DRAFT - FOR REVIEW
Viewee DSPT Preparation Plan
Prepared for a rapid contract-triggered submission | Version 0.1 | 16 September 2026
For Viewee, DSPT is conditional. It becomes relevant when Viewee processes or can access NHS patient/health and care data, connects to NHS systems, or a customer or contract requires a submission. A general sale to a care operator does not by itself prove that DSPT is mandatory. Confirm applicability and scope in each procurement.
The old 30 June 2026 deadline applied to 2025-26 version 8 and has passed. The live cycle is 2026-27 version 9, published 8 September 2026, with a deadline of 30 June 2027. Recheck the live service immediately before submission.
Correct profile matters
The current DSPT organisation-type guidance distinguishes a large IT Supplier from a small supplier. A company supplying digital goods/services to NHS or care selects IT Supplier only if it meets all three criteria: 50+ staff, £10m+ turnover, and digital supply to NHS and/or care. A smaller company should select Other, including small companies/NHS business partners. On Viewee's present early-stage facts, prepare against the live IT Supplier assertion set because a contract may ask for it, but do not self-register under the large IT Supplier profile without checking the current eligibility rules and customer instruction.
DSPT scope should be the health and care data and supporting people, systems and suppliers in the contracted service, not automatically every Viewee activity.
Preparation objective
Maintain a ready-to-submit evidence room mapped to the live 2026-27 v9 assertions for the profile ultimately selected. Do not mark an assertion complete until the evidence exists and shows the control operating.
Preparation path
| Step | Do now | Trigger-time action |
|---|---|---|
| 1. Applicability | Create a one-page decision template: customer, contract clause, NHS relationship, data types, access, system connection, controller/processor roles. | Get the customer's written requirement; confirm ODS/DSPT registration route and profile in the live service. |
| 2. Scope | Maintain system/data-flow and supplier diagrams for app, API, hosting, support, development and endpoints. | Mark which flows handle in-scope health/care data; exclude unrelated processing with reasons. |
| 3. Assertion map | Import the live v9 IT Supplier assertions/evidence items into a tracker with ID, wording, applicability, owner, evidence link, status and gap. | Re-export from the service and diff against the tracker. Change to the selected profile if required. |
| 4. Core governance | Name accountable founder; maintain policies, risk register, information assets, ROPA/DPIA, supplier register and review minutes. | Approve scoped submission and any improvement plan. |
| 5. People and access | Annual security/privacy training; unique accounts; MFA; least privilege; joiner/mover/leaver process; privileged/support access log and quarterly review. | Export current evidence and close stale access. |
| 6. Technical security | Secure configuration, supported software, dependency/container/cloud scanning, patch and exception workflow, logs/alerts and tested backups. | Run current scans; close high-risk gaps; document justified exceptions. |
| 7. Incidents and continuity | Incident and breach plan, reporting matrix, tabletop exercise, BCP/DR plan and restore test. | Update NHS/customer contacts and contract timescales. |
| 8. Independent assurance | Budget and shortlist competent assessors/penetration testers; keep scopes ready. | Commission the assessment, audit or penetration test required by the live profile, current guidance or contract. |
| 9. Submission | Maintain an evidence index and monthly gap review. | Quality-review every answer; submit; retain export/status and track improvement actions to closure. |
Live 2026-27 v9 IT Supplier assertion workstreams
The authoritative v9 item-by-item wording is the NHS DSPT downloadable IT Supplier assertion and evidence set. Use it without rewriting IDs or wording. Organise preparation under these workstreams so each live item has an owner and evidence:
| Workstream | Evidence pack to keep warm |
|---|---|
| Lawfulness, transparency and information governance | ICO registration; privacy notices; ROPA; DPIA; processing contracts; governance roles and minuted review. |
| People, contracts and training | Founder/contractor terms; confidentiality; annual training; role competence; reporting and just-culture evidence. |
| Assets, data flows and access | Asset/data-flow registers; account inventory; MFA; privileged/support access; access reviews; leaver process. |
| Vulnerability, patching and secure configuration | Supported-software inventory; secure baselines; scans; remediation/exception records; threat/advisory review. |
| Incident response and continuity | Plan; roles; logs; exercises; incident records; BCP/DR; backup and restore test; communications matrix. |
| Application, API and infrastructure assurance | Secure development/change records; OWASP coverage; cloud/IaC review; independent penetration test and retest where required. |
| Suppliers | Due diligence, DPAs, security evidence, subprocessor list, locations, breach terms, continuity and exit/deletion. |
Because v9 was released only on 8 September 2026, do not copy last year's 12-audit-assertion list into a v9 submission. The live v9 workbook and selected profile are the source of truth. Record a frozen copy with the submission evidence.
Evidence-room structure
00 Applicability and profile
01 Scope and data flows
02 Live v9 assertion tracker
03 Governance, risks and privacy
04 People, training and access
05 Technical controls and vulnerability
06 Incidents, continuity and backups
07 Suppliers and contracts
08 Testing and independent assurance
09 Submission export, improvement plan and renewal
Use links to original records rather than screenshots where possible. Store dates, owners and review/expiry dates. Never create evidence retrospectively.
Fast-response checklist when a contract asks
Obtain the exact clause, deadline and required status.
Confirm whether Viewee will process/access NHS patient or health and care data.
Confirm current organisation type/profile with the live DSPT service or helpdesk; do not assume large IT Supplier.
Download the current 2026-27 v9 assertion/evidence set for that profile and diff against the tracker.
Run a gap review, evidence quality check, current scan/access review and founder sign-off.
Commission independent assurance if the live profile or contract requires it.
Submit by the contractual date and no later than the live annual deadline; retain status/export and track actions.