DSPT compliance
At The AbedGraham Group we exclusively work with IT suppliers and technology providers serving the NHS. We offer two specific services:
- Independent DSPT Audits
- DSPT Preparation and Support
Each service is delivered by our experienced team of NHS security consultants.
DSPT Framework: Current Position for IT Suppliers
The DSPT Model
There are currently two versions of DSPT. NHS organisations have to follow NCSC’s CAF model while suppliers are still assessed using the legacy National Data Guardian (NDG) Standards. For suppliers this means:
- Audit requirements and assertions are based on historical standards
- Standards are subject to change from year to year to gradually align with the CAF model
Looking Ahead
We expect DSPT requirements to be altered every year creating enhanced expectations of suppliers. This means that suppliers with an active DSPT program that’s regularly reviewed by the same team of external auditors will be best placed to respond to any changes. This is particularly important as:
- NHS procurement addresses cybersecurity increasingly
- Cyber-attacks increase in healthcare
- The UK Cybersecurity and Resilience Bill is enforced
By working with our team your organisation will stay ahead of DSPT requirements and be prepared to demonstrate compliance on an ongoing basis.
Our DSPT Services for IT Suppliers
The Independent DSPT Audit
We are an independent DSPT Audit and Assurance provider supporting suppliers operating in the NHS. Every audit follows NHS England’s structured guidance including:
- Assessing all assertions and evidence
- Verifying controls are implemented
- Gathering information through interviews and workshops
- Completing reports that are defensible when subjected to NHS scrutiny
As a leading DSPT auditor we are trusted by some of the largest suppliers to the NHS to objectively validate their DSPT submissions and give their NHS customers confidence.
DSPT Support Services
For many suppliers, completing DSPT can be a daunting and confusing process. It can include multiple exemptions and is significantly different from other security frameworks such as ISO27001 and Cyber Essentials. Our Support Service ensures our clients project manage their DSPT submission effectively, correctly and in an audit ready manner. This includes:
- Conducting a DSPT gap analysis
- Reviewing evidence items
- Identifying relevant assertions
- Making remediation recommendations
- Running mock interviews and workshops
Why DSPT Audit & Readiness Matters for Suppliers
Contract Enablement
DSPT outcomes directly affect access to NHS systems, platforms and contracts.
Independent Assurance
Third-party DSPT audits provide confidence to NHS customers that your submission reflects real, operational controls.
Reduced Audit Risk
Preparation reduces the likelihood of adverse findings, delays or remediation cycles.
Future Readiness
Audit-ready suppliers are better positioned for evolving DSPT and cyber resilience expectations.
Who We Work With
We ensure IT suppliers of all categories can complete DSPT successfully including:
- Digital health suppliers
- Data processors handling NHS data
- Software as a Medical Device (SaMD) manufacturers
- AI suppliers
- Cybersecurity and Network Infrastructure vendors
Why Choose The AbedGraham Group?
- Independent third-party DSPT consultancy and auditor for IT suppliers
- Deep experience in healthcare technology assurance
- Clear separation between audit and readiness services
- Evidence-led, regulator-aware approach
- Trusted by suppliers operating in high-scrutiny environments
We help suppliers move beyond DSPT compliance uncertainty towards credible, defensible assurance.
Cybersecurity Expertise
vCISO (Virtual CISO) Services
Virtual CISO support providing senior cyber security leadership, governance and regulatory alignment for healthcare and life sciences organisations operating in the UK and Europe.
Incident Response (Healthcare & Life Sciences)
Specialist incident response support for cyber incidents, ransomware and data breaches, designed for regulated and safety-critical healthcare and life sciences environments.
Managed SOC / SIEM
Managed SOC and SIEM services providing continuous monitoring, threat detection and escalation for healthcare and life sciences organisations across the UK and Europe.
ISO for Cybersecurity
The best way for organisations to meet the UK and EU's cybersecurity regulations is to implement a suite of ISO standards with our expert guidance
Cybersecurity
Talk to a DSPT specialist
Whether you require a formal audit or want to ensure your organisation is audit-ready, our DSPT consultants can help you approach DSPT with clarity and confidence.
Frequently asked questions
Any supplier of digital goods/services to the NHS with equal to or greater than 50 employees and £10m in worldwide annual revenue.
Our DSPT audit service is an independent audit service following NHS England’s guidelines that validates the DSPT submission answers and evidence. Our DSPT Support Service is a service designed to support our clients to complete their DSPT answers in a structured and accurate way to meet the DSPT requirements so that they can be audited.
Yes, there are no regulatory barriers that prevent us from providing our project management based support service to prepare the DSPT submission followed by an audit to validate compliance. As our client you are still responsible for accurately fulfilling all DSPT requirements.
It varies with client complexity and responsiveness. It can range from 3-12 weeks depending on a client’s previous experience with DSPT and ability to provide the relevant requested evidence and documents.
Inaccurate and inconsistent documentation, especially relating to evidence, are the most typical issues our auditors encounter. In terms of thematic areas, supply chain security and incident response stand out as areas where our clients typically require and request the most support.
The NHS Data Security and Protection Toolkit (DSPT) is an annual, mandatory self-assessment that NHS suppliers use to demonstrate they are handling patient and personal data securely and meeting appropriate standards whether based on National Data Guardian standards or the NCSC CAF Model. For IT suppliers and technology providers, it is the framework against which NHS customers judge whether your security and data protection controls are robust enough to be trusted with NHS data, and larger suppliers also must complete an independent audit of that submission.
Suppliers preparing for NHS DSPT audits can draw on both independent audit services and structured readiness support. Our NHS toolkit audit support spans DSPT gap analysis, evidence mapping and structured recommendations, helping suppliers approach the Data Security and Protection Toolkit with confidence and reduce the risk of adverse findings.
Yes. Our DSPT consultants work solely with 3rd party vendors to the NHS including IT suppliers, medical technology providers and outsourced clinical services entities. We do not work directly with NHS organisations. We provide independent assurance auditing services, audit-readiness support and DSPT compliance consultancy tailored according to the latest NHS defined regulatory obligations for suppliers of all sizes.
Related services
vCISO for Healthcare & Life Sciences
Cybersecurity leadership is now a prerequisite for successfully navigating cybersecurity regulations…
Incident Response for Healthcare & Life Sciences
When a cyber incident occurs, speed and precision matter. But in healthcare and life sciences, the…
Managed SOC & SIEM for Healthcare & Life Sciences
A Managed SOC (Security Operations Centre) with SIEM (Security Information and Event Management)…