NHS cyber standards and the Cyber Security and Resilience Bill
NHS organisations deal with three overlapping things: the Data Security and Protection Toolkit (DSPT), the NCSC Cyber Assessment Framework (CAF) and the Cyber Security and Resilience Bill (CSRB). The DSPT is an NHS assurance tool, the CAF sits behind its newer assessment, and the Bill would add legal reporting and supplier rules.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
The short version
The Data Security and Protection Toolkit (DSPT) is the NHS's own assurance tool. The NCSC's Cyber Assessment Framework (CAF) is the structure behind its newer assessment for larger organisations. The Cyber Security and Resilience Bill (CSRB) is legislation that changes reporting, supplier and enforcement rules under the NIS Regulations 2018.
They overlap, but completing one does not automatically satisfy the others.
How the three fit together
| DSPT | CAF | The Bill | |
|---|---|---|---|
| What it is | NHS annual self-assessment | NCSC assessment framework | Proposed amendments to UK law |
| Run by | NHS England | NCSC | Parliament, then regulators |
| Who it reaches | Organisations with access to NHS data and systems | Whoever adopts it or is assessed against it | Regulated persons, including healthcare operators above thresholds |
| What failure means | Published status and improvement expectations | No direct penalty | Regulatory enforcement and financial penalties |
Who uses the CAF-aligned DSPT
The DSPT moved towards the CAF in September 2024. NHS England's published change notes list these users of the CAF-aligned interface:
- NHS trusts
- Integrated care boards
- Commissioning support units
- Arm's length bodies
- Operators of essential services
- Genomics organisations nominated by the Department of Health and Social Care
Independent providers that are operators of essential services and genomics organisations are covered from 2025-26. Other organisations keep prescriptive controls, which NHS England maps to a CAF profile nationally.
The health and care version extends the CAF with an overlay. NHS England describes 47 contributing outcomes: 39 from the CAF and 8 custom outcomes about using and sharing information appropriately. Organisations assess themselves against outcomes using indicators of good practice, and the assessment includes independent audit.
The scope for IT suppliers has been described differently by different secondary sources, so suppliers should confirm their category on the DSPT site rather than rely on summaries.
What the Bill changes for health
Health care in England already has a competent authority under the NIS Regulations: the Secretary of State for Health and Social Care, not NHS England. The Bill then adds:
- Faster reporting. Initial notification within 24 hours and a full notification within 72 hours, both from when an operator first becomes aware of a reportable incident, and copied to the CSIRT.
- A wider incident definition. Events capable of having an adverse effect count as incidents, though a separate test decides what must be reported. See what counts as a significant incident.
- Regulated suppliers. Larger managed service providers would have their own duties, regulated by the Information Commission.
- Critical supplier designation. A regulator could designate a supplier if disruption to it could cause significant wider harm, for example a pathology or IT provider that many services depend on. Whether any particular supplier is designated is a decision for the regulator.
See NHS organisations under the Bill for the sector-level view.
How to use one evidence base
You do not need three separate programmes. A workable approach is:
- Use your CAF-aligned DSPT work as the base. Keep evidence organised by CAF outcome so it can be reused.
- Add a Bill gap list. Your DSPT submission does not show that you can notify within 24 hours. Test that separately, including out of hours.
- Sort your suppliers. Identify which are likely to be regulated managed service providers and which could be critical to clinical services.
- Review contracts. Make sure suppliers must tell you quickly about incidents, and align this with what they will have to do under the Bill.
- Keep board reporting joined up. Report one view of cyber risk, with separate lines for each obligation.
Questions worth asking now
- Who decides, at 2am, whether an incident is reportable?
- Which contact would we use for the regulator and the CSIRT?
- Which suppliers could stop a clinical service if they went down?
- Can we show evidence for each CAF outcome, or only a score?
- Does our DSPT audit tell us anything about incident notification speed?
What is not settled
The form and manner of notifications will be set by regulators, and the Bill may change before Royal Assent. Later DSPT versions may also change how the toolkit maps to the CAF, and new CAF versions may take time to feed through. Check the DSPT site before each submission.
Sources
Frequently asked questions
The Data Security and Protection Toolkit is an annual NHS self-assessment of data security and protection. Larger organisations such as NHS trusts and integrated care boards use a version aligned to the Cyber Assessment Framework.
Not automatically. Good DSPT evidence can help, but the Bill has its own duties, such as notifying regulators within 24 and 72 hours. Test those separately.
For England, the competent authority is the Secretary of State for Health and Social Care, not NHS England. Devolved arrangements differ.
Larger suppliers providing managed services could be relevant managed service providers, regulated by the Information Commission. A regulator could also designate a supplier as critical if the legal tests are met. Each case depends on the facts.