DSPT 2026-27 · Standard 7: Continuity Planning
Do you manage your hardware, software, and data assets throughout their lifecycle — from purchase to disposal?
Why it matters for your practice
This means having a process for managing equipment from when you buy it to when you dispose of it. When a computer becomes obsolete, is it identified and replaced? When old equipment is disposed of, are hard drives wiped securely? When software licences expire, is this tracked?
Is it mandatory?
No. 7.1.6 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 7.1: Organisations have a defined, planned and communicated response to data security incidents that impact sensitive information or key operational services
Assets (hardware, software and data) are owned and managed throughout their lifecycle.
You should have an asset management process which ensures that: - obsolete devices are identified and managed - suitable controls are applied wherever assets are reused, transferred or disposed of
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Information & Digital Asset Register
Ready-to-edit templates are included in paid plans.