DSPT vs ISO 27001: what NHS suppliers actually need
If your organisation has access to NHS patient data or systems, you need to complete the Data Security and Protection Toolkit (DSPT). That's the NHS requirement, and ISO 27001 doesn't replace it. ISO 27001 is optional from the NHS's point of view, but many NHS suppliers choose it, because it's the management system that produces the policies, risk decisions and evidence the DSPT, the DTAC and every trust questionnaire ask about.
So the short answer to "DSPT vs ISO 27001" is: not "versus", but "and". The DSPT is the assessment the NHS asks for. ISO 27001 is a way of running security that makes that assessment, and everything around it, easier to answer honestly. This guide explains what each one is, where they overlap, and what to do first.
This guide is general information as of October 2026. The DSPT and the DTAC change between versions, so always check the current requirements on the NHS England sites linked below.
What the DSPT is
The DSPT is an online self-assessment run by NHS England. In its own words, all organisations that have access to NHS patient data and systems must use it. You answer a set of assertions and provide evidence, and NHS England publishes your status so that the organisations you work with can check it.
A few points that matter for suppliers:
- It's based on the National Data Guardian's 10 data security standards. These cover things like staff responsibilities, training, access to data, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection and accountable suppliers.
- It's annual. You complete a new assessment for each toolkit version, by the deadline NHS England sets. Treat it as a yearly cycle, not a one-off.
- What you complete depends on your organisation type. NHS England has been moving larger NHS bodies, such as trusts and integrated care boards, to a version aligned with the NCSC's Cyber Assessment Framework (CAF). Many suppliers and smaller providers have stayed on the standard, category-based version. When you register, the toolkit tells you which assessment applies to you.
- It's evidence-based. Ticking "yes" isn't enough; you're expected to be able to show how you meet each assertion.
Standards Met, Standards Exceeded and the rest
Your published DSPT status is what an NHS buyer looks at first. The terms you'll see are:
| Status | What it broadly means |
|---|---|
| Standards Met | You've met the mandatory requirements for that year's toolkit. This is the target. |
| Standards Exceeded | You've met the standards and also hold additional independent assurance recorded in the toolkit. Check the current toolkit for exactly which certification counts in your version. |
| Approaching Standards | You didn't meet every requirement, but NHS England has approved an improvement plan. Your status moves to Standards Met once you've completed the plan's actions. |
| Standards Not Met | You haven't met the requirements and there's no approved improvement plan. |
In practice, most NHS buyers want to see Standards Met or better before they sign or renew. "Standards Exceeded" is a useful extra signal, but it isn't something you can get from a certificate alone: you still have to meet the standards first.
What ISO 27001 is
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). It isn't NHS-specific, and it isn't a self-assessment. You build and run a management system covering your scope, risks, policies, controls, internal audit and management review, then an independent certification body audits it in two stages. In the UK, buyers usually look for a certification body accredited by UKAS. Certification then has annual surveillance audits and a recertification audit every three years.
Where the DSPT asks "do you do these things?", ISO 27001 asks "do you have a system that decides what you need to do, makes sure it happens, and improves when it doesn't?". That difference is why the two fit together.
DSPT vs ISO 27001 side by side
| DSPT | ISO 27001 | |
|---|---|---|
| Who asks for it | The NHS, for anyone with access to NHS patient data or systems | Enterprise and public-sector buyers in any sector, including the NHS |
| Is it mandatory? | Yes, for organisations in scope of the toolkit | No, it's voluntary, though contracts may require it |
| Who assesses it | You self-assess; some organisation types also need an independent audit | An independent, accredited certification body |
| What it covers | The National Data Guardian's 10 standards (or CAF outcomes, for some organisations) | Your whole ISMS: clauses 4 to 10, plus a decision on each of the 93 Annex A controls |
| Scope | Set by the toolkit for your organisation type | Set by you, and stated on the certificate |
| How often | Every year | Surveillance audits each year; recertification every three years |
| What you get | A published status (for example, Standards Met) | A certificate with a defined scope |
| Recognised outside health? | Rarely | Widely, in the UK and internationally |
Does ISO 27001 replace the DSPT?
No. Holding an ISO 27001 certificate doesn't exempt you from the DSPT, and it doesn't automatically give you Standards Met. You still complete the toolkit and provide the evidence.
What ISO 27001 does is make that evidence exist. Look at where the two overlap:
| DSPT topic | Where it sits in ISO 27001:2022 |
|---|---|
| Information governance and responsibilities | Clause 5.3 (roles), Annex A 5.2 (information security roles) |
| Policies | Clause 5.2 (information security policy), Annex A 5.1 (policies) |
| Staff training and awareness | Clause 7.2 (competence), 7.3 (awareness), Annex A 6.3 (awareness, education and training) |
| Managing access to data | Annex A 5.15 to 5.18 (access control, identity, authentication, access rights) |
| Incidents and breaches | Annex A 5.24 to 5.28 (incident management) |
| Continuity | Annex A 5.29, 5.30 (security during disruption, ICT readiness), 8.13 (backup) |
| Unsupported systems and patching | Annex A 8.8 (technical vulnerabilities) |
| Suppliers | Annex A 5.19 to 5.22 (supplier relationships) |
| Legal requirements and personal data | Annex A 5.31 (legal requirements), 5.34 (privacy and protection of PII) |
If you run an ISMS properly, most of what the DSPT asks for is already a policy, a record or a task with an owner. Completing the toolkit becomes a case of pointing at evidence that exists, rather than writing it the week before the deadline. That's the real benefit: less riding on one person's memory, and answers that stay the same from one buyer to the next.
The overlap isn't total. The DSPT has health-specific expectations, such as data protection training, NHS information governance roles and how you handle patient data, that ISO 27001 won't phrase the same way. Read each assertion and map it, rather than assuming your certificate covers it.
Where the DTAC fits
If you sell digital health technology (software used to deliver or support care), you'll also meet the Digital Technology Assessment Criteria (DTAC). NHS organisations use your completed DTAC form during procurement to check your product meets baseline standards. It covers five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility.
Two of those areas overlap heavily with security work:
- Data protection expects things like a DSPT assessment and a data protection impact assessment (DPIA) where you process personal data.
- Technical security asks about things like Cyber Essentials, penetration testing and how you build and run the product securely.
NHS England introduced an updated DTAC form in 2026 with fewer questions, partly to cut duplication with the DSPT. As with the DSPT, check the current form before you start. The point for this guide is simple: the DTAC assumes you already have your data protection and security house in order. An ISMS is where that house lives.
Trust, ICB and practice questionnaires
On top of the DSPT and the DTAC, individual trusts, integrated care boards and GP practices often send their own supplier security questionnaires, especially at renewal. They ask the same things in different words: who's responsible, when you last reviewed access, how you'd handle a breach, which suppliers touch the data. If your answers come from one set of approved records, they agree with each other and with your DSPT. See our guide to customer security questionnaires.
So what do NHS suppliers actually need?
Here's a sensible order for most small and mid-sized suppliers:
- Complete the DSPT and reach Standards Met. If you have access to NHS patient data or systems, this isn't optional, and it's the first thing buyers check.
- Get Cyber Essentials if you haven't already. It's commonly expected by NHS and other public-sector buyers, and it shows up in the DTAC technical security section. See Cyber Essentials vs ISO 27001.
- Complete the DTAC if you sell digital health technology.
- Build an ISO 27001 ISMS when the contracts get bigger, when you sell outside health as well, or when you're tired of answering the same questions from scratch. You can run the ISMS before you go for certification; the records it produces help with steps 1 to 3 straight away.
Do you need ISO 27001 to sell to the NHS? Usually not on its own terms, although some contracts and frameworks ask for it. Does it help? Yes: it's the management system that keeps your DSPT evidence current, makes the DTAC and trust questionnaires quicker, and gives you something recognised by buyers outside health too.
A worked example
Example Ltd is fictional, and only shows how the pieces fit. Imagine Example Ltd is a 20-person software company whose appointment booking tool a few NHS physiotherapy services want to use. It would complete the DSPT because the tool would handle NHS patient data, fill in the DTAC because the tool is digital health technology, and answer each service's own questionnaire. If its access reviews, incident log, supplier checks and training records already lived in an ISMS, all three would draw on the same evidence.
How ClearIMS helps
ClearIMS helps you build and run an ISO 27001 ISMS, so the policies, risks and evidence behind your DSPT, DTAC and questionnaire answers already exist and stay current. You describe your business in plain English and it drafts your first scope, risks, policies, Statement of Applicability and tasks. It works like a virtual ISMS manager, emailing owners about outstanding and overdue actions, and its AI drafts customer security questionnaire answers from your approved records, with sources. Everything stays a draft until a named person approves it; the AI never approves anything. ClearIMS doesn't complete or submit your DSPT for you. Read more about ClearIMS for NHS suppliers.
We make the software. Your certification is yours, awarded by your certification body.
Take the 2-minute readiness check, or book a 20-minute call.