DSPT 2026-27 · Standard 8: Unsupported Systems

Evidence item 8.4.3Optional

Do you regularly test for and identify security vulnerabilities in your IT systems?

Why it matters for your practice

This means proactively looking for weaknesses in your IT setup — for example, through vulnerability scanning tools, penetration testing, or regular security reviews by your IT support company. This is optional for GP practices, but good practice.

Is it mandatory?

No. 8.4.3 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.

Official wording from NHS England

Assertion 8.4: You manage known vulnerabilities in your network and information systems to prevent disruption of the essential service

You identify and understand security vulnerabilities in your systems, such as through regular vulnerability testing.

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

Track 8.4.3 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.