar slides, NHS England's standards directory, the NCSC, GOV.UK and UK Parliament on 13 November 2026. It is general information, not legal or audit advice, and no audit firm or vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What changed for 2026-27, and the dates that matter
The toolkit's release notes record version 9 as released on 1 September 2026. The assertions and evidence items followed on 2 October 2026 as spreadsheets for IT suppliers (Category 2), smaller organisations such as dentists and pharmacies (Category 3) and GPs (Category 4). That news item gives 30 June 2027 as the deadline, and the 2026-27 audit guides for IT suppliers are valid until then.
Three changes matter most to software suppliers:
- A products and services section. For each product, the toolkit now asks about security controls, vulnerability management, access controls, incident handling and the Digital Technology Assessment Criteria (DTAC), with version details. The detailed questions arrived on 9 October and appear by default for IT suppliers.
- A different audit scope. The 12 mandated audit assertions for IT suppliers changed almost completely from 2025-26 (see the comparison table below).
- New software requirements. Mandatory evidence items 9.5.11 and 4.5.6 ask whether software you provide to health and care follows the Software Security Code of Practice and supports identity federation or multi-factor authentication (MFA).
On the CAF side, version 9 added a mandatory extended detection and response (XDR) policy in September and, in October, a step confirming compliance with the mandatory post-quantum cryptography (PQC) policy, shown on outcome B3.b. Expect trusts to ask suppliers more about encryption plans and endpoint telemetry.
| Date | What happens | Status |
|---|---|---|
| 1 September 2026 | Version 9 released; products and services question and mandatory XDR policy added | Done |
| 1 October 2026 | 12 mandatory audit areas for IT suppliers published | Done |
| 2 October 2026 | Version 9 assertions and evidence items published as spreadsheets | Done |
| 9 October 2026 | Detailed products and services questions and PQC compliance step added | Done |
| 13 October 2026 | Version 9 webinar for IT suppliers; slides on the toolkit | Done |
| 10 November 2026 | First webinar in the monthly IT supplier series | Done |
| 8 December 2026 to 11 May 2027 | Monthly supplier webinars: 8 December, 12 January, 9 February, 9 March, 13 April, 11 May | Scheduled |
| 8 June 2027 | Last scheduled IT supplier webinar | Scheduled |
| 30 June 2027 | Deadline for the 2026-27 DSPT | Confirmed |
Supplier webinars run on Tuesdays from 12.30 to 13.15; the 13 October deck is on the slides page.
CAF-aligned or not: which DSPT an IT supplier completes
Commentary often calls this cycle's DSPT CAF-aligned. That is true for NHS trusts, integrated care boards, commissioning support units and arm's length bodies, which moved to a CAF interface in 2024-25, and for operators of essential services and genomics organisations, which followed in 2025-26.
IT suppliers did not move. When version 7 launched in August 2024, the release notes said other organisations would keep the existing interface and its list of prescriptive controls, with NHS England mapping their answers to a CAF profile nationally. The 2026-27 audit list for suppliers still uses numbered assertions from 1.1 to 10.2 under the National Data Guardian's standards.
So your evidence is mapped to CAF behind the scenes while your customers answer CAF outcomes directly. A trust's supply chain outcome, A4.a, expects it to understand and manage the risks that come from depending on external suppliers. When a trust asks for CAF-style answers, translate your existing evidence into its outcome language rather than starting a second assessment.
For most suppliers the obligation is not optional. NHS England's standards directory lists the DSPT as information standard DAPB0086, published under section 250 of the Health and Social Care Act 2012 and the NHS Standard Contract. It applies to organisations with access to NHS patients or their information, those providing support services directly to NHS organisations, and those with direct or indirect access to national informatics services. Bodies that fail to submit a return may face enforcement action, which may include fines. NHS England's 2024-25 audit page added that the Standard Contract and the DSPT require IT suppliers to complete an independent audit every year, and the 13 October 2026 supplier webinar said the audit is required to reach Standards Met.
One scoping point saves effort: the same webinar said the DSPT covers health and care data only, so areas of your business that never touch it need not be included.
Health IT suppliers that also run managed services should watch a separate regime. The Cyber Security and Resilience (Network and Information Systems) Bill, which amends the NIS Regulations 2018, passed its Lords stages on 2 November 2026 and is listed for Commons consideration of Lords amendments on 24 November 2026; it is not yet law. Our explainer on the Cyber Security and Resilience Bill for MSPs and data centres covers who it would reach.
The 12 mandatory audit areas for IT suppliers in 2026-27
The table summarises each assertion and the evidence items the version 9 Category 2 spreadsheet marks as mandatory under it. NHS England's 2026-27 supplier assurance framework sets out how an auditor tests each item.
| Ref | What the assertion covers | Mandatory evidence items (v9, Category 2) |
|---|---|---|
| 1.1 | Lawful, fair and transparent processing | ICO registration number; asset and processing register and asset classification, both approved since 1 July 2026; published privacy information; named DPO, SIRO, Caldicott Guardian, head of IT and cyber security lead; consent review |
| 2.2 | Staff contracts | Every employment contract includes data security duties beyond confidentiality, such as following IT security policies |
| 3.1 | Training and awareness | Training needs analysis covering all roles, endorsed and resourced by senior leadership; proof staff complete it; how you evaluate it |
| 3.2 | Engagement and culture | Evidence that the board or senior leaders prioritise information governance and cyber security |
| 4.1 | Record of staff and roles | Who can reach personal and confidential data through each system, including systems without individual logins |
| 6.2 | Anti-virus and email | Anti-malware on all internet-capable computers, updated and scanning on access; malicious websites blocked; SPF, DKIM and DMARC; spam and malware filtering with inbound DMARC enforced |
| 7.1 | Incident response | A map of the services you provide and their dependencies, reviewed in the last 12 months; business continuity plans for a data security incident |
| 8.1 | Asset survey | Software asset list with versions and configuration; list of end-user devices and removable media |
| 8.2 | Unsupported systems | Unsupported software listed by business risk with a remediation plan per item; SIRO confirmation that the risk is managed, reported to the board in the last 12 months |
| 9.2 | Penetration test | Annual test since 1 July 2026, scoped by the SIRO, the business and the testers, including a vulnerability scan and a default-password check on network components; SIRO review of results with an action plan |
| 9.6 | Firewalls | Boundary firewalls; admin interface off the internet or protected by MFA or address limits; default deny inbound; every inbound rule justified and approved; regular reviews; host firewalls on laptops and desktops |
| 10.2 | Supplier due diligence | Suppliers whose systems could affect care or process identifiable data hold suitable certification; a record of which security duties stay with you when services are outsourced |
The joint scoping of the penetration test, the vulnerability scan and password check, and SIRO reporting of unsupported software to the board all sit in NHS England's version 9 evidence items and the framework's audit steps, so expect auditors to test them. Watch the date conditions too: a penetration test from before 1 July 2026 does not count for this year.
Three areas take weeks, not days: the penetration test (scoping, testing, fixes and usually a retest), the 8.1 and 8.2 inventory (build servers, container images and libraries as well as laptops) and supplier due diligence (writing to your own cloud, email and support vendors and filing the replies).
Software suppliers should test the product NHS customers use, not only the office network. Unsupported components inside the product, such as an end-of-life runtime or database, belong in the 8.2 register. Two common platforms leave support during this DSPT year: Windows Server 2016 after 12 January 2027 and Ubuntu 22.04 standard support in May 2027. Our guides to Windows Server 2016 end of support and Ubuntu 22.04 end of standard support cover the upgrade options.
How the scope rotates: 2024-25, 2025-26 and 2026-27
NHS England publishes a fresh supplier audit list each autumn. Comparing the last three, the 2026-27 list largely returns to the 2024-25 scope and drops almost all of 2025-26.
| Assertion area | 2024-25 audit scope | 2025-26 audit scope | 2026-27 audit scope |
|---|---|---|---|
| Lawfulness, governance | 1.1 | 1.3 | 1.1 |
| Staff contracts | 2.2 | None | 2.2 |
| Training and culture | 3.1, 3.2 | None | 3.1, 3.2 |
| Staff records, identity and access | 4.5 (passwords) | 4.2, 4.4 (identity, privileged access) | 4.1 (staff and roles) |
| Process reviews | 5.1 | None | None |
| Breach reporting, anti-virus, vulnerability alerts | 6.2 | 6.1, 6.3 | 6.2 |
| Incident response and continuity | 7.1 | 7.2, 7.3 | 7.1 |
| Supported and unsupported systems | 8.2 | 8.3, 8.4 (patching, vulnerabilities) | 8.1, 8.2 |
| Technical protection | 9.2, 9.5, 9.6 | 9.3, 9.6 | 9.2, 9.6 |
| Supplier management | 10.2 | 10.1 | 10.2 |
| Assertions audited | 13 | 12 | 12 |
By our count, 10 of this year's 12 assertions were also in the 2024-25 scope, while only 9.6 appears in 2025-26 as well. If you kept your 2024-25 audit evidence, start there. If your first audited year was 2025-26, your pack covered patching, privileged access and continuity testing, which you still self-assess but which the auditor does not sample this time.
What software suppliers must evidence beyond the audit
The audit samples 12 assertions; the self-assessment covers every mandatory evidence item, which by our count is 102 items for IT suppliers in the version 9 spreadsheet. Five areas now shape a software supplier's submission.
Products and services. For each product you supply to health or care organisations, the toolkit asks whether it has documented security controls aligned with NHS England's supplier charter, a vulnerability process that includes telling customers about updates, role-based access with suitable authentication, an incident process that notifies customers promptly, and a completed DTAC. You must answer before you publish.
The Software Security Code of Practice. Version 8 added this DSIT code for software vendors to IT supplier requirements. In version 9 it is mandatory evidence item 9.5.11, and the tooltip suggests an assessment against the code's principles using the NCSC template. The code, first published on 7 May 2025, is voluntary on its own terms and has 14 principles in four themes. Quick checks include principles 3.2 (publish a vulnerability disclosure process), 3.5 (provide timely security updates) and 4.2 (give at least a year's notice before support ends).
Product MFA. Item 4.5.6 asks that software provided to health and care supports identity federation or industry-standard MFA, or that you have an approved, resourced plan to get there by 30 June 2027. Federation with services such as NHS Care Identity Service, NHSmail or Entra ID is preferred.
DTAC. NHS England introduced an updated DTAC form on 24 February 2026, with 25% fewer questions and duplication with the DSPT removed, and said the previous form should not be used from 6 April 2026. Its guidance says products with access to NHS systems or patient data also need a completed DSPT. A DTAC pack without a current DSPT publication will stall.
Certification exemptions. IT suppliers can claim ISO 27001 equivalence through the organisation profile, and a Cyber Essentials Plus certificate must have been issued within the previous 12 months. For 2026-27, NHS England lists Cyber Essentials Plus exemptions for items 6.2.1, 6.2.3 to 6.2.5, 8.1.1, 9.2.1, 9.2.3 and 9.6.1 to 9.6.6, and ISO 27001 exemptions for 2.2.1, 3.1.1, 6.2.1, 7.1.2, 7.1.3, 9.6.1, 10.2.3 and 10.2.4. Exempt items need no further audit once the certificate's scope is confirmed to cover all the health and care data you process. A certificate scoped to head office does not cover a cloud tenant holding patient data. See our Cyber Essentials Danzell guide for the 2026 scheme changes and our Cyber Essentials, ISO 27001 and SOC 2 comparison for what buyers ask for.
Audit mechanics: who audits and what happens on 30 June
NHS England keeps no list of approved auditors. The auditor must be able to act independently, which can include your own internal audit function, and must follow the DSPT audit guidance; a purchasing framework exists but is optional. The 1 October news item says supplier audit guidance will follow, but the toolkit's guides page already carries the 2026-27 supplier framework, guide, summary and report template. The framework, dated 26 September 2026, gives the control objective and audit steps for each Category 2 evidence item.
The auditor uploads details to the toolkit, which completes evidence item 9.4.5. If the audit is not final by 30 June, the supplier webinar said to upload a draft and update it later. Do not plan on that: 9.4.5 also expects the results to reach your board.
Statuses, improvement plans and what NHS buyers see
A published assessment ends as Standards Met, Standards Exceeded, Approaching Standards or Standards Not Met, and anyone can look up an organisation's latest status in the toolkit's organisation search. For IT suppliers, Standards Exceeded means Standards Met plus a Cyber Essentials Plus certificate from the 12 months before publication.
Under the 2025-26 instructions, an organisation that missed requirements published Standards Not Met with an improvement plan; an approved plan moved it to Approaching Standards, and finishing every action to Standards Met. Plans were not agreed where completion dates were missing or went beyond June 2027 without agreed exceptional circumstances. Unlike trusts, IT suppliers did not need to contact NHS England before the deadline about a shortfall. NHS England had not published 2026-27 instructions by 13 November 2026, so check before relying on the same rules.
Because buyers can see your status, plan to publish Standards Met.
Worked example: a 40-person health-tech SaaS supplier
Take a UK company with 40 staff selling a cloud referral-management app to three NHS trusts. It hosts patient-identifiable data in a public cloud, uses managed email and was first audited in 2025-26. It has 229 days to 30 June 2027. Working back:
| Window | Days from 13 November 2026 | Work |
|---|---|---|
| By 8 December 2026 | 25 | Gap analysis against the v9 Category 2 spreadsheet and the 12 audit assertions; attend the 8 December supplier webinar |
| By 12 January 2027 | 60 | 8.1 inventory complete, including container images and runtime versions; 8.2 register drafted; asset register approved by the SIRO; auditor booked |
| 12 January to 9 March 2027 | 60 to 116 | Penetration test of the product and corporate edge scoped with the SIRO, run, fixed and retested (9.2); firewall rule review (9.6) |
| By 13 April 2027 | 151 | Supplier due diligence returned (10.2); contracts, training and access records refreshed (2.2, 3.1, 3.2, 4.1); Code of Practice self-assessment (9.5.11) |
| By 11 May 2027 | 179 | Service map and continuity plans reviewed (7.1); products and services section completed for each product version; SIRO report on unsupported software to the board |
| 18 May to 8 June 2027 | 186 to 207 | Independent audit fieldwork, final report uploaded, results to the board (9.4.5) |
| By 23 June 2027 | 222 | Publish, leaving a week of buffer before 30 June |
The penetration test window runs 56 days, or 8 weeks, and the auditor needs the report before fieldwork. A supplier starting on 1 March has 121 days and no slack for a failed retest. This supplier's 2025-26 audit pack covers only 9.6, so it needs fresh evidence in 11 areas.
Decision table: what to do based on where you start
| If you are | Then | Why |
|---|---|---|
| A new supplier with no DSPT publication | Register now; complete the full Category 2 self-assessment and arrange an audit | DTAC reviewers and buyers look for a current publication |
| Audited in 2024-25 but not 2025-26 | Refresh your 2024-25 evidence for 10 of the 12 areas | The 2026-27 scope largely repeats 2024-25 |
| Audited only in 2025-26 | Plan new evidence for 11 areas; only 9.6 repeats | The audited scope changed almost completely |
| Holding Cyber Essentials Plus or ISO 27001 | Confirm the certificate covers all health and care data before claiming exemptions | Exemptions apply only when scope covers that data |
| Selling a product with an end-of-life component | Add it to the 8.2 register with a dated remediation plan and SIRO sign-off | Unsupported software is audited this year |
| Selling a product without MFA or federation | Ship it, or get an approved, resourced plan dated no later than 30 June 2027 | Item 4.5.6 is mandatory |
| Unlikely to meet every requirement by June | Prepare an improvement plan with dated actions | Approaching Standards beats Standards Not Met; undated plans were not agreed in 2025-26 |
Implementation checklist
- Download the v9 Category 2 spreadsheet and give every mandatory evidence item an owner.
- Confirm which parts of the business handle health and care data, and scope the assessment to them.
- Book an independent auditor who will follow the 2026-27 supplier framework, with fieldwork in May.
- Scope the penetration test with the SIRO, the business and the testers, covering the product and the corporate edge.
- Build the 8.1 inventory from endpoint management, cloud asset lists, container registries and dependency manifests.
- Record vendor support end dates and flag anything unsupported before 30 June 2027.
- Attach a business reason and approval to every inbound firewall and security group rule.
- Check SPF, DKIM and DMARC on every sending domain; export endpoint protection coverage.
- Assess each product against the Software Security Code of Practice and the MFA requirement.
- Complete the products and services section for each product version, then publish by the third week of June.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can prepare the evidence your auditor samples, from software inventories and unsupported component registers to firewall rule reviews, penetration test scoping and Code of Practice self-assessments, while your independent auditor and NHS England decide the outcome. Talk to us at /contact-us/.
Last updated: 13 November 2026.
