NHS DSPT: Penetration Testing Requirements Explained

Table of Contents

NHS DSPT requirements for 2026-27

The NHS has released a new version of the mandatory Data Security and Protection Toolkit (DSPT, version 9), and all submissions are due by 30th June 2027.

If you run IT services for an NHS trust or sell software or services to the NHS, one question comes up every year: do we need a penetration test, and what should it cover? This guide pulls together what the NHS’s guidelines actually say and what it could mean for you.

What’s new in DSPT 2026-27

CAF version 4.0. The CAF-aligned toolkit now follows CAF version 4.0, with 49 outcomes instead of 47.
Faster cyber alert responses. For CAF organisations, the deadline to respond to a high-severity NHS cyber alert drops from 14 days to 48 hours for alerts issued from 1 January 2027.
New subcategories. Category 3a (CQC Market Oversight providers) and 3b (local authorities) now carry extra CAF-related evidence requirements.

Which version of the toolkit are you on?

Your category decides which toolkit you complete and whether you need independent assurance.

Category	Who	Toolkit	Independent assurance
1	NHS trusts and foundation trusts, ICBs, ALBs, CSUs, independent health organisations designated as operators of essential services, genomics organisations nominated by DHSC	CAF-aligned (Cyber Assessment Framework)	Mandated for NHS trusts, ICBs, CSUs and ALBs
2	IT suppliers	Assertions and evidence items	Mandated
3, 3a, 3b	Opticians, pharmacists, dentists, universities and researchers, others; 3a CQC market oversight providers; 3b local authorities	Assertions and evidence items, plus a CAF assessment (3a) or a CAF for Local Government progress update (3b)	Not listed
4	GPs	Assertions and evidence items	Not listed

Where penetration testing fits in the DSPT

Category 2 IT & Software suppliers

On the National Data Guardian version of the toolkit, penetration testing sits under Standard 9 (IT protection), assertion 9.2: “A penetration test has been scoped and undertaken.” For Category 2 suppliers, both 9.2 evidence items are mandatory, and the test must have taken place since 1 July 2026.

NHS’s guidance, the DSPT assessment guide on penetration testing, lays out what a best-practice test looks like:

At least once a year.
A minimum scope. The test must cover every web server you use, include vulnerability scans, and verify that you’ve changed default passwords on network devices. NHS England also expects it to cover critical infrastructure.
Senior Information Risk Owner sign-off. The SIRO should actively participate in scoping, including approving the plan’s scope, particularly any penetration testing.
Fixes within 14 days. Remediate critical and high-risk findings within 14 days. Anything that can’t be fixed in that time needs a documented risk agreed with the SIRO, and longer-term work goes into your data security improvement plan, with suppliers uploading the remediation plan with SIRO review confirmation.

Category 1 NHS trusts and other CAF organisations

Pen testing here feeds into CAF outcome B4.d, Vulnerability management: managing known vulnerabilities so they don’t affect your essential function.

NHS guidance adds a specific data collection under B4.d. Organisations must follow the advice in every high-severity NHS cyber alert, or decide at Board level not to. They must also report what they did through the “Respond to an NHS cyber alert” service within 14 days for alerts issued between 1 July and 31 December 2026, which shortens to 48 hours for alerts issued from 1 January 2027.

NHS England expects these organisations to regularly test their systems to understand vulnerabilities and verify that understanding with third-party testing. An independent penetration test is one of the clearest ways to evidence this.

Practical rules for a pen test

Don’t scan across HSCN (the Health and Social Care Network) without speaking to the NHS first. Depending on how aggressively they’re run, some scanners can be indistinguishable from a cyber attack
Know your boundaries. Only test assets you’re responsible for, especially on shared sites or managed networks.
Warn people in advance. Tell system owners, service desks, network teams and any third-party support providers before testing starts.
Choose your tester carefully. NHS England doesn’t endorse suppliers, but it lists trust signals to look out for. Check that your pen test suppliers are CREST-accredited and are listed on the government’s Digital Marketplace. These can help you decide if a vendor is suitable

Does Cyber Essentials Plus replace a penetration test?

Not on its own. Cyber Essentials+ helps organisations guard against the most common cyber threats. A penetration test assesses whether an attacker could exploit weaknesses in your specific systems and applications.

On the DSPT supplier toolkit, Cyber Essentials+ can exempt Category 2 IT suppliers from the two 9.2 evidence items. But the DSPT isn’t the only check NHS buyers use.

DTAC: assurance for the product you sell

The Digital Technology Assessment Criteria (DTAC) is the NHS’s framework for evaluating digital healthcare products that are sold to the sector. Buyers often use it alongside DSPT, which covers five areas. These areas are clinical safety, data protection, technical security, interoperability, and usability and accessibility.

Both the DSPT and DTAC link together. For each product or service you provide to a healthcare organisation, the toolkit asks whether you have processes to identify, assess, and remediate security vulnerabilities, and whether you have completed a DTAC assessment. Cyber Essentials does not replace a pen test as your certificate, and an external penetration test of your product is a separate question.

The DSPT looks at your business, while a DTAC assessment looks more closely at the product or service. An independent pen test is one of the clearest ways to evidence technical security. To learn more, read our in-depth blog post about the DTAC assessment.

How can Sencode help?

Sencode are a CREST-accredited penetration testing company based in the UK. We regularly work with organisations of all sizes that supply products or services to the NHS. We understand what DSPT and DTAC require to meet NHS contract requirements.

To get started, use our scoping tool for a fixed-scope quote, or call us if you would like help scoping your next penetration test.

Sources: