Unavoidably Secure helps care homes and home care providers complete the NHS Data Security and Protection Toolkit (DSPT) and reach Standards Met for 2026-27. We start with a free external audit, then assemble and check the evidence the toolkit asks for. Fixed fees: full audit from £950, standards readiness with support through to submission from £1,500.
On this page
Which care providers need the DSPT
Care homes and home care providers that handle NHS data are expected to complete the DSPT every year. If you are not sure whether that includes you, the DSP Toolkit website and Digital Care Hub both explain who is in scope. The 2026-27 toolkit is version 9, released on 1 September 2026, and the deadline is 30 June each year, so 30 June 2027 for this round.
For background on the toolkit itself, read our guide to the DSPT for care homes and the DSPT explained.
Standards Met and Approaching Standards
The DSPT gives three main results: Standards Met, Approaching Standards, and Standards Exceeded. Digital Care Hub, which supports adult social care with the toolkit, says all care providers should aim to reach Standards Met. The official toolkit guidance also allows care providers to publish a one-off Approaching Standards assessment if they have made good progress but are not yet at Standards Met; Digital Care Hub explains that this means answering the 26 questions that are mandatory for Approaching Standards and publishing an action plan.
Approaching Standards is a stepping stone, not a destination. Our standards readiness work is aimed at getting you to Standards Met, and the official guidance says an organisation that reaches Standards Met and records a current Cyber Essentials Plus certificate can reach Standards Exceeded.
How we help
The provider submits the DSPT, not us. We find out where you really stand, gather the evidence the questions ask for, and check it before you submit. The audit covers four areas:
| Area | What it means for a care provider |
|---|---|
| External attack surface | Your website and email, assessed without access to your systems, including whether someone could send email pretending to be you to families, staff or commissioners. |
| Cookies, trackers and consent | Whether your website sets cookies or loads trackers before visitors agree, and whether refusing is as easy as accepting. |
| Governance documentation | Processing records, privacy notice, retention, supplier contracts (including care planning and rostering systems), breach readiness and all ten DSPT standards. |
| Internal systems | Devices, patching, access control, multi-factor authentication and backups, assessed on evidence your IT provider produces. |
Care providers often need the most help with evidence of staff data security training across shift-working teams, removing leavers' access promptly, shared devices, and contracts with the suppliers who handle residents' or clients' data.
In our Yorkshire and the Humber healthcare benchmark, public DNS checks on 16 October 2026 found that 83% of home care agency websites (336 of 404) and 73% of care home websites (212 of 289) could be impersonated by email. Families and local authorities trust emails from your domain, which is what makes this matter. Read why care homes are targeted, or run the free email security check.
Free support you should know about
Digital Care Hub runs Better Security, Better Care, which offers free support with the DSPT to adult social care providers. If you are comfortable completing the toolkit yourself with guidance, start there. Our paid service suits providers who want an independent audit, someone to assemble and check the evidence, or help keeping it current through the year.
What it costs
Your public web and email surface, assessed without any access to your systems. Written report within five working days.
All four components, evidence pack, remediation plan, and a re-test at 60 days.
Everything in the full audit, plus DSPT or Cyber Essentials evidence assembly and support through to submission.
Continuous monitoring, quarterly re-assessment, evidence kept current, annual submission handled.
For a provider facing the 30 June 2027 deadline, standards readiness (from £1,500) is usually the right package because it includes evidence assembly and support through to submission. Ongoing assurance (from £250 a month) keeps the evidence current and handles the annual submission.
Not sure where you stand?
We run a free external audit of your public web and email setup and show you where you are against the ten standards. No charge, no obligation, no system access.
Request your free auditOr email support@unavoidablysecure.com
We are independent: your IT provider carries out technical fixes, and we refer out physical security, in-depth penetration testing and legal advice. We are not a Cyber Essentials certification body, and no assessment certifies compliance with any standard.
Common questions
Do care homes have to complete the DSPT?
Care homes and home care providers that handle NHS data are expected to complete it every year. The 2026-27 deadline is 30 June 2027.
What is Approaching Standards?
A result for providers that have made good progress but have not reached Standards Met. Care providers can publish a one-off Approaching Standards assessment by answering the mandatory questions and publishing an action plan. Providers should still aim for Standards Met.
How much does DSPT help for a care provider cost?
The external audit is free. A full audit is from £950, standards readiness with support through to submission is from £1,500, and ongoing assurance is from £250 a month. Fees are fixed and quoted after a scoping call.
Is there free DSPT help for care providers?
Yes. Digital Care Hub runs Better Security, Better Care, which offers free DSPT support to adult social care providers. Our paid service is for providers who want an independent audit and someone to assemble and check the evidence.
Do you submit the DSPT for us?
No. The provider submits the DSPT. We assess readiness, assemble evidence and support you through to submission on the standards readiness package.
This page is general information, accurate at the time of writing (October 2026), and is not legal advice. No assessment certifies compliance with any standard. Unavoidably Secure is not a Cyber Essentials certification body. Fees are fixed and quoted after a scoping call.