DSPT Audit 26-27 Areas of Mandatory Audit NHS Trusts, ICBs, ALBs, CSUs, OES, Genomics and IT Suppliers (01 October 2026)
The outcomes and assertions of the DSPT which must be included in a 26-27 DSPT Audit for NHS Trusts, ICBs, ALBs, CSU, OES and Genomics.
DSPT Audit 26-27 Areas of Mandatory Audit NHS Trusts, ICBs, ALBs, and CSUs
For NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics there are 11 mandated outcomes to be audited (listed below) with organisations selecting 1 outcome of their choice.
A1b
Roles and
responsibilities
A3a
Asset management
B2c
Privileged user
management
B2d
Identity and
access management
B3a
Understanding
data
B4c
Secure
management
B6a
Culture
B6b
Training
C1e
Personnel skills
for monitoring and detection
D1c
Testing and
exercising
E4a
Managing records
If you are undecided which optional outcome to audit we would recommend:
OES and Genomics Organisations
B5c
Backups
NHS Trusts, ICBs, ALBs and CSUs
D1a
Response Plan
CNI operators
A2a Risk
management process
Audit guidance for NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics is being updated and will be launch in early October 2026.
Audit guidance for Audit areas for IT Suppliers will be shared shortly.
DSPT Audit 26-27 Areas of Mandatory Audit for IT Suppliers
1.1 The organisation has a framework in place to support Lawfulness, Fairness and Transparency
2.2 Staff contracts set out responsibilities for data security
3.1 Staff have appropriate understanding of information governance and cyber security, with an effective range of approaches taken to training and awareness
3.2 Your organisation engages proactively and widely to improve data security, and has an open and just culture for data security incidents
4.1 The organisation maintains a current record of staff and their roles
6.2 All user devices are subject to anti-virus protections while email services benefit from spam filtering and protection deployed at the corporate gateway
7.1 Organisations have a defined, planned and communicated response to Data security incidents that impact sensitive information or key operational services
8.1 All software and hardware has been surveyed to understand if it is supported and up to date
8.2 Unsupported software and hardware is categorised and documented, and data security risks are identified and managed
9.2 A penetration test has been scoped and undertaken
9.6 The organisation is protected by a well-managed firewall
10.2 Basic due diligence has been undertaken against each supplier that handles personal information
