DSPT 2026-27 · Standard 9: IT Protection

Evidence item 9.2.1Optional

Has your practice had an annual IT penetration test that was properly scoped with senior management?

Why it matters for your practice

Penetration testing is where a security specialist tries to find weaknesses in your IT systems. While optional for GP practices, it's good practice. If you've had one, describe its scope. If you have Cyber Essentials Plus certification or PSN compliance, you may be exempt from this requirement.

Is it mandatory?

No. 9.2.1 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.

Official wording from NHS England

Assertion 9.2: A penetration test has been scoped and undertaken

The annual IT penetration testing is scoped in negotiation between the Board/person with delegated responsibility for data security, business and testing team including a vulnerability scan and checking that all networking components have had their default passwords changed to a high strength password.

Use the comments field to outline the scope of the organisation's penetration test and redact any elements of the scope that are sensitive.

Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.

Track 9.2.1 and every other DSPT item

ClinicShield turns each DSPT question into plain English, shows your traffic-light status by standard and builds an action plan for anything you haven't met yet. Free forever plan, no card needed.

Start your free assessment

This guide covers the requirements for GP practices (Category 4). ClinicShield is a preparation and guidance tool. You still publish your submission on the official DSPT website. We're not affiliated with NHS England and can't guarantee an outcome. Guidance only, not professional advice.