DSPT compliance
The AbedGraham Group works exclusively with IT suppliers and technology providers. We do not provide DSPT services to NHS organisations themselves.
We provide two distinct services:
- Independent DSPT audits (as a third-party assessor), and
- DSPT audit readiness and preparation services, supporting suppliers before formal audit.
All services are delivered directly by our specialist team.
DSPT Framework: Current Position for IT Suppliers
Current DSPT Model
IT suppliers and technology providers are currently assessed under the legacy DSPT framework, rather than the CAF-aligned model now being introduced for NHS organisations.
This means:
- Assertions and evidence requirements for suppliers differ from those placed on NHS bodies
- Expectations of DSPT audits remain evidence-driven but proportionate to supplier obligations
- The framework continues to evolve year-on-year
Looking Ahead
While CAF alignment does not currently apply to IT suppliers, it is widely expected that supplier assurance requirements will increase in future years.
Suppliers that mature their governance, security controls and evidence practices early are significantly better positioned for:
- Future DSPT changes
- Increased procurement scrutiny
- Broader UK cyber resilience expectations
Our services are designed to support current DSPT compliance while also future-proofing assurance maturity.
Our DSPT Services for IT Suppliers
Independent DSPT Audit (Third-Party Assurance)
We act as an independent third-party auditor for IT suppliers where DSPT audits are required or contractually mandated.
This service includes:
- Independent assessment of DSPT assertions and submitted evidence
- Verification that controls are implemented and operating effectively
- Structured audit interviews and walkthroughs
- Clear, defensible audit findings
- Audit reporting suitable for NHS customer and contractual scrutiny
Our audit role is independent and objective, providing confidence to NHS customers that supplier DSPT submissions are credible and trustworthy.
DSPT Audit Readiness & Preparation (Separate Service)
Many IT suppliers fail or struggle with DSPT audits not because controls are missing but because evidence is incomplete, misaligned or inconsistent.
Our DSPT Audit Readiness service helps suppliers prepare before formal audit and is delivered separately from any audit engagement.
This service includes:
- DSPT gap analysis against current supplier requirements
- Evidence mapping and validation
- Identification of high-risk assertions
- Practical remediation planning
- Governance and documentation improvement
- Mock audit interviews and evidence walkthroughs
This service is ideal for suppliers who:
- Expect a DSPT audit now or in future years
- Want to reduce audit risk and rework
- Are preparing for rising assurance expectations
Why DSPT Audit & Readiness Matters for Suppliers
Contract Enablement
DSPT outcomes directly affect access to NHS systems, platforms and contracts.
Independent Assurance
Third-party DSPT audits provide confidence to NHS customers that your submission reflects real, operational controls.
Reduced Audit Risk
Preparation reduces the likelihood of adverse findings, delays or remediation cycles.
Future Readiness
Audit-ready suppliers are better positioned for evolving DSPT and cyber resilience expectations.
Who We Work With
We support IT suppliers and technology providers, including:
- Digital health and health IT vendors
- Software and platform providers
- Cloud and hosting providers supporting NHS workloads
- Infrastructure and network technology suppliers
- Data processors handling NHS data
We do not provide DSPT services to NHS organisations.
Why Choose The AbedGraham Group?
- Independent third-party DSPT consultancy and auditor for IT suppliers
- Deep experience in healthcare technology assurance
- Clear separation between audit and readiness services
- Evidence-led, regulator-aware approach
- Trusted by suppliers operating in high-scrutiny environments
We help suppliers move beyond DSPT compliance uncertainty towards credible, defensible assurance.
Cybersecurity Expertise
vCISO (Virtual CISO) Services
Virtual CISO support providing senior cyber security leadership, governance and regulatory alignment for healthcare and life sciences organisations operating in the UK and Europe.
Incident Response (Healthcare & Life Sciences)
Specialist incident response support for cyber incidents, ransomware and data breaches, designed for regulated and safety-critical healthcare and life sciences environments.
Managed SOC / SIEM
Managed SOC and SIEM services providing continuous monitoring, threat detection and escalation for healthcare and life sciences organisations across the UK and Europe.
ISO for Cybersecurity
The best way for organisations to meet the UK and EU's cybersecurity regulations is to implement a suite of ISO standards with our expert guidance
Cybersecurity
Talk to a DSPT specialist
Whether you require a formal audit or want to ensure your organisation is audit-ready, our DSPT consultants can help you approach DSPT with clarity and confidence.
Frequently asked questions
IT and technology suppliers are required to undergo a DSPT audit where they meet the NHS audit threshold for suppliers, which is greater than or equal to 50 employees and greater than or equal to £10 million in global annual revenue, and where they process NHS data or provide services to NHS organisations.
A DSPT audit is a formal, independent assessment that verifies whether a supplier’s DSPT assertions and supporting evidence are accurate, complete, and effective.
DSPT audit readiness is a preparatory service that helps suppliers identify gaps, improve evidence quality, and address issues before or alongside a formal audit.
Yes. There is no regulatory barrier preventing the same organisation from providing DSPT audit readiness support and conducting the DSPT audit. Where both services are delivered, it is essential that audit conclusions remain objective, evidence-based, and defensible.
The duration of a DSPT audit depends on the size, complexity, and maturity of the supplier. Most audits involve structured evidence review and interviews and are typically completed over several weeks, depending on evidence quality and responsiveness.
Common findings include incomplete or inconsistent evidence, misalignment between documented policies and operational practice, limited incident response testing, and unclear ownership of security or data protection controls.
The NHS Data Security and Protection Toolkit (DSPT) is an annual, mandatory self-assessment that NHS suppliers use to demonstrate they are handling patient and personal data securely and meeting appropriate standards whether based on National Data Guardian standards or the NCSC CAF Model. For IT suppliers and technology providers, it is the framework against which NHS customers judge whether your security and data protection controls are robust enough to be trusted with NHS data, and larger suppliers also must complete an independent audit of that submission.
Suppliers preparing for NHS DSPT audits can draw on both independent audit services and structured readiness support. Our NHS toolkit audit support spans DSPT gap analysis, evidence mapping and structured recommendations, helping suppliers approach the Data Security and Protection Toolkit with confidence and reduce the risk of adverse findings.
Yes. Our DSPT consultants work solely with 3rd party vendors to the NHS including IT suppliers, medical technology providers and outsourced clinical services entities. We do not work directly with NHS organisations. We provide independent assurance auditing services, audit-readiness support and DSPT compliance consultancy tailored according to the latest NHS defined regulatory obligations for suppliers of all sizes.
Related services
vCISO for Healthcare & Life Sciences
Cybersecurity leadership is no longer optional in regulated healthcare markets. Whether you are…
Incident Response for Healthcare & Life Sciences
When a cyber incident occurs, speed and precision matter. But in healthcare and life sciences, the…
Managed SOC & SIEM for Healthcare & Life Sciences
A Managed SOC (Security Operations Centre) with SIEM (Security Information and Event Management)…