Standards Met is the status to aim for. It means your organisation has completed all the mandatory parts of the Data Security and Protection Toolkit (DSPT). Approaching Standards means you have met the minimum and published an action plan for the rest. It is a temporary step, not a destination. Standards Exceeded means you have reached Standards Met and also hold Cyber Essentials Plus.
The DSPT statuses at a glance
| Status | What it means | What to do |
|---|---|---|
| Not published | The organisation is registered but has not published an assessment for the current toolkit year. | Complete and publish before the deadline. |
| Approaching Standards | Minimum standards met, with an action plan for the remaining items. | Work through the action plan and republish at Standards Met. |
| Standards Met | All mandatory items completed. | Keep evidence current and republish each year. |
| Standards Exceeded | Standards Met, plus Cyber Essentials Plus certification. | Keep the certification current. |
What does Standards Met require?
Standards Met means you have answered every mandatory question for your organisation type and confirmed the evidence behind each answer. The number of questions depends on the type of organisation. For 2026-27, adult social care providers answer 45 mandatory questions. Other organisation types, such as dental practices, GP practices and NHS trusts, see a different set, so check your own assessment rather than relying on a number you have read elsewhere.
For care providers, Standards Met is mandatory if you deliver services under an NHS contract or access NHS patient data, and it opens up access to shared systems with GPs, hospitals and pharmacists.
When is Approaching Standards allowed?
It depends on your organisation type:
- Care providers can publish at Approaching Standards for their first publication only, by completing the 26 mandatory items and writing an action plan showing how they will reach Standards Met. From the second publication onwards, they need to reach Standards Met.
- Some NHS organisation types, such as NHS trusts and integrated care boards, can submit an improvement plan if they cannot meet the required level. An approved plan gives the status Approaching Standards, with progress updates due during the year. We cover this in what changed in DSPT version 9.
Approaching Standards still shows you are meeting minimum legal standards, and for care providers it gives access to secure NHS email. But it is meant to be a stepping stone, and commissioners can see it.
How do you get Standards Exceeded?
Reach Standards Met, and hold a current Cyber Essentials Plus certificate. Cyber Essentials Plus is the independently tested version of the government-backed Cyber Essentials scheme, certified by an IASME certification body. Read Cyber Essentials vs Cyber Essentials Plus for the difference.
How to move from Approaching Standards to Standards Met
- Open your action plan and list every item still outstanding.
- Sort them by who has to act: you, your staff, your IT provider or a supplier.
- Start with the slow ones: staff training and supplier contracts take longest.
- Fix the technical basics: multi-factor authentication, updates, backups and email security. You can check your email in seconds with our free DMARC checker.
- Collect evidence as you go, in one shared folder, so the final answers take an afternoon rather than a week.
- Republish as soon as you can honestly confirm every mandatory item. You do not have to wait for the deadline.
How to check any organisation's DSPT status
The DSPT website has a public organisation search. Enter the organisation's name or ODS code to see its latest published status and the toolkit year it relates to. It is worth checking your own listing, and the listings of suppliers who handle your data.
Frequently asked questions
What is the difference between Standards Met and Approaching Standards?
Standards Met means every mandatory item for your organisation type is complete. Approaching Standards means the minimum is met and you have published an action plan for the rest. For care providers it is only available for the first publication.
What does DSPT Standards Exceeded mean?
It means you have reached Standards Met and also hold a current Cyber Essentials Plus certificate.
How many questions do you need for DSPT Standards Met?
It depends on your organisation type. For 2026-27, adult social care providers answer 45 mandatory questions, and first-time care providers can publish at Approaching Standards with 26. Other organisation types see a different set of questions.
Can I stay at Approaching Standards?
Care providers can only publish at Approaching Standards once. From the second publication onwards they need to reach Standards Met. It is designed as a temporary step.
Next, read when the 2026-27 DSPT is due, the DSPT for care homes and how to complete the DSPT step by step.
How we can help
Unavoidably Secure reviews your controls, website and email security against what the DSPT asks for, and helps you get ready for Cyber Essentials. We do not certify, accredit or guarantee compliance: the DSPT is your organisation's own self-assessment, and Cyber Essentials certification comes from an IASME certification body. What we give you is a plain-English list of what to fix first, written for small teams.
This guide is general information, not legal advice. Facts were checked against Digital Care Hub and the DSPT website on 16 October 2026. For more practical guides, browse the blog.
Stuck at Approaching Standards?
Book a free external audit. We will show you which gaps stand between you and Standards Met, in plain English, so you know exactly what to fix.
Book a free auditNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.