DSPT 2026-27 · Standard 7: Continuity Planning
Have you tested or rehearsed your business continuity plan for a data or cyber incident in the last 12 months?
Why it matters for your practice
This doesn't need to be a full simulation. A tabletop walkthrough counts — sit down as a team and talk through what you'd do if you couldn't access EMIS or SystmOne or NHSmail was down. The NCSC's free Exercise in a Box also counts. Record the date, who took part, what you discussed and any actions that came out of it, and put a summary in the comments.
Is it mandatory?
No. 7.1.7 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
What changed since 2025-26
New evidence item for cat 4. See all 2026-27 changes.
Official wording from NHS England
Assertion 7.1: Organisations have a defined, planned and communicated response to data security incidents that impact sensitive information or key operational services
Has your organisation tested or exercised its business continuity plan for a data or cyber incident within the last 12 months?
A test does not need to be a full simulation. A tabletop walkthrough - where the practice team talks through what they would do if they could not access SystmOne or if NHSmail was unavailable - counts as an exercise. As does the NCSC Cyber Exercise in a Box. Record the date, who participated, what was discussed, and any actions or learning that followed. Please provide details in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Business Continuity Plan
Ready-to-edit templates are included in paid plans.