If you’re yet to get your NHS Data Security and Protection Toolkit submitted and independently audited under the new requirements for IT Suppliers, we can help.
Our services are conducted to NHS England’s mandated Strengthening Assurance scope and include:
NHS DSPT 2025/26
submission audit services
Delivered by an independent assessor – separate from anyone who helped prepare your submission – assessed against NHS England’s Independent Assessment Framework for IT Suppliers (the non-CAF, assertion-and-evidence route that applies to Category 2 suppliers for 2025/26).
- A single scoping touchpoint to confirm boundaries and the evidence pack
- Independent assessment of the mandatory assertions defined by NHS England for IT Suppliers
- Review of your submitted evidence for accuracy, currency and consistency
- Interviews with relevant staff to confirm controls operate in practice, not just on paper
- Targeted sample testing and technical validation where the framework requires it, against the evidence you provide
- A written independent assessment report setting out findings, any non-conformities and the risk rating for your submission
- Carried out by an independent, CISSP certified assessor with hands-on NHS-supplier experience
- 10 working-day turnaround from receipt of a complete evidence pack
From £2,000 +VAT
NHS DSPT 2025/26
full submission completion services
Led by Thibault Williams, our DSPT Lead, we prepare your 2025/26 submission and build the evidence to stand behind it.
- A scoping call to confirm your organisation type, the in-scope assertions and the evidence you already hold
- Preparation of your 2025/26 DSPT submission against every mandatory assertion for IT Suppliers
- Building and organising your evidence pack – logs, screenshots, system outputs and policies, each mapped to the relevant assertion
- Practical remediation guidance where controls are missing or out of date
- A submission that is genuinely audit-ready, not just complete on paper
From £4,750 +VAT
Independence, done properly
Where we prepare your submission, your independent audit is always carried out by a separate assessor who had no part in preparing it. That is what makes the assessment genuinely independent – and it is exactly what NHS England’s framework, and your NHS customers, expect.
About TMW Resilience
TMW Resilience was founded to demystify AI governance and cyber security, helping organisations move away from box-ticking compliance and toward decision-ready resilience. We combine deep regulatory knowledge with hands-on operational experience, working closely with your teams to deliver clear, actionable outcomes.
