Board and executive assurance: cyber security risk (NHSE, 10 June 2026)

Summary

The Government’s 10 Year Health Plan is transforming how services are delivered through greater digitisation. However, increased use of digital tools also brings new and enhanced risks that need to be managed. 

In a letter to providers, NHS England and the Department of Health and Social Care ask boards and executives to assure themselves that cybersecurity risks are being managed effectively, with clear, sustained programmes for improvement..

Content

The Data Security and Protection Toolkit (DSPT) is the standard that all frontline NHS organisations are expected to comply with and is aligned to the National Cyber Security Centre’s Cyber Assessment Framework (CAF).

The DSPT details a range of outcomes, covering the following 5 objectives:

• managing cyber risk
• protecting against cyber-attack and data breaches
• detecting cyber security events
• minimising the impact of incidents
• using and sharing information appropriately.