DSPT and Cyber Essentials Plus – Update January 2021

Applicable to NHS Trusts and Foundation Trusts

To reduce the burden on individual organisations from having to respond to multiple standards, the requirements for Cyber Essentials have been included within the 2020-21 DSPT for NHS Trusts and Foundation Trusts. Equivalence to Cyber Essential Plus is now gained when completion of the DSPT is combined with an independent on-site assessment which was due to be completed in 2020-21.


Due to the pressures that organisations have faced in responding to the COVID-19 pandemic - we recognise that resourcing an on-site assessment will place an additional burden on the NHS. Therefore, the need to complete an on-site assessment before the end of June 2021 is no longer mandatory for NHS Trusts and Foundation Trusts. So, unless we get in touch with you, an on-site assessment is not required.


For NHS Trusts and Foundation Trusts that will be ready for external assessment in 2021, NHS Digital will fund a limited number of on-site assessments between now and the end of June 2021. For further details about on-site assessments see on-site assessments - NHS Digital.


NHS organisations will still have the option of arranging their own independent assessments.


The evidence items in the DSPT which cover Cyber Essentials are available at: https://www.dsptoolkit.nhs.uk/News/131 in the DSPT Requirements 20-21 attachment, flagged in column V.