DSPT 2026-27 · Standard 4: Managing Data Access
Is multi-factor authentication (MFA) enabled on all systems that can be accessed remotely?
Why it matters for your practice
MFA means requiring a second form of verification (like a code on your phone) in addition to a password. This should be turned on for all systems accessible outside the practice — NHSmail, clinical systems accessed remotely, VPNs, cloud services, etc. If a system doesn't support MFA, document this as an approved exception.
Is it mandatory?
Yes. GP practices must meet 4.5.3 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 4.5: You ensure your passwords are suitable for the information you are protecting
Multi-factor authentication is used on all remotely accessible user accounts on all systems, with exceptions only as approved by a relevant board or senior management.
Multi-factor authentication (MFA) is one of the most effective ways to protect data and accounts from unauthorised access. Where systems do not support MFA, or where there are significant operational reasons outweighing the risk of not having MFA, then exceptions can be made and should be detailed in the text box response. Exceptions for ICB-commissioned digital services should be decided by the ICB board or senior management. Exceptions for practice-commissioned digital services may be decided by the practice management. All exceptions should be detailed in the text box response. Guidance on implementing Multi-factor authentication is available (https://www.digitalcarehub.co.uk/data-security-protecting-my-information/cyber-security/implement-multi-factor-authentication-mfa/).
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Information Security Policy
Ready-to-edit templates are included in paid plans.