Your DSPT assessment
starts with Microsoft 365.
Work in the NHS, or supply it? For the 2026/27 cycle, Version 9 assesses NHS trusts, ICBs and CSUs against the Cyber Assessment Framework, now aligned to CAF version 4.0, with a final publication deadline of 30 June 2027. Whatever you publish becomes a live claim. InquilionDSPT provides independent assessment of the Microsoft 365 estate that carries much of that evidence, so the claim is proven rather than self-attested and your people are not marking their own homework.
The deadline is
30 June 2027.
01Why now?
The Data Security and Protection Toolkit used to be a form. For the 2026/27 cycle, Version 9 assesses the larger and higher-risk NHS organisation categories against the National Cyber Security Centre's Cyber Assessment Framework, version 4.0: an outcomes-based, evidence-heavy model. The question is no longer whether a box is ticked. It is whether an outcome is achieved, and whether you can prove it.
02The workload
That changes the workload. Evidence has to be gathered, kept current and organised across five objectives, and for most organisations a large share of it is configuration: identity, access, data protection, audit and information governance, concentrated in Microsoft 365.
03The risk
A self-assessment signed off inside the organisation is a claim. Under an outcomes-based framework, an unsupported claim is exactly what an audit, an incident review or a commissioner will test.
A business‑as‑usual assessment, not a last‑minute sprint.
04Start now
So start now, and make it business as usual. Evidence that builds month by month, kept current and owned by named people, stands up to an assessor. Evidence assembled in a rush as 30 June 2027 closes in does not, and a rush is when gaps are found with no time left to fix them.
You and your suppliers.
When a supplier fails, your care stops. Your DSPT posture is not only your own estate. NHS care runs through suppliers you do not control and cannot see. Over 11,000 appointments delayed. Services not restored until December. Linked to a patient's death.
Ransomware hit Synnovis, a pathology supplier to London NHS trusts. The risk lived in a supplier's environment. It stopped NHS care. That is the class of risk the DSPT exists to surface before an incident, not after. Synnovis · June 2024 · NHS England / BBC
Government guidance names the cause: low visibility and control at the right levels, inadequate oversight. The Government provides the guidance on this, and InquilionDSPT fits right in: independent assurance.
That assurance targets the Microsoft 365 layer behind a DSPT assertion. Read-only. No operations touched. It does not certify clinical systems: anything outside the estate is reported as outside assessment scope, not passed.
Marking your own homework
is not assurance.
Self-assessment is a claim.
Standards Met, self-attested by the team that operates the controls, proves commitment. It does not prove the outcome. Independent assessment does.
The NHS has said so.
NHS England's Strengthening Assurance programme formally recognises DSPT independent assessment providers and expects independent assessment for higher-risk organisation categories. Read the NHS's own Strengthening Assurance guidance.
The CAF makes the gap visible.
An outcomes-based framework exposes the distance between what is claimed and what is evidenced. That distance is now a governance risk owned at board level.
Independence is the point.
InquilionDSPT assesses. It does not operate or remediate what it assesses. That separation is what makes the assurance invaluable.
Independently assessed across all five CAF objectives.
The assessment targets the Microsoft 365 and Azure estate, organised the way the CAF-aligned DSPT is organised, so every piece of evidence lands where an assessor, a commissioner or an auditor expects to find it. The toolkit covers more than Microsoft 365: anything outside the estate is reported as outside assessment scope rather than passed.
Governance, ownership and decision-making, evidenced in the estate: named accountability for the tenant, privileged access under control, decisions recorded and auditable. An organisation chart is not an outcome.
Identity, access and data security as actually configured in Microsoft Entra ID and Microsoft 365: the controls claimed, tested against the controls that exist.
Monitoring coverage and the ability to notice, evidenced from audit logging, alerting and Defender configuration: what is watched, what is logged and what would actually be seen if something went wrong.
Response, recovery and resilience posture in the tenant: the configuration that determines how far an incident spreads and how quickly the estate comes back. Exercised plans, not filed ones.
The DSPT-specific objective: transparency, records management and lawful, well-governed sharing of patient data, evidenced from Microsoft Purview and sharing configuration.
What an engagement delivers.
The Microsoft 365 evidence layer for DSPT compliance
- Where every engagement begins
- A structured gap assessment of your Microsoft 365 estate against the CAF-aligned DSPT for your organisation category, for the 2026/27 cycle.
- Evidence, not folders
- A read-only, organised evidence base across sixteen governance domains, mapped to the five CAF objectives and their expected achievement levels.
- Independent validation
- An independent assessment of the Microsoft 365 evidence behind your submission before you publish. What cannot be assessed in the estate is reported as outside scope, never waved through.
- A board-ready readout
- A clear statement of where you stand, what would not survive scrutiny and what to fix first.
- Continuity
- Optional continuous assurance through the year, so next June is a publication, not a project.
- How it is transacted
- InquilionDSPT is not on NHS procurement frameworks. Engagements are delivered with an accredited delivery partner, typically your existing managed service provider, so procurement runs through a route you already have.
Your team keeps its day job.
Your board gets evidence it did not have to mark itself.
If you are a managed service provider with NHS clients, see outsource DSPT assurance for MSPs. If you supply the NHS through a procurement framework, see DSPT for NHS suppliers.
Common questions.
Standards Met is the published status an organisation reaches when its Data Security and Protection Toolkit assessment meets the expected level for its organisation category. For the 2026/27 cycle, larger and higher-risk NHS categories are assessed against the Cyber Assessment Framework, so Standards Met means the CAF outcomes are achieved and evidenced, not that a checklist is complete.
DSPT 2026/27 (version 9) is live and the final publication deadline is 30 June 2027. Evidence gathering across five CAF objectives takes months rather than weeks, and an unsupported Standards Met is exactly what an audit, an incident review or a commissioner will test, so the practical time to start is now: make it business as usual, not a sprint as the date closes in.
It is a review of your DSPT self-assessment and its supporting evidence by an assessor outside your organisation. NHS England's Strengthening Assurance programme formally recognises DSPT independent assessment providers, and InquilionDSPT acts as one for the Microsoft 365 estate: we independently validate the evidence behind what you intend to publish, before you publish it.
Not universally. For the 2026/27 cycle NHS England expects independent assessment for higher-risk organisation categories under its Strengthening Assurance programme, and recommends it more widely. Even where it is not required, it is the difference between claiming an outcome and proving it.
The Cyber Assessment Framework (CAF) is the National Cyber Security Centre's outcomes-based model for assessing cyber resilience. The DSPT now uses a CAF-aligned approach for larger NHS organisations, structured around five objectives: managing risk, protecting against cyber attack, detecting cyber security events, minimising the impact of incidents, and using and sharing information appropriately.
No. The assessment targets the Microsoft 365 and Azure estate, where most of the toolkit's technical evidence lives for most organisations. DSPT areas outside that estate are reported as outside assessment scope rather than passed, for your team or delivery partner to cover. That honesty is what makes the rest of the evidence credible.
Know where you stand, independently assessed.
Tell us where you are in the 2026/27 cycle. We respond within one working day, and delivery is routed through an accredited partner so procurement is not the hard part.
REQUEST INFO