DSPT v8 (2025/26): The Complete Change Log and What Small Providers Need to Do Differently
DSPT version 8 was the 2025/26 edition of the Data Security and Protection Toolkit. That cycle closed on 30 June 2026, and version 9 (2026-27) is now the toolkit to complete. This page records what actually changed between version 7 (2024-25) and version 8, using NHS England's own downloadable workbooks, and which of those changes carry into version 9.
The short version for care homes, pharmacies, dental practices, opticians and GP practices: the assertions did not change, the toolkit kept its ten-standard structure, and a handful of evidence items were added, removed or made mandatory. Two of those matter most: the administrator agreement (4.3.1) and the digital asset register (7.1.1).
When v8 was released and the timeline that matters
NHS England's announcement, "Outcomes, Assertions and Evidence items for the Data Security and Protection Toolkit 2025-26 version 8 (18 September 2025)", is at dsptoolkit.nhs.uk/News/161, and it links to the downloadable workbook for Categories 2, 3 and 4.
| Date | Event |
|---|---|
| 1 Sep 2025 | DSPT version 8 (2025-26) released |
| 18 Sep 2025 | Version 8 assertions and evidence items published |
| 30 Jun 2026 | Version 8 submission deadline |
| 1 Sep 2026 | DSPT version 9 (2026-27) released |
| 2 Oct 2026 | Version 9 outcomes, assertions and evidence items published |
| 30 Jun 2027 | Version 9 submission deadline |
The deadline itself is annual. NHS England's guidance asks every organisation to publish "at least one assessment by the deadline of 30 June every year".
The headline: the assertions did not change
NHS England's version 8 workbook for Categories 2, 3 and 4 has an "Assertions" sheet with a column headed "Change v7 to v8". All 36 assertions are marked "None", and their wording is identical to version 7. They are still numbered 1.1 to 10.3 in National Data Guardian standard order, starting with 1.1, "The organisation has a framework in place to support Lawfulness, Fairness and Transparency".
The workbook's evidence-item sheet has no column for a CAF principle or objective. NHS England's current guidance describes the same structure: "The DSPT is organised under the 10 data security standards. Under each standard there are a number of 'Assertions' which you will need to work through."
NHS England's release notes describe the version 8 change for these organisations in one line: "For NHS Organisations, IT Suppliers, Category 3 and Category 4 evidence item minor amendments to update wording." So a Category 3 or Category 4 provider who completed version 7 opened version 8 to the same standards, the same assertions and mostly the same evidence items.
Where the Cyber Assessment Framework fits
The NCSC Cyber Assessment Framework (CAF) does sit behind the DSPT, but not in the way it is often described. NHS England's v8 announcement says "DSPT Version 8 is aligned to CAF version 3.4". That alignment is at framework level, and it did not start with version 8.
NHS England's page on the change says: "In September 2024 the DSPT changed to adopt the National Cyber Security Centre’s Cyber Assessment Framework (CAF) as its basis for cyber security and IG assurance." That was version 7. The same page sets out who sees what. NHS Trusts, OES, CSUs, ALBs, ICBs and Genomics organisations see "a different interface when they log in, which sets out CAF-aligned requirements in terms of Objectives, Principles and Outcomes." Everyone else "will retain the current interface and will continue to respond to a list of prescriptive controls, which will be mapped nationally ‘in the background’ against a CAF profile."
The v8 announcement follows that split. It offers the "Assertions and Evidence items" workbook to IT suppliers, dentists, GPs, local authorities, opticians, pharmacies, social care, universities and others, and the CAF-style outcome and indicators-of-good-practice spreadsheet only to NHS Trusts, ALBs, CSUs, OES, Genomics organisations and ICBs.
Two details are worth knowing if you read about the CAF elsewhere:
- NHS England's CAF has five objectives, not four. The NCSC describes its CAF as "4 high-level objectives and the 14 principles", lettered A to D. NHS England's health and care version adds an objective E. Its CAF FAQ explains that "objective E was added to ensure appropriate outcomes were included to cover ‘Using and sharing information appropriately’."
- The CAF view is still for the large organisations. NHS England's 2026-27 organisation-type guidance says "Category 1 organisations will view a Cyber Assessment Framework (CAF) aligned view of the DSPT requirements". For dentists, opticians, pharmacies, social care and other Category 3 organisations it says: "DSP Toolkit view is based on the Category 3 evidence items." For more on this, see our guide to what CAF alignment means for Category 3.
What changed in the evidence items
The changes that did happen were at evidence-item level. Comparing the version 7 and version 8 workbooks row by row gives the following.
Category 3 (care homes, pharmacies, dentists, opticians and others)
| Change | Items | What they ask |
|---|---|---|
| New in v8 (not mandatory) | 7.1.5, 7.1.6, 8.3.8 | An asset register that "prioritises assets according to their organisational importance"; assets "owned and managed throughout their lifecycle"; registration for the NCSC Early Warning service |
| Made mandatory in v8 | 4.3.1, 7.1.1 | The administrator agreement; the digital asset register |
| Removed in v8 | 4.3.3, 6.3.5, 9.3.8, 10.2.5 | Notifying staff that system use could be monitored; repeat incidents; a register of connected medical devices; suppliers' DSPT or equivalent |
| Reworded in v8 | 1.1.5, 1.3.1, 7.1.1, 7.3.6, 8.3.5, 8.4.3 | Senior responsibility; policies; asset register; offline backups; software updates; vulnerabilities |
That takes Category 3 from 77 evidence items (43 mandatory) in version 7 to 76 items (45 mandatory) in version 8. NHS England's own change log in the workbook also lists 1.3.9 as a new Category 3 item, but the requirements sheet has no version 8 item 1.3.9 for Category 3; it marks 1.3.9 "Removed".
Category 4 (GP practices)
Version 8 added seven items to the GP list: 7.1.1, 7.1.5, 7.1.6, 8.1.4, 8.2.1, 8.3.8 and 8.4.3. Of these, only 7.1.1 (the digital asset register) is mandatory. It removed 4.3.3 (staff notified about monitoring), which had been mandatory, and 9.3.8 (connected medical devices). Category 4 went from 40 items to 45, with 29 mandatory in both versions.
The two changes that matter most
The administrator agreement (4.3.1). The item reads: "Have all the administrators of your organisation's IT system(s) signed an agreement to hold them accountable to higher standards?" It was already in version 7, with the same wording. Version 8 made it mandatory for Category 3; NHS England's change log records "Evidence item made mandatory for category 3 - 4.3.1". For GP practices (Category 4) it was already mandatory in version 7. If you are a Category 3 provider who last looked at this item before 2025, it is easy to have missed. Our DSPT access controls guide covers how to evidence it.
The digital asset register (7.1.1). In version 8 the item became: "Do you have a digital asset register detailing your organisation's hardware and software, which is kept up to date?" It is mandatory for both Category 3 and Category 4. For Category 3 it replaced a version 7 item about understanding the health and care services you provide, which was not mandatory. For GP practices it was a new item. A spreadsheet of devices and software, with an owner and a review date, is a reasonable starting point.
The other new items (7.1.5, 7.1.6, 8.3.8) are optional. They are worth doing if your asset register is already in good shape, but they do not affect whether you reach Standards Met.
What did not change
- The deadline is 30 June, every year.
- The ten National Data Guardian standards are still the structure. Assertions sit under each standard, and evidence items sit under each assertion.
- Standards Met still means the mandatory items. NHS England's guidance is to complete "all the questions within the assessment which are indicated as being MANDATORY". For Category 3 that is 45 items in the version 8 workbook.
- The portal address is unchanged. dsptoolkit.nhs.uk remains the single point of submission.
What carried into version 9 (2026-27)
Version 9 was released on 1 September 2026, and its workbook was published on 2 October 2026 with a deadline of 30 June 2027. Against version 8, NHS England's version 9 workbook shows:
- The same mandatory items. Category 3 still has 45 mandatory items and Category 4 still has 29, and they are the same items as in version 8. 4.3.1 and 7.1.1 remain mandatory for both.
- Four new items, none mandatory: 1.3.15, 7.1.7, 10.2.6 and 10.2.7, for both Category 3 and Category 4. That brings Category 3 to 80 items and Category 4 to 49.
- The same 36 assertions, with the same wording.
- A newer CAF reference for the large organisations. NHS England's version 9 page says "DSPT Version 9 is aligned to CAF version 4.0". The Category 3 and 4 assessments are still built from evidence items, as above.
The assertion and evidence-item workbook for version 9 is linked from dsptoolkit.nhs.uk/News/169. For a walk-through, see what changed in version 9.
What to do now
If you completed version 8, most of your evidence is still the right evidence for version 9. The practical list:
- Download the version 9 workbook from dsptoolkit.nhs.uk/News/169 and filter it to your category.
- Check 4.3.1. Make sure every IT administrator, including your IT supplier's, has signed an accountability agreement.
- Check 7.1.1. Make sure your digital asset register lists your hardware and software and has been kept up to date.
- Look at the four new version 9 items and decide which apply to you. None is mandatory.
- Run staff training again before you publish. Annual data security awareness training is free at e-Learning for Healthcare, and completion records are among the easiest evidence to gather.
For first-time providers, the how to complete the DSPT guide walks through the full process step by step. For a Category 3 worked example, see the DSPT for care homes guide.
FAQ
When was DSPT v8 released? NHS England's release notes record that "The 2025-26 (version 8) standard has been released" on 1 September 2025, and the assertions and evidence items were published on 18 September 2025. The deadline for that cycle was 30 June 2026. Version 8 has since been replaced: the 2026-27 (version 9) DSPT was released on 1 September 2026, with a deadline of 30 June 2027.
Is DSPT v8 still the version to complete? No. Version 8 covered the 2025/26 cycle, which closed on 30 June 2026. For 2026-27 you complete version 9. For Category 3 and Category 4 the mandatory items are the same in both versions (45 and 29), so most of what you prepared for v8 still applies.
Did v8 restructure the DSPT around the Cyber Assessment Framework? Not for Category 3 and 4 organisations. NHS England's v8 workbook lists the same 36 assertions as v7, each marked "None" in its "Change v7 to v8" column, still numbered 1.1 to 10.3 under the ten National Data Guardian standards. NHS England says "DSPT Version 8 is aligned to CAF version 3.4", but that alignment is at framework level: organisations outside the large-NHS group "will continue to respond to a list of prescriptive controls", mapped to the CAF in the background.
Is the workload bigger in v8 than v7? Slightly, for Category 3. NHS England's workbooks give 77 Category 3 evidence items with 43 mandatory in v7, and 76 items with 45 mandatory in v8: the administrator agreement (4.3.1) and the digital asset register (7.1.1) became mandatory. Category 4 went from 40 to 45 items, with 29 mandatory in both.
Next steps
- Read the Cyber Assessment Framework guide for what the CAF is and who works with it directly.
- Read the DSPT complete guide for the full overview tailored to small providers.
- Use the evidence checklist generator to build a structured list for your category.
- Take the readiness quiz to identify your biggest gaps.
- Check the deadline calculator and plan your milestones.
- Sort out the administrator agreement with the DSPT access controls guide, and record risks with the DSPT risk assessment guide.
This guide is based on NHS England's DSPT workbooks for version 7 (2024-25), version 8 (2025/26) and version 9 (2026-27), and on NHS England's published DSPT guidance. Always verify current requirements on the official DSPT portal. This is not legal or compliance advice.
Sources
- DSPT 2025-26 version 8 announcement — NHS England
- Version 8 (2025-26) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
- Version 7 (2024-25) assertions and evidence items (spreadsheet) — NHS England
- DSPT 2026-27 version 9 announcement — NHS England
- Version 9 (2026-27) assertions and evidence items for Categories 2, 3 and 4 (spreadsheet) — NHS England
- Changes to the DSPT for large NHS organisations — NHS England
- CAF-aligned DSPT FAQ (2024-25) — NHS England
- Organisation types — NHS England
- DSPT overview guidance — NHS England
- DSPT system changes and release notes — NHS England
- Cyber Assessment Framework — NCSC
- Data Security Awareness e-Learning — NHS e-Learning for Healthcare