--- title: Never Published Your DSPT? What NHS IT Suppliers Miss description: 401 of the 1,160 IT suppliers on the NHS Data Security and Protection Toolkit have never published an assessment. What publishing involves, what Category 3 suppliers need, and where penetration testing fits. image: https://blog.echosecure.co.uk/hubfs/dspt-register-featured-og.png --- [Skip to content](https://blog.echosecure.co.uk/nhs-it-suppliers-never-published-dspt#main-content) [![Echo Secure AI Logo](https://blog.echosecure.co.uk/hs-fs/hubfs/Echo%20Secure%20Logo-3.png?width=1250&height=625&name=Echo%20Secure%20Logo-3.png)Homepage](https://echosecure.co.uk) - [Penetration Testing](https://echosecure.co.uk/penetration-testing) - Packages - [Phishing Packages](https://echosecure.co.uk/phishing-packages) - [Cyber Protect Packages](https://echosecure.co.uk/cyber-protect-packages) - Resources - [Portal](https://echosecure.co.uk/echo-secure-portal) - [Adversarial Phishing Simulation](https://echosecure.co.uk/adversarial-phishing-simulations) - [APS Kill-Chain](https://echosecure.co.uk/phishing-kill-chain) - [What is Phishing?](https://echosecure.co.uk/what-is-phishing) - [Training Webinars](https://echosecure.co.uk/phishing-awareness-webinars) - [Phishing Glossary](https://echosecure.co.uk/phishing-glossary) - [Compliance Benefits](https://echosecure.co.uk/compliance-benefits) - [Blog](https://blog.echosecure.co.uk) - About - [About Us](https://echosecure.co.uk/about-us) - [Why Echo Secure](https://echosecure.co.uk/why-echo-secure) - [Contact](https://echosecure.co.uk/contact-us) - [0208 7207 322](tel:+442087207322) - [Penetration Testing](https://echosecure.co.uk/penetration-testing) - Packages - [Phishing Packages](https://echosecure.co.uk/phishing-packages) - [Cyber Protect Packages](https://echosecure.co.uk/cyber-protect-packages) - Resources - [Portal](https://echosecure.co.uk/echo-secure-portal) - [Adversarial Phishing Simulation](https://echosecure.co.uk/adversarial-phishing-simulations) - [APS Kill-Chain](https://echosecure.co.uk/phishing-kill-chain) - [What is Phishing?](https://echosecure.co.uk/what-is-phishing) - [Training Webinars](https://echosecure.co.uk/phishing-awareness-webinars) - [Phishing Glossary](https://echosecure.co.uk/phishing-glossary) - [Compliance Benefits](https://echosecure.co.uk/compliance-benefits) - [Blog](https://blog.echosecure.co.uk) - About - [About Us](https://echosecure.co.uk/about-us) - [Why Echo Secure](https://echosecure.co.uk/why-echo-secure) - [Contact](https://echosecure.co.uk/contact-us) - [0208 7207 322](tel:+442087207322) [Login](https://dev.echosecure.co.uk) ![Bar chart of the 1,160 IT supplier companies on the NHS DSPT register on 12 October 2026. 566 have a current assessment at Standards Met or better, 31 are current but below Standards Met, 162 are out of date and 401 have never published an assessment.](https://blog.echosecure.co.uk/hs-fs/hubfs/dspt-register-featured-og.png?width=1200&height=630&name=dspt-register-featured-og.png) Penetration Testing NHS DTAC # Never Published Your DSPT? What NHS IT Suppliers Miss ![Kurtis Baron](https://app.hubspot.com/settings/avatar/309285c67a14ddc7b3853d8abe302b94) Kurtis Baron October 15, 2026 You have to publish your Data Security and Protection Toolkit assessment. Until you do, as far as your NHS customers can see, you haven't done it. That sounds obvious, but the toolkit's own register says a lot of suppliers miss it. ## A call that started with the wrong question On Monday I was on a call with a software supplier. One of their NHS customers had asked them for "an audit of their DSPT", and they wanted to know what that would involve. The answer was that they didn't need one. They're under the Category 2 thresholds, so they're Category 3, and the independent DSPT audit is a Category 2 requirement. They'd done the work. What they hadn't done was publish. Their page on the toolkit said "This organisation has never published an assessment." Anyone can search the toolkit, and their customer had. ## How common is it? I wanted to know whether this was a one-off, so on 12 October I went through the toolkit's public register. - 1,160 companies are registered with "IT Supplier" as their sector (counting each company once, even where it has several registrations). - 401 of them (35%) have never published an assessment. - 162 more have a latest assessment from before 2025-26, and the 2025-26 deadline was 30 June 2026. - 31 have a current assessment that's below Standards Met. - That leaves 566 (49%) with a current assessment at Standards Met or Exceeded. So more than half of the IT suppliers on the toolkit would fail a customer's check today. A third have never published anything. The register can't tell you which of those still work with the NHS, and some won't. The ones that do have customers who can see the same page I did. ## Why your customer is asking Every organisation that has access to NHS patient data and systems has to use the toolkit to publish an assessment. That includes your customers. If they're Category 3, as most smaller organisations are, their own DSPT asks them (item 10.2.1): "Does your organisation assure that your IT system suppliers have robust cyber security arrangements?" The quickest way for them to answer that is to look you up. A published assessment at Standards Met is the easiest thing for them to point at. "Never published" leaves them with nothing to point at, so they ask you for something, and "an audit" is usually the word they reach for. ## What Category 3 actually means The toolkit splits suppliers by size. You're a Supplier (Category 2) only if you have 50 or more staff, £10m or more turnover, and you supply digital goods or services to the NHS or care. Miss any one of those and you register as "Other", which is Category 3. For Category 3, using the 2026-27 evidence spreadsheet: - There are 45 mandatory evidence items. You need all of them for Standards Met. - Cyber Essentials Plus exempts three: removing leavers' access, anti-malware, and changing default passwords on network devices. It's worth having, but it saves less work than people think. - No pen test item is mandatory. The 9.2 pen testing items and the web application item are blank for Category 3. - There's no independent audit. The 45 items are mostly things a well-run small company already has: up-to-date data protection and security policies, a records retention schedule, at least 95% of staff trained in the last twelve months, a way to report breaches, an asset register, and a list of your own suppliers. The work is gathering it and pressing publish. ## Where pen testing does come in The DSPT doesn't make a Category 3 supplier pen test. DTAC does. If you sell a digital health product into the NHS and it's internet facing, DTAC C3.3 asks for the summary report of an external pen test of the product, including the OWASP Top 10, from the last 12 months. The exception is if you've signed the NHS supplier cyber charter. The charter doesn't get you out of the DSPT, though. Its first commitment is that you'll "achieve and maintain at least 'Standards Met'" on it. So a small supplier can have nothing to pen test for the DSPT and still need a proper application test for DTAC. We've covered that split in more detail in [DSPT 9.2 pen testing for NHS IT suppliers](https://blog.echosecure.co.uk/dspt-9.2-pen-testing-for-nhs-it-suppliers-what-changed-for-2026-27). ## What to send a customer who asks for an audit You don't have to wait until you've published to reply. Tell them you're Category 3, so an independent DSPT audit isn't required. Give them a date you'll publish by and your organisation code, so they can check it themselves. Attach your Cyber Essentials Plus certificate and, if you've had one, a letter of attestation from your pen test provider. Then publish. The 2026-27 deadline is 30 June 2027. Your customers aren't waiting for it. ## Check yourself in two minutes Search your company name on the toolkit's [organisation search](https://www.dsptoolkit.nhs.uk/OrganisationSearch). If your page says "never published", or the latest assessment is older than 2025-26, that's what your customers see too. If you sell into the NHS and aren't sure which tests you need, [tell us your DSPT category and what you sell](https://echosecure.co.uk/contact-us), and we'll tell you whether you need a [pen test](https://echosecure.co.uk/penetration-testing) at all. Sometimes the answer is no, and we'll say so. ## Share this post [mailto:https%3A%2F%2Fblog.echosecure.co.uk%2Fnhs-it-suppliers-never-published-dspt](mailto:https%3A%2F%2Fblog.echosecure.co.uk%2Fnhs-it-suppliers-never-published-dspt) ## Keep reading ### [![DSPT 2026-27 evidence items showing pen testing (9.2.1, 9.2.3) exempt for Cyber Essentials Plus, but web applications (9.3.1) not exempt.](https://blog.echosecure.co.uk/hs-fs/hubfs/dspt-9-2-featured-og.png?width=1200&height=630&name=dspt-9-2-featured-og.png) NHS Cyber Essentials DTAC DSPT 9.2 Pen Testing for NHS IT Suppliers: What Changed for 2026-27](https://blog.echosecure.co.uk/dspt-9.2-pen-testing-for-nhs-it-suppliers-what-changed-for-2026-27) ### [![Table of six UK retail breaches and how the attackers got in. M&S and Co-op through help desk password resets, ASOS through an impersonated trusted contact, Kering through an OAuth app authorised after a phone call, Adidas and Harrods through third-party providers. None came through the storefront.](https://blog.echosecure.co.uk/hs-fs/hubfs/retail-breaches-featured-og.png?width=1200&height=630&name=retail-breaches-featured-og.png) Web App Breach Asos A Web App Test Would Not Have Stopped Any of These Retail Breaches](https://blog.echosecure.co.uk/a-web-app-test-would-not-have-stopped-any-of-this-years-retail-breaches) [![Echo Secure AI Logo](https://blog.echosecure.co.uk/hs-fs/hubfs/Echo%20Secure%20Logo-3.png?width=1250&height=625&name=Echo%20Secure%20Logo-3.png "Echo Secure AI Logo")](https://echosecure.co.uk) - [Terms & Conditions](https://echosecure.co.uk/terms-of-service) - [Privacy Policy](https://echosecure.co.uk/privacy-policy) - [Personal Protection Packages](https://echosecure.co.uk/cyber-security-protection-packages-and-end-user-devices) - [Blog](https://blog.echosecure.co.uk) - [Contact Us](https://echosecure.co.uk/contact-us) - [Cookie settings](https://echosecure.co.uk/#cookie-settings) **Echo Secure AI Limited** Company Number: 16320764 Address: 86-90 Paul St, London, EC2A 4NE --- ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Kurtis Baron", "url" : "https://blog.echosecure.co.uk/author/kurtis-baron" }, "dateModified" : "2026-10-15T21:39:46.723Z", "datePublished" : "2026-10-15T21:32:11.000Z", "headline" : "Never Published Your DSPT? What NHS IT Suppliers Miss", "image" : [ "https://blog.echosecure.co.uk/hubfs/dspt-register-featured-og.png" ], "mainEntityOfPage" : { "@id" : "https://blog.echosecure.co.uk/nhs-it-suppliers-never-published-dspt", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.echosecure.co.uk/hubfs/Echo%20Secure%20Logo-3.png" }, "name" : "Echo Secure AI" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://echosecure.co.uk/#organization", "@type" : "Organization", "description" : "UK penetration testing and cyber security firm.", "founder" : { "@id" : "https://kurtisebear.com/#person", "@type" : "Person", "name" : "Kurtis Baron", "url" : "https://kurtisebear.com/" }, "legalName" : "ECHO SECURE AI LIMITED", "logo" : "https://echosecure.co.uk/hubfs/Echo%20Secure%20Logo.png", "name" : "Echo Secure", "sameAs" : [ "https://www.linkedin.com/company/echo-secure-cyber-security/", "https://find-and-update.company-information.service.gov.uk/company/16320764", "https://blog.echosecure.co.uk/", "https://www.github.com/echosecure" ], "telephone" : "+443308081713", "url" : "https://echosecure.co.uk/" } ```