DSPT 2026-27 · Standard 9: IT Protection
Have all default passwords on your network equipment (routers, Wi-Fi, switches) been changed?
Why it matters for your practice
When routers, Wi-Fi access points, and other network equipment are first installed, they come with default passwords (like 'admin' or 'password'). These must be changed to strong, unique passwords. This applies to all your locations but not to staff working from home. Ask your IT support company to confirm this has been done.
Is it mandatory?
Yes. GP practices must meet 9.1.1 to reach "Standards Met" in the 2026-27 DSPT.
Official wording from NHS England
Assertion 9.1: All networking components have had their default passwords changed
Does your organisation make sure that the passwords of all networking components, such as a Wi-Fi router, have been changed from their original passwords?
Networking components include routers, switches, hubs and firewalls at all of your organisation's locations. Your organisation may just have a Wi-Fi router. This does not apply to Wi-Fi routers for people working from home. You may need to ask your IT supplier to assist with answering this question. If your organisation does not have a network or internet access, then tick and write "Not applicable" in the comments box.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Information Security Policy
Ready-to-edit templates are included in paid plans.