DSPT 2026-27 · Standard 8: Unsupported Systems
If you're using unsupported software, do you have a document explaining the risks and what you're doing about it?
Why it matters for your practice
If you answered in 8.1.4 that you have unsupported systems but are managing the risks, you need a document that: lists each unsupported item, explains the risk, gives the reason you're still using it, and describes what you're doing to reduce the risk. This must be formally approved by the partners or senior management. If everything is supported, write 'Not applicable'.
Is it mandatory?
No. 8.2.1 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 8.2: Unsupported software and hardware is categorised and documented, and data security risks are identified and managed
If your answer to 8.1.4 (on IT systems and software being supported by the manufacturer) was that software risks are being managed, please provide a document that summarises the risk of continuing to use each unsupported item, the reasons for doing so and a summary of the action your organisation is taking to minimise the risk.
This is a conscious decision to accept and manage the associated risks of unsupported systems. This document should indicate that your board or management team have formally considered the risks of continuing to use unsupported items and have concluded that the risks are acceptable. If your answer to the previous question was yes, write "Not applicable" in "Enter text describing document location".
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.