WorkNest Secure
NHS DSP Toolkit Consultancy
Get expert-led support to quickly meet the required standards of your NHS DSP Toolkit (DSPT) submission.
Our NHS DSP Toolkit consultancy provides expert-led support to help you meet the required standards quickly and confidently.
Our NHS DSP Toolkit consultancy provides expert-led support to help you meet the required standards quickly and confidently.
Our NHS DSP Toolkit consultancy provides expert-led support to help you meet the required standards quickly and confidently.
With extensive NHS experience, we guide you through every stage, supplying bespoke policies and procedures to ensure your organisation meets its information security, cyber security, and data protection requirements.
With extensive NHS experience, we guide you through every stage, supplying bespoke policies and procedures to ensure your organisation meets its information security, cyber security, and data protection requirements.
What is the NHS DSP Toolkit?
What is the NHS DSP Toolkit?
What is the NHS DSP Toolkit?
The NHS Data Security and Protection (DSP) Toolkit is an annual self-assessment for organisations handling NHS data in England.
It measures compliance and resilience against the National Data Guardian's 10 standards, covering everything from the appointment of key personnel and policies through to training and technical controls.
Completion is mandatory for health and social care providers and all organisations accessing NHS data or networks.
Why WorkNest for NHS DSP Toolkit support?
Meet NHS DSP Toolkit standards quickly, confidently, and with expert guidance.
Proven NHS experience
Experience across the NHS, including frontline hospitals, trusts, and healthcare partners.
100% success rate
100% of our NHS DSP Toolkit customers pass with Standards Met or Standards Exceeded.
End-to-end coverage
Get expert consultant-led support at every stage of the journey.
Where we can help
Where we can help
Where we can help
No matter the level of support you require, we are ready to assist. We collaborate with you to develop a strategic plan to achieve complete compliance. This includes:
A risk-based review of your submission assessed against National Data Guardian standards.
Checks across training records, risk reviews, continuity exercises, and supporting documentation to verify evidence.
Verification of current certifications, including Cyber Essentials, Cyber Essentials Plus, and ISO 27001.
Reviews of your Information Asset Register, Records of Processing Activities, Retention and Disposal policies, Data Subject Rights procedures, and related documentation.
An evaluation of whether your current security standards are suitable and effective.
A detailed report and rating broken down by area, aligned to national guidelines and ready to include with your annual submission.
No matter the level of support you require, we are ready to assist. We collaborate with you to develop a strategic plan to achieve complete compliance. This includes:
A risk-based review of your submission assessed against National Data Guardian standards.
Checks across training records, risk reviews, continuity exercises, and supporting documentation to verify evidence.
Verification of current certifications, including Cyber Essentials, Cyber Essentials Plus, and ISO 27001.
Reviews of your Information Asset Register, Records of Processing Activities, Retention and Disposal policies, Data Subject Rights procedures, and related documentation.
An evaluation of whether your current security standards are suitable and effective.
A detailed report and rating broken down by area, aligned to national guidelines and ready to include with your annual submission.
Discover how our expert consultants can guide you through every stage of your NHS DSP Toolkit submission.
FAQs
The toolkit applies only to England, though any organisation outside England that receives English NHS data must still comply.
You must complete the assessment if your organisation:
Provides health or social care services in England (including pharmacies, dentists, private ambulance services, counselling services, and charities)
Connects to the Health and Social Care Network (HSCN) or receives NHS data
Provides technology or services that handle health or care data in England, including IT providers, auditors, payment processors, and facilities/maintenance
Provides services to any of the above organisations
In short, if you answered yes to any of the following, the assessment applies to you:
Does your organisation provide health or care services in England?
Does your organisation connect to NHS systems or receive NHS data?
Does your organisation provide technology or services handling health or care data in England?
Standards not met – You haven’t met the requirements. This can result in the termination of contracts, exclusion from securing work, and the loss of NHS data/network access.
Approaching standards – Nearly but not quite there, but there is evidence that you will get there soon, and they are permitting you to proceed so long as you rectify it soon. This is for eligible social care providers.
Standards met – You’ve met the requirements and can undertake work for another year. This is the highest rating you can achieve if you don’t have Cyber Essentials Plus in place.
Standard exceeded – You met the requirements above and have CE+ in place. Some commissioners may rate suppliers with this more highly than others when scoring bids.
The toolkit applies only to England, though any organisation outside England that receives English NHS data must still comply.
You must complete the assessment if your organisation:
Provides health or social care services in England (including pharmacies, dentists, private ambulance services, counselling services, and charities)
Connects to the Health and Social Care Network (HSCN) or receives NHS data
Provides technology or services that handle health or care data in England, including IT providers, auditors, payment processors, and facilities/maintenance
Provides services to any of the above organisations
In short, if you answered yes to any of the following, the assessment applies to you:
Does your organisation provide health or care services in England?
Does your organisation connect to NHS systems or receive NHS data?
Does your organisation provide technology or services handling health or care data in England?
Standards not met – You haven’t met the requirements. This can result in the termination of contracts, exclusion from securing work, and the loss of NHS data/network access.
Approaching standards – Nearly but not quite there, but there is evidence that you will get there soon, and they are permitting you to proceed so long as you rectify it soon. This is for eligible social care providers.
Standards met – You’ve met the requirements and can undertake work for another year. This is the highest rating you can achieve if you don’t have Cyber Essentials Plus in place.
Standard exceeded – You met the requirements above and have CE+ in place. Some commissioners may rate suppliers with this more highly than others when scoring bids.
What our clients say
We’ve always been very impressed with the cyber security services WorkNest provide us. Their professional approach, knowledge and flexibility have ensured they have become a key trusted partner in our supply chain.
Paymentsense
Founder
WorkNest Secure delivered a highly professional and thorough incident response service. Their team’s technical knowledge, attention to detail, and clear communication throughout the process made a complex area easy to navigate. The quality of the analysis and final reporting gave us real assurance and added value to our internal security efforts, minimising the impact to the business.
Shoezone
Head of IT
We provide a comprehensive suite of data protection services designed to navigate regulatory complexity, maintain compliance, and build lasting organisational confidence.
Get access to an expert Data Protection Officer for data privacy support.
Achieve GDPR compliance with clarity and ease through specialist‑driven, cost‑effective solutions.
