Health and care organisations in England assess their cyber security and information governance each year through the Data Security and Protection Toolkit (DSPT). From September 2024 the toolkit for NHS trusts, integrated care boards, commissioning support units, and arm’s-length bodies aligns with the National Cyber Security Centre’s Cyber Assessment Framework (CAF)—a shift referenced in NHS England Digital’s introduction to the CAF-aligned DSPT. Suppliers of transport management software, e-procurement platforms, and patient booking systems frequently need DSPT “Standards Met” status to exchange data with the NHS; understanding the new model is now central to market access.
Why the DSPT changed
The move fulfils a commitment in the Department of Health and Social Care cyber security strategy to 2030. Instead of a long checklist of prescriptive controls, large NHS organisations now work through objectives, principles, and outcomes—47 contributing outcomes spanning risk management, protective measures, detection, incident minimisation, and appropriate information use. Smaller organisation types retain a familiar interface while mapping to CAF profiles in the background.
NHS England and DHSC stress that the DSPT never covered every legal obligation; it samples practices that demonstrate good cyber hygiene and personal data handling. The CAF alignment raises the bar for self-assessment quality: organisations must judge whether people, process, and technology choices genuinely increase resilience, not merely tick boxes.
How the assurance cycle works in practice
The first CAF-aligned year (2024–25) required large NHS bodies to publish an interim baseline assessment by 31 December 2024 and a full publication by 30 June 2025, with improvement plans where expected achievement levels were not met. NHS England Digital’s interim assessment guidance explains that the December publication is a snapshot of progress—not a forecast of the June position—and that only confirmation of completion is shared publicly.
For 2025–26, the DSPT toolkit published version 8 outcomes and evidence items in September 2025, aligned to CAF version 3.4, with a full publication deadline of 30 June 2026. Organisations completing a CAF-aligned DSPT were reminded to publish an interim assessment by 31 December 2025. IT suppliers, local authorities, and other organisation types continue to use category-specific spreadsheets published on the DSPT portal.
What transport technology vendors should expect
Patient transport platforms process identifiable journey data, location information, and sometimes clinical referral details—making them in scope for NHS customers’ supplier assurance. Contracts often require annual DSPT submission, incident reporting within defined hours, and encryption standards for data in transit and at rest. The CAF framing pushes conversations from “do you have antivirus?” to “how do you detect and contain compromise without disrupting urgent bookings?”
Commissioners evaluating digital marketplaces for NEPTS or mental health transport should map vendor assertions to Objective B (protecting against attack), Objective C (detecting events), and Objective D (minimising incident impact). A booking outage during winter pressure is both a cyber and a patient-safety incident; recovery time objectives belong in bid responses.
Governance roles and evidence
Senior Information Risk Owners must approve submissions, including self-assessed achievement levels and improvement plans. Evidence packs grow more narrative under CAF, with indicators of good practice published in spreadsheet form for trusts and separate packs for local authorities, social care, and IT suppliers. Organisations should scope essential functions—explicitly including patient transport booking if hosted internally—before assessing outcomes.
Regional Security Leads and DHSC oversight of improvement plans mean that “Approaching Standards” is a managed state, not a permanent waiver. Partners watching a provider’s status should ask for plan milestones tied to booking platform upgrades, penetration test remediation, and identity access reviews for dispatch staff.
Incident response and booking continuity
Objective D in the CAF-aligned toolkit expects tested response and recovery planning. For transport platforms, tabletop exercises should include loss of mobile data, ransomware on dispatch workstations, and failure of telephony integrations used for NEPTS booking lines. Customers increasingly ask for recovery time estimates in procurement questionnaires separate from generic hosting SLAs.
Relationship to NHS transport programmes
NEPTS data collections and digital transport marketplaces depend on trusted data exchange between ICBs, ambulance trusts, and independent providers. DSPT alignment coincides with those operational reforms: the same boards scrutinising timeliness metrics also scrutinise whether cloud-hosted transport systems meet CAF outcomes. ISO 27001 and Cyber Essentials remain complementary badges many suppliers hold, but NHS contractual gates increasingly reference DSPT assertions directly.
Local authorities outside the CAF-large-org interface still complete DSPT categories relevant to social care and education transport data, so school transport teams may encounter DSPT questions when sharing pupil records with contracted platforms. Multi-tenant SaaS vendors should be ready to explain data segregation, penetration test scope, and how customer administrators are provisioned and deprovisioned when staff leave a council transport team.
Practical steps for suppliers each year
Complete DSPT categories applicable to your organisation type early enough to remediate findings before customers’ June publication gates. Map essential functions to hosting locations, privileged access for support staff, and subcontractor processors such as SMS gateways used for passenger notifications. Document how backup and restore are tested without using live patient itineraries, and align improvement-plan updates if a prior year’s status was “Approaching Standards” or “Standards Not Met.”
Conclusion
The CAF-aligned DSPT reset assurance for NHS cyber and information governance in terms of outcomes rather than controls lists. Transport technology suppliers should treat annual June publication deadlines and improvement-plan monitoring as commercial facts—not IT trivia—especially where 24/7 mental health or NEPTS bookings underpin clinical pathways. Customers benefit when vendors articulate how dispatch, mobile apps, and integration APIs support detection, response, and safe sharing under the rolling CAF-aligned programme.
