DSPT Standard 8 After Windows 10 Support

Standard 8 of the DSPT is the one most small providers misread, and the misreading has become expensive since Windows 10 support ended.

NHS England publishes Standard 8 in two wordings, and it is worth knowing both before you judge how hard the bar is.

Its guide-8 chapter page (last edited 8 October 2025) states it as: "No unsupported operating systems, software or internet browsers are used within the IT estate." Its assessment-guides index page (last edited 8 April 2026, so the newer of the two) states the same standard as: "No unsupported operating systems, software or internet browsers should be used within the IT estate."

One reads as a flat statement of the required end state; the other as an expectation. We are not going to pick whichever suits the argument — NHS England has published both, and you should know that if someone quotes one at you. Either way the target is none, and what you are actually assessed on is the assertions below.

What people miss is the layer underneath. NHS England's own assessment guide for Standard 8 says there is "a clear recognition that not all unsupported systems can be upgraded, and that financial and other constraints should drive intelligent discussion around priorities" — "it's about demonstrating that analysis has been done and informed decisions were made."

That is what you are assessed on. The assertion you actually answer is: "Unsupported software and hardware is categorised and documented, and data security risks are identified and managed."

So both things are true at once, and you need to hold both. The standard's target is none. The evidence you submit is that you know what you have, have recorded it, and are managing the risk of anything you have not removed yet. A documented, risk-assessed, isolated machine with a replacement date is a defensible position against a target you have not met. An undocumented one is not — even if it is the only one in the building.

That distinction is the whole of this guide, and it matters more now than it did two years ago.

What changed on 14 October 2025

Microsoft's own guidance describes the position for anyone who kept running Windows 10: organisations that "elect to continue using Windows 10 after support ends on October 14, 2025, will have the option of enrolling their PCs into a paid ESU subscription."

From that date, Microsoft states it no longer provides:

• Technical support
• Feature updates or new features
• "Quality updates (including security and reliability fixes)"

That third one is what makes this a DSPT matter rather than an IT preference. A machine that stops receiving security fixes is, in Standard 8 terms, unsupported software — and if it is on your network holding or reaching patient data, it belongs in your documentation.

Extended Security Updates: a bridge, not a fix

The paid programme buys time. Microsoft's terms for organisations are specific:

• Enrolled commercial or educational PCs "can receive security updates for a maximum of three years after end of support for Windows 10"
• Pricing starts at "$61 USD per device for Year One" through volume licensing, and "The price doubles every consecutive year, for a maximum of three years"
• "Year One starts in November 2025"
• It must be bought whole years at a time: "Customers can't buy partial periods… If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative"
• Devices must be on Windows 10 version 22H2 to be eligible
• ESU excludes new features, "customer-requested nonsecurity updates" and design changes — and "No, technical support isn't included in the ESU program"

For the DSPT this is genuinely useful nuance. A device on ESU is still receiving critical and important security updates, which is a meaningfully different risk position from one receiving nothing. Record that difference. But note the shape of the deal: doubling annual cost, cumulative purchase, hard three-year ceiling. It is a runway, and it is priced to make you use it for migration rather than for delay.

What else in a small provider is quietly unsupported

Windows is the obvious one. In practice the items that surprise people are the others:

• The old PC in the office nobody logs into but which still runs the rota software. Usually the worst offender, because nobody owns it.
• A care planning or practice management system on a version the supplier no longer patches. Ask the supplier directly, in writing, and keep the reply — it doubles as Standard 10 evidence. Our supplier assurance guide covers what to ask for.
• The router or firewall the broadband provider installed years ago. Consumer-grade network hardware has short support lives and is rarely on anyone's inventory.
• A networked printer or multifunction device with a scan-to-email function. These hold documents and credentials and are almost never patched.
• Phones and tablets past their vendor's update window. Particularly relevant to domiciliary care, where devices leave the building — see our domiciliary care guide.
• A server or NAS holding backups. The thing you would rely on in an incident is worth knowing the support status of.

The document Standard 8 actually wants

Half a page is enough for most small providers. The failure mode is having nothing, not having something short.

For every device and system, record:

Field	Why it is there
What it is	Device or software name and version
Still supported?	Yes / No / On extended support, with the date support ended or ends
What data it touches	Whether it holds or reaches patient data
Why it is still in use	The honest reason — cost, a dependency, a supplier who has not released a replacement
Compensating controls	Network isolation, no email or web browsing on it, restricted accounts, removable-media controls
Replacement plan and date	A real date, even if it is eighteen months out
Review date	When you will look at this again

The compensating-controls row is the one that turns a liability into a managed risk. An unsupported machine that has been taken off the internet, given no email client, restricted to one function and one account, and has a replacement date is a different proposition from the same machine sitting on the main network with a shared login.

Standard 8 connects to your risk register in practice: the risk you document here should appear on it with an owner and a review date, and may be one of the top three risks you give for item 1.3.6. Our risk assessment guide covers that side, and the evidence requirements guide places Standard 8 among the other nine.

A sequence that works

1. Walk the building and list everything. Every PC, laptop, tablet, phone, server, NAS, router, firewall, printer. Include the ones nobody uses — those are the risk.
2. Establish support status for each. Vendor pages for hardware; a written question to your software suppliers. Keep the replies.
3. Mark what touches patient data. Not everything does, and the ones that do not are a lower priority.
4. Write the compensating controls you already have, then the ones you should add. Most small providers find they can isolate one legacy machine in an afternoon.
5. Set replacement dates and put them in a budget. This is the item that cannot be fixed in the last fortnight before a deadline, which is why it belongs in autumn planning — see our guide to the 2026/27 cycle.
6. Date the document and set a review date. An undated inventory is an assertion nobody can check, including you.

Use the evidence checklist generator to see Standard 8 alongside the rest of your submission, and the readiness quiz to find out whether this is genuinely one of your weak standards or whether something else deserves the afternoon more.

This guide is based on NHS England's published statement of Standard 8 and its Standard 8 assessment guide, the DSPT Standard 8 assertion wording and Microsoft's published Windows 10 Extended Security Updates guidance, verified on 2 September 2026 — before this post's own October 2026 publish date, so check the sources for anything announced in between. ESU pricing is quoted by Microsoft in US dollars through volume licensing; confirm current pricing and terms with Microsoft or your licensing reseller. Always verify current requirements on the official DSPT portal. This is not legal, compliance or IT procurement advice.

Sources

• DSPT assessment guide 8: Unsupported systems — NHS England (last edited 8 October 2025)
• DSPT assessment guides index — NHS England (last edited 8 April 2026; states Standard 8 as "should be used")
• DSPT assertion wording (Standard 8.2) — NHS England
• Extended Security Updates (ESU) program for Windows 10 — Microsoft
• DSPT overview — NHS England
• Device security guidance — NCSC