How NHS Suppliers Pass the DSP Toolkit with Minimal Overhead: A Pragmatic Technical Blueprint

For any technology provider, SaaS vendor, or clinical software supplier delivering services to NHS Trusts, Integrated Care Boards (ICBs), or NHS England, the Data Security and Protection Toolkit (DSPT) is a non-negotiable contractual prerequisite.

Too often, tech teams treat DSPT as a multi-month compliance ordeal, generating hundreds of pages of unread policies that become immediately out of date.

The reality: for modern cloud-native suppliers, most DSPT assertions can be satisfied directly with automated cloud controls, existing identity policies, and clear evidence exports.

Here is a pragmatic blueprint to achieve "Standards Met" status with minimal operational overhead.

1. Determine Your True Assertion Profile

The DSPT is not one-size-fits-all. The NHS classifies organisations into specific categories:

• Category 1: NHS Trusts, Foundation Trusts, CSUs.
• Category 2: Arm's Length Bodies, ICBs.
• Category 3: Commercial Third-Party Suppliers & Software Vendors.

As a commercial supplier, you only need to complete the assertion subset applicable to Category 3 (or the simplified SME profile if you have under 50 staff).

Pragmatic Action:

• Ensure your organisation profile in the DSPT portal is correctly registered as an IT/Digital Service Supplier rather than a healthcare provider. This automatically removes dozens of irrelevant clinical governance assertions.

2. Leverage Cyber Essentials as Your Technical Baseline

Under the National Data Guardian (NDG) standards that underpin DSPT, holding a valid Cyber Essentials certificate automatically provides the necessary evidentiary basis for multiple mandatory technical assertions:

• Firewall and boundary protection
• Secure configuration and default credential removal
• User access control and least privilege
• Malware defense and antivirus
• Patch management (applying critical updates within 14 days)

Pragmatic Action:

• If you hold Cyber Essentials, map your certificate number directly to Assertion 9.4.1. This significantly reduces redundant narrative drafting.

3. Solve Data Flow Mapping in One Afternoon

DSPT Assertion 6 mandates that you know what personal confidential data (PCD) or patient-identifiable data you handle, where it resides, and where it travels.

Avoid over-engineered GRC software. A clean, board-approved Information Asset Register (IAR) covering four areas is sufficient:

1. Primary Repositories: Production cloud database, encrypted storage buckets.
2. Transit Channels: TLS 1.3 encrypted API endpoints, NHSmail / encrypted mail.
3. Backup Regimes: Immutable backups with documented recovery time objectives (RTO).
4. Third-Party Sub-processors: Hosting providers (GCP, AWS, Azure) and transactional email services with signed UK Data Processing Agreements (DPAs).

4. Evidence Cloud Identity & MFA Enforcement

Assertion 4 covers access controls. Assessors look for concrete proof that access to systems holding health data is strictly controlled and audited.

Pragmatic Action:

• Enforce Phishing-Resistant MFA: Screenshot Conditional Access or Google Workspace policies mandating MFA across all production accounts and administrator tenants.
• Quarterly Access Reviews: Document a quarterly IAM review where inactive accounts and retired contractors are revoked.
• Zero Shared Accounts: Enforce named administrator accounts; eliminate generic admin@ or root logins.

5. Prepare Your Incident Response & Breach Notification Drill

DSPT requires organisations to report high-severity security incidents and data breaches within 72 hours (aligning with UK GDPR and the NHS Security Operations Centre).

You don't need a 50-page manual. An effective 2-page Security Incident Response Plan (SIRP) with:

• The named Incident Lead and Data Protection Officer (DPO).
• Immediate containment triage steps (credential revocation, network isolation).
• Clear reporting escalation paths to the Information Commissioner's Office (ICO) and the NHS DSPT Incident Reporting Tool.
• An annual simulated tabletop exercise recorded in your security log.

Need Support Completing Your DSPT Submission?

Sachan & Partners assists UK suppliers, healthtech startups, and public sector contractors in conducting gap assessments, assembling audit-ready evidence, and hardening cloud controls.

• Explore our Compliance & Assurance Services.
• Need urgent support ahead of an NHS procurement deadline? Book a 30-minute consultation with our team.