DSPT Evidence Requirements: A Category-by-Category Breakdown

The DSPT portal tells you which assertions you need to complete, but it doesn't always make clear what evidence will actually satisfy each one. "Provide evidence of appropriate technical controls" is vague when you're a care home manager staring at the screen wondering whether a screenshot of Windows Defender counts.

This guide breaks down the evidence requirements by category and standard — what types of evidence are accepted, what "good" evidence looks like versus "just-enough" evidence, and where most small providers get stuck.

How evidence works in the DSPT

NHS England's guidance describes the structure: "The DSPT is organised under the 10 data security standards. Under each standard there are a number of 'Assertions' which you will need to work through. To complete each assertion, you are required to provide evidence items which demonstrate compliance with the assertion."

• Standards — the ten National Data Guardian data security standards
• Assertions — statements under each standard (e.g., 1.1: "The organisation has a framework in place to support Lawfulness, Fairness and Transparency")
• Evidence items — the questions you answer and the documents you upload (e.g., 7.1.1: "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?")

That structure has been stable. NHS England's version 8 workbook marks all 36 assertions as unchanged from version 7, and version 9 (2026-27) keeps the same 36; what changes each year is the evidence items. Our DSPT v8 changes explained guide sets out those changes.

Evidence items vary in what they ask for. Some only ask whether something exists: 1.1.1 asks for your ICO registration number. Others ask whether a control is working: 3.2.1 asks whether at least 95% of staff, directors, trustees and volunteers have "completed training on data security and protection, and cyber security, in the last twelve months". Where an item asks about a policy or process, the strongest answer shows the document and that it is in use.

Category 1 organisations see a different, CAF-aligned format. Our Cyber Assessment Framework explained guide covers where the CAF fits for Category 3 and 4 providers.

Evidence volume by category

Category	Total evidence items	Mandatory items	Independent audit?
1 (NHS trusts, ICBs and other large NHS bodies, plus OES independent providers and Genomics organisations)	Assessed on CAF outcomes rather than this evidence-item list — 49 outcomes in version 9	n/a	Yes
2 (Large suppliers)	~120	~100	Yes
3 (Care homes, pharmacies, dentists)	80 (76 in v8)	45	No
4 (GP practices)	49 (45 in v8)	29	No

The Category 3 and 4 figures are counted from NHS England's version 9 (2026-27) workbook, with version 8 (2025/26) totals in brackets; the mandatory counts are the same in both years. Category 4 is the smaller set — 29 mandatory items against 45 for Category 3 — and most of its items are worded exactly as they are for Category 3. Category 1 is assessed differently: NHS England states that "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements", and its 2026-27 CAF-aligned workbook sets out 49 outcomes with indicators of good practice, so there is no Category 1 evidence-item count to compare. Category 2 (large suppliers) uses the evidence-item format with a larger set than Category 3. Both categories require an independent audit — Category 1 covers NHS trusts and other large NHS bodies, plus independent providers designated as Operators of Essential Services (OES) and Genomics organisations; Category 2 covers large suppliers. Our guide to DSPT audit requirements sets out exactly which organisations NHS England mandates an audit for.

If you're a care home, pharmacy, or dental practice, you're Category 3. If you're a GP practice, you're Category 4. The rest of this guide focuses on these two categories.

Evidence by standard: what you actually need

Standard 1: Personal confidential data

What they want to know: Is personal data handled, stored and transmitted securely, and only shared for lawful and appropriate purposes? That is the National Data Guardian's wording for Standard 1; limiting access to the people who need it is Standard 4.

Evidence required:

• Information asset register and record of processing activities (item 1.1.2) — the systems and record sets that hold patient/resident data, what each holds, how it is kept safe and who it is shared with
• Data protection and cyber security policies (item 1.3.1) — customised to your organisation and up to date: NHS England's tooltip says policies "should be updated every three years as a minimum"; an annual review is good practice
• Named senior responsibility (item 1.1.5) — the person or people with overall responsibility for data security and protection, and how that responsibility was formally assigned
• ICO registration number and privacy notice (items 1.1.1 and 1.1.3)

What good evidence looks like: A register listing each system or record set, the data it holds, where it is kept, who it is shared with, and the date it was last reviewed. NHS England's tooltip for 1.1.2 says "The register should have been reviewed and approved by the management team at least once in the last twelve months." Alongside it, a dated policy with a review schedule that names your actual systems and procedures.

What weak evidence looks like: A policy downloaded from the internet with your organisation's name pasted in, no review date, and nothing about which systems you actually use.

Standard 2: Staff responsibilities

What they want to know: Do staff understand their data security responsibilities? The Standard 2 assertions are that "Staff are supported in understanding their obligations under the National Data Guardian's Data Security Standards" and that "Staff contracts set out responsibilities for data security".

Evidence required:

• Induction (item 2.1.1) — an induction process that "covers data security and protection, and cyber security", with records that new starters completed it
• Contract clauses (item 2.2.1) — employment contracts and volunteer agreements that "contain data security requirements". NHS England's tooltip says "Clauses in contracts or agreements should reference data security (confidentiality, integrity and availability). Many contracts commonly focus on just confidentiality."

What good evidence looks like: An induction checklist with a data security section, signed and dated by each new starter, plus your contract template showing a clause that covers confidentiality, integrity and availability. Asking staff to read and acknowledge the data security policy at induction is good practice and fits here.

What weak evidence looks like: A contract clause that mentions confidentiality only, and no record of what new starters were told about data security.

Go deeper: how to write a DSPT data security policy walks through what NHS England expects in the policy itself, section by section.

Standard 3: Training

What they want to know: Have at least 95% of staff, directors, trustees and volunteers completed data security training in the last twelve months (item 3.2.1)?

Evidence required:

• Training Needs Analysis (TNA) — reviewed or approved annually by the person with overall responsibility for data security, showing what training each role needs
• Training completion records — certificates, attendance registers, or completion logs for every staff member
• Optional: training evaluation — a short note on whether training worked (quiz results, assessment scores). NHS England's evaluation guidance is written for Category one organisations; it is not a Category 3 or 4 evidence item, but it supports your TNA

What good evidence looks like: A TNA table listing each role and the training required, signed by the registered manager or practice manager. A training log spreadsheet showing every staff member's name, role, training completed, date, and certificate reference. Optionally, a short evaluation statement noting completion rates and any follow-up actions.

What weak evidence looks like: A list of staff names with "completed" next to each one but no certificates, dates, or evidence of what was completed.

Common gap: Agency and locum staff. Your training records need to cover everyone who accesses patient data, including temporary staff.

Go deeper: our DSPT staff training records guide covers what a training record needs to show now that the assessment is built around a training needs analysis.

Standard 4: Managing data access

What they want to know: Are access controls properly managed throughout the employment lifecycle?

Evidence required:

• Access control register — who has access to which systems, at what level
• Joiner/leaver process — documented procedure for granting and revoking access
• Regular access reviews — evidence that access is reviewed periodically (at least annually)
• Administrator agreements — a list of everyone with admin-level access, each with a signed agreement holding them to higher standards (item 4.3.1, mandatory for Category 3 since v8 and already mandatory for Category 4)

What good evidence looks like: A spreadsheet listing every staff member, the systems they access, their access level, when access was granted, and the last review date. A separate column for "date access removed" for leavers. Screenshots of system admin panels showing disabled leaver accounts.

Common gap: Administrator agreements, because 4.3.1 only became mandatory for Category 3 in v8. List every account with admin or superuser access across all systems — PMR, care planning software, NHSmail admin, router/firewall management.

Go deeper: the DSPT access controls guide has a worked admin account register you can copy.

Standard 5: Process reviews

What they want to know: Have you reviewed the process behind any data or cyber security breach or near miss in the last year? Item 5.1.1, mandatory for Category 3 and 4, asks: "If your organisation has had a data or a cyber security breach or near miss in the last year, has the organisation reviewed the process that may have allowed the breach to occur?" If there were none, NHS England's tooltip says to tick and write "Not applicable".

Evidence required:

• A short record of each post-incident review: what happened, which process allowed it, and what you changed
• If there were no breaches or near misses, a note saying so ("Not applicable" in the toolkit)
• Optional: an annual review of your data processes. The tooltip says "It is good practice to review processes annually even if a breach or near miss has not taken place."

Policy review dates belong to Standard 1 (item 1.3.1; item 1.3.2 covers checking compliance with your policies), not Standard 5.

What good evidence looks like: A one-page note for each breach or near miss: date, what happened, the process that allowed it, what you changed and who signed it off. Keep your policy review schedule too, under Standard 1.

Go deeper: our DSPT risk assessment guide covers documenting the risks those reviews are meant to catch.

Standard 6: Responding to incidents

What they want to know: Can you detect and respond to data security incidents?

Evidence required:

• Incident response procedure — step-by-step process for reporting and handling data breaches
• Staff awareness — evidence that staff know how to report incidents (covered in Standard 3 training)
• Incident log — a record of incidents reported and actions taken

What good evidence looks like: A procedure document covering: what counts as a data incident, who to report to, initial response steps, ICO notification thresholds (within 72 hours for notifiable breaches), and post-incident review process. An incident log — even if empty — with column headers for date, description, reporter, actions taken, and resolution.

What if you've had zero incidents? That's fine. An empty incident log with the procedure attached proves you have a working system. The DSPT doesn't penalise you for having no incidents — it penalises you for having no process to detect them.

Go deeper: the DSPT incident response guide covers the reporting routes and the ICO threshold in more detail.

Standard 7: Continuity planning

What they want to know: What happens if your systems fail or you suffer a cyber attack?

Evidence required:

• Business continuity plan (BCP) covering IT failure, cyber attack, and data loss scenarios
• Plan review and test evidence — proof that the plan is "regularly reviewed and tested" (item 7.1.2, mandatory for Category 3 and 4). For Category 3, item 7.2.1 also asks how you test it and what the outcome was, and NHS England's tooltip says "This should be in the last twelve months."

What good evidence looks like: A 2-4 page BCP covering:

• PMR/clinical system failure — manual backup procedures, paper-based alternatives
• NHSmail outage — alternative communication methods
• Ransomware/cyber attack — who to contact (IT provider, Action Fraud 0300 123 2040), isolation steps
• Data loss — backup locations, recovery process
• Reviewed date and next review date

A plan that's been "tested" can mean a tabletop exercise: walk through the scenarios with your team, document what you'd do, note any gaps, and fix them. Record the date, participants, and outcomes.

Go deeper: our DSPT business continuity guide has a Standard 7 plan outline sized for a single-site provider.

Standard 8: Unsupported systems

What they want to know: Are all devices running supported software? NHS England states the standard as "No unsupported operating systems, software or internet browsers are used within the IT estate" — while its assessment guide for Standard 8 recognises that "not all unsupported systems can be upgraded" and asks you to demonstrate "that analysis has been done and informed decisions were made."

Evidence required:

• IT asset register — every device (computer, tablet, phone) used by staff, with make, model, OS version, and key software
• Confirmation that no unsupported operating systems or software are in use — and, for anything unsupported that remains, a risk assessment showing it is categorised, documented, and its data security risks identified and managed (assertion 8.2)

What good evidence looks like: A spreadsheet listing every device: location (reception, dispensary, office), device type, make/model, OS version (e.g., Windows 11 23H2), key software installed, and support status. Where a device is running an unsupported OS (Windows 7, Windows 8, or any other end-of-life build), a documented risk assessment for that device with compensating controls and a replacement date — the analysis and the decision, not a bare claim either way.

Common gap: Old devices in back offices or nurse stations that nobody remembers. Walk the building and check every screen. If your IT provider manages your devices, ask them to generate this list — most remote management tools can do it automatically.

Standard 9: IT protection

What they want to know: Are technical security controls in place and working?

Evidence to gather (the toolkit numbers several of these under other standards, but one IT letter can cover them all):

• Encryption — confirmation that laptops, tablets and removable devices holding patient data are encrypted (item 9.5.2)
• Network-device passwords — confirmation that router and other network-device passwords have been changed from the originals (item 9.1.1)
• Firewall — confirmation that a firewall is active and configured (item 9.6.1: not mandatory for Category 3, and not a Category 4 item)
• Patching — evidence that operating systems and software are kept up to date (Standard 8: item 8.3.5 for Category 3, 8.3.1 for Category 4)
• Anti-malware — antivirus or anti-malware installed and updated (Standard 6: item 6.2.1)
• Multi-factor authentication (MFA) — for remote access to systems holding patient data (Standard 4: item 4.5.3, mandatory for Category 3 and 4)

What good evidence looks like: If you have a managed IT provider: a single assurance letter from them confirming all of these controls are in place. This is the most efficient approach — one document covering the lot.

If you manage IT yourself: screenshots of Windows Security (Defender status), Windows Update (last update date), BitLocker (encryption status), and your router admin page (firewall enabled).

Standard 10: Accountable suppliers

What they want to know: Do your IT suppliers meet data security standards?

Evidence required:

• Data processing agreements (DPAs) — contracts with suppliers handling patient data
• Supplier assurance — evidence that suppliers meet data security standards (their own DSPT completion, ISO 27001, or similar)

What good evidence looks like: Emails or letters from each key supplier confirming: (a) their DSPT completion status or equivalent certification, and (b) a copy of or reference to your data processing agreement. Keep these organised by supplier.

Key suppliers for small providers:

• PMR system / care planning software provider
• Managed IT provider
• Any cloud storage or backup service
• Delivery management software (pharmacies)
• Clinical system provider (GP practices)

Go deeper: the DSPT supplier assurance guide covers what to ask each supplier for and what a data processing agreement needs to say.

Category 3 vs Category 4: key differences

Most evidence requirements are shared between Categories 3 and 4. In NHS England's version 9 workbook, every Category 4 item is also a Category 3 item except two:

• 6.3.5 — "Have you had any repeat data security incidents within the organisation during the past twelve months?"
• 8.3.1 — "How do you make sure that the latest software updates are downloaded and installed promptly?" (mandatory for Category 4)

The other difference is size: Category 4 has 49 items, 29 of them mandatory, against Category 3's 80 and 45, and four shared items (1.3.6, 4.1.1, 4.5.3 and 7.3.4) are worded differently for Category 4. The workbook has no separate Category 4 items on NHS Spine, smartcards or clinical-system access, though your evidence for the shared access-control items will naturally come from your clinical system.

If you're a GP practice, check the version 9 workbook for Category 4 specifically. Our DSPT for GP practices guide covers the Category 4 evidence items and where a practice's evidence usually comes from.

Dental practices are Category 3, but the evidence hangs off different systems again — our DSPT for dental practices guide covers the practice-management-software and NHSmail items.

Getting your evidence ready

Rather than working through the DSPT standard by standard, group your evidence preparation by type:

1. Policies first — review, update, and date-stamp all data-related policies. One session, multiple standards covered.
2. Training records next — the most time-consuming evidence to gather. Start early.
3. IT technical evidence — one request to your IT provider covers Standards 8 and 9, and parts of 4, 6 and 7.
4. Access records — document who has access to what. Standard 4.
5. Supplier evidence — email requests to 3-4 key suppliers. Standard 10.

For a complete, categorised checklist of every evidence item for your category, use the evidence checklist generator.

Next steps

• Generate your full evidence checklist by category
• Check the deadline calculator for your submission timeline
• Take the readiness quiz to see which standards need the most work
• Read the complete DSPT guide for a full overview
• Follow the step-by-step completion guide when you're ready to start

This guide reflects DSPT version 9 (2026-27), the current toolkit. Category 3 and 4 counts are taken from NHS England's version 8 and version 9 workbooks; the Category 1 outcome count is from NHS England's version 9 CAF-aligned workbook; Category 2 counts are approximate. Counts may vary by organisation sub-type. Always verify current requirements on the official DSPT portal and download the version 9 workbook for your category. This is not legal or compliance advice.

Sources

• Data Security and Protection Toolkit — NHS England
• DSPT 2025-26 version 8 — NHS England
• DSPT 2026-27 version 9 outcomes, assertions and evidence items — NHS England
• Version 9 (2026-27) CAF-aligned outcomes and indicators of good practice (spreadsheet) — NHS England
• DSPT organisation types and categories — NHS England
• National Data Guardian data security standards — GOV.UK
• Cyber Assessment Framework — NCSC