Who holds a current NHS data-security assessment: a census of the DSP Toolkit register

What this census counts, and what it cannot

NHS DSP Toolkit register, 25 September 2026 09:06 UTC. n = 93,260 registered entries (a population, not a sample). Joined to NHS ODS the same day. The toolkit register is Crown copyright reproduced under the free-reproduction permission published in its terms— not the Open Government Licence. The activity join uses NHS Organisation Data Service data, which is Open Government Licence material.

What the register shows

On 25 September 2026 the NHS Data Security and Protection Toolkit's public register carried 93,260 registered entries. 31.94% of them (29,791 of 93,260) had no assessment published in the 2025-26 cycle or later: 24,355 had published at some point but not since, and 5,436 had never published at all. That is a count of the register, not of any sector, and it is not a measure of whether anybody is secure.

The two headline figures answer different questions and the page keeps them apart. Across every row on the register, 31.94% (29,791 of 93,260) have nothing from 2025-26 or later. Restricted to the 79,678entries whose organisation code is still marked Active in NHS ODS — the reading to use if the question is about assurance today — it is 21.93% (17,477 of 79,678). The three buckets reconcile exactly: 63,469 current plus 24,355 lapsed plus 5,436 never published is 93,260.

Scroll the table sideways to see every column →

Every percentage is measured against that group’s own entry count. “Current” means an assessment published in the 2025-26 (version 8) cycle or later. 92,591 of the 93,260 registered codes (99.28%) resolve in NHS ODS; the 669 that do not are reported as their own group and never merged into either side.

Read this finding with

• The whole-register figure and the ODS-Active figure answer different questions. The first asks what the register says; the second asks what it says about the entries whose organisation code is still marked Active in NHS ODS.
• The ODS-Active figure is the one to quote if the question is about assurance today. The whole-register figure is the one to quote if the question is about the state of the register itself.

A missing assessment is often a closed organisation

45.61% of the entries whose last assessment predates 2025-26 (11,007 of the 24,132 that resolve in NHS ODS) are marked Inactive in the NHS Organisation Data Service, against 1.55% of the entries with a current assessment. Restricting the census to the 79,678 registered entries still Active in ODS moves 'no current assessment' from 31.94% to 21.93%.

This is the caveat about insecurity put next to the number rather than banked at the foot of the page. It does not work in reverse: an Active ODS record does not prove an organisation still handles NHS data, and an Inactive one does not prove it has stopped. Read the other way, 92.41% (11,933 of 12,913) of the registered entries marked Inactive in NHS ODS have no current assessment.

Scroll the table sideways to see every column →

Read this finding with

• This is the measured version of the caveat that a missing assessment is not evidence of insecurity. It is put here, next to the number, rather than in a caveat list at the foot of the page.
• It does not work in reverse. An Active ODS record does not mean the organisation still handles NHS data, and an Inactive one does not prove it has stopped.

Registered, and never published anything

5,436 registered entries (5.83% of the register) have registered on the toolkit and never published an assessment. The register cannot say what any of them does, because it reveals a sector only once an assessment is published.

The two sets are the same rows, tested rather than assumed: 5,436entries carry the status “Not Published”, 5,436carry “No Sector Identified”, and the symmetric difference between them is 0. That is why no never-published figure can be given for any sector, including the one this study’s own brief expected. Geography survives where sector does not, because the board is supplied from NHS ODS rather than from the assessment: 58.35% (3,172 of 5,436) of the never-published entries have an Integrated Care Board recorded.

Scroll the table sideways to see every column →

ICB comes from ODS rather than from the assessment, so it survives where sector does not — which is why these rows can be placed geographically but not by sector.

Read this finding with

• A registration with nothing published may be an abandoned sign-up, a duplicate, an organisation that registered and then found it was out of scope, or one that simply has not filed. The register does not distinguish these and neither does this study.
• This is the single figure that most clearly cannot be cut by sector. The study brief expected a sector-level never-published count; it does not exist.

Why the register cannot measure supplier compliance

This study set out to count how many NHS suppliers hold a current data-security assessment. The register cannot answer that question, and showing why is a more useful result than a number would have been. There is no stable supplier population on the register: the label has been rewritten twice, the only published definition of it — NHS England's 2024-25 organisation-types guidance, which defines the version 6 to 8 label 'IT Supplier' and not the version 9 label 'Supplier' — covers only large suppliers, and smaller suppliers are filed alongside charities in a bucket they cannot be separated from.

The four labels below occupy non-overlapping version ranges, so they are successive names for overlapping but not identical populations, and each is lapsed or current by construction. 'Supplier' exists only in the 2026-27 cycle, so it cannot contain a lapsed organisation. 'IT Supplier' exists only in versions 6 to 8, so it cannot contain a 2026-27 filer. NHS England maps the oldest label, 'Company', to 'Other' rather than to 'Supplier', and 'Company' was in any case a catch-all containing hospitals and sole traders.

Scroll the table sideways to see every column →

Three of these four are lapsed or current purely because of when the label existed. “Supplier” appears only in the 2026-27 cycle, so no row carrying it can be lapsed; “Company” and “NHS Business Partner” were withdrawn before 2025-26 opened, so no row carrying either can be current. NHS England’s 2024-25 organisation-types guidancemaps both of the older labels to “Other”, not to “Supplier”.

The population the brief expected does not exist

This study was commissioned to count 1,279 registered suppliers. The four supplier-era labels come to 1,824 between them, and every combination of them was tested against that figure. No subset of the supplier-era labels sums to 1,279. The briefed population does not exist on the register. The pre-registered number is published here and used nowhere else in the study.

The best figure the register can give, and why it is not a supplier compliance rate

Pooling “Supplier” with its immediate predecessor gives 787 entries that have published at least once, of which 21.73% (171 of 787) have no assessment from 2025-26 or later; restricted to entries still Active in NHS ODS it is 21.22% (156 of 735). 97.84% of those rows arrived through the pooling. The figure is published with its warning attached rather than withheld, and it should not be quoted as a measure of supplier compliance. Even at face value it does not support the premise the study started from: suppliers do not stand out from the rest of the register.

Two structural reasons sit behind that. NHS England’s 2024-25 organisation-types guidance— the most recent edition published at the snapshot date, which opens “This document defines the organisation types within the Data Security and Protection Toolkit in 2024-25” — reserves the label in force for versions 6 to 8, “IT Supplier”, for firms with 50 or more staff and £10m or more turnover, and sends everyone smaller to “Other”. That document contains no standalone “Supplier” type, and no published source we collected defines the version 9 label at all, so carrying the threshold across to it is our inference rather than NHS England’s rule. Either way the smaller suppliers are mixed into a bucket of 12,041 entries with charities and NHS business partners (37.89% (4,562 of 12,041) of which have no current assessment) from which they cannot be separated. And NHS ODS cannot rescue the definition either: of the self-declared suppliers that resolve there, the most common primary role is not a supplier role at all.

Scroll the table sideways to see every column →

Measured against the 787pooled supplier entries that have published at least once. Role descriptions are NHS ODS’s own wording. Sector is self-assigned at registration, so “Supplier” means whoever chose that label.

Read this finding with

• The pooled supplier figure is published because withholding it would be worse than publishing it with its warning attached. It is not a measure of supplier compliance and should not be quoted as one.
• Even taken at face value, it does not support the premise this study started from. Suppliers do not stand out from the rest of the register.
• NHS ODS cannot rescue the definition. Of the self-declared suppliers that resolve in ODS, the most common primary role is not a supplier role at all.

By sector, with the pooling made explicit

A sector cut is weaker evidence than it looks, because the sector label on a row is frozen at the cycle in which the organisation last published. Retired labels are therefore lapsed by construction. Every figure below pools retired labels into their present-day equivalent first, is computed only among entries that have published at least once (n = 87,824), and carries the share of its rows that came in from a retired label so a reader can see how much work the pooling is doing.

Scroll the table sideways to see every column →

Sector denominators exclude never-published rows by construction, because the register reveals no sector until an assessment is published: the sector table is computed on 87,824 entries, not 93,260, and is therefore not comparable with the whole-register headline. These label families did not exist before the 2025-26 cycle, so no row carrying one can be lapsed. Their rates are artefacts of the register's vocabulary and are shown only so the table is complete. 19 retired labels have no current assessment at all for the same reason in reverse, which is why everything here is pooled before it is counted.

The pooling, row by row

5 of the 20mappings are NHS England’s own published mapping — its 2024-25 organisation-types guidance says “This has replaced several previous categories, including: AQP Clinical, AQP Non-Clinical, Charity/Hospice, Company, NHS Business Partner and Prison.” — and the rest are inferred by us from the label wording and the version range each label occupies, and marked inferred_renaming on every row of the published dataset

Scroll the table sideways to see every column →

The label is self-assigned, and it often disagrees with NHS ODS

The sector on a row is chosen by the organisation. NHS ODS records a primary role independently. Where the two disagree, the sector label is the weaker of the two, and this is how far they disagree. Of the 315 entries that call themselves NHS trusts, 64.44% (203 of 315) carry the NHS ODS primary role NHS TRUST. Fewer than two thirds of the entries that call themselves NHS trusts carry the ODS role NHS TRUST. The rest are sites, independent-sector providers and social care records: 203 of the 315 rows pooled into this label carry that role. No published count of NHS trusts in England was collected for this study, so the comparison made here is with ODS rather than with the world.

Scroll the table sideways to see every column →

Read this finding with

• Both the pooled and the unpooled counts are published. A reader who rejects our inferred mappings can recompute from the raw labels.
• The sector figures exclude every never-published entry, because those rows carry no sector. They are therefore not comparable with the whole-register headline.
• These are self-assigned labels. They record what an organisation said it was when it last filed, and they frequently disagree with what NHS ODS records the same organisation as. The role mix for each sector is published so the disagreement is visible.
• Two labels in the table are current by construction, because the label itself did not exist before the 2025-26 cycle. They are marked and should not be read as sectors that are doing well.
• The 'OES Independent Provider' row is a large outlier we could not explain from any published source. It is reported as an open question in its own right and is not used in any headline.

By Integrated Care Board

Across the 36 named Integrated Care Boards recorded on the register, the share of registered entries with no current assessment runs from 13.17% (NHS Kent and Medway Integrated Care Board, n = 2,210) to 27.09% (NHS West and North London Integrated Care Board, n = 4,795). No source collected for this study states how many Integrated Care Boards exist in England, so this is the count of boards that appear on the register, not a statement that every board is here. This is the only cut in the study that is not circular, because the board on a row is refreshed from NHS ODS rather than frozen at the last assessment.

The spread across boards is real but modest, and it is not a ranking of how well any board is run: a board does not control whether a registered organisation files, and the mix of organisation types differs between them. Coverage is the limit to watch. 72.83% (67,919 of 93,260) of registered entries have a board recorded at all, and the missing share varies sharply by sector, so boards are not strictly like-for-like.

Scroll the table sideways to see every column →

Board names are NHS ODS’s own wording, taken from the register’s column “Integrated Care Board (where available, from ODS)”. Tables and charts print that wording as it comes, in upper case; running prose title-cases it, because capitals mid-sentence read as emphasis on the body named, which is not what any figure here says. The last row is not a board: it is every entry with no board recorded, reported separately for the reason given above, and its whole-register figure is not comparable with the boards above it — restricted to entries still Active in NHS ODS it reads 31.12%(3,662 of 11,766) rather than 63.04%.

Where the boards are missing, and from which sectors

Scroll the table sideways to see every column →

Scroll the table sideways to see every column →

Read this finding with

• The spread across boards is real but modest. It is not presented as a ranking of how well any board is run: the boards do not control whether a registered organisation files, and the mix of organisation types differs between them.
• The entries with no ICB recorded are less likely to have a current assessment than any named board, and they are a large group. Much of that gap is closure rather than geography: 12,906 of the 12,913 entries marked Inactive in NHS ODS sit in this bucket. Restricted to entries still Active on both sides the gap roughly halves, to 31.12% against 20.34%. They are reported on their own and never folded into a geography.
• ICB coverage varies by sector, so boards whose registered population leans towards a sector with poor ICB coverage are measured on a different subset. The missingness table is given so this can be checked.

What was published, and when

Of the 63,469 entries with a current assessment, 90.37% recorded 'Standards met' and 8.46% 'Standards exceeded'. Publication clusters hard against the deadline: 64.07% of the 62,119 entries whose latest assessment is a 2025-26 one published it in June 2026, and 36.03% in the final week.

Scroll the table sideways to see every column →

Measured against the 63,469 registered entries whose most recent assessment is from 2025-26 or later, and against the 87,824 that have published at least once. “Standards met” is the ordinary result. “Standards exceeded” does not mean the same thing in every sector and is counted here only as a published assessment; this study counts publication and recency, not the strength of an outcome.

Filing clusters against the deadline

NHS England’s toolkit help states the rule plainly: “You must however ensure that your organisation has published at least one assessment by the deadline of 30 June every year”. Of the 62,119 registered entries whose most recent published assessment is a 2025-26 (version 8) one with a publication date, 91.11% (56,599 of 62,119) were published on or before 30 June 2026, 64.07% (39,802 of 62,119) in June 2026 alone, 36.03% (22,379 of 62,119) in the final week and 12.99% (8,069 of 62,119) on the deadline day itself. 8.89% (5,520 of 62,119) arrived after it. This counts the most recent assessment on each row, not every assessment ever filed. A row whose organisation filed in May 2026 and again in September 2026 shows only the later one, so these are the dates of assessments that are still the organisation's latest, not a complete record of filing behaviour in the cycle.

What each cycle looks like on the register

Scroll the table sideways to see every column →

These look like a time series and are not one: the register publishes only each organisation’s most recent assessment, so a row appears against the cycle it last filed in, not against every cycle it ever filed in. The threshold this study uses — version 8 or later — is the most consequential judgement in it. Version 9 opened in late August 2026, a month before this snapshot, and 1,350 entries had already filed under it, so requiring version 9 would be an unfair test. The Status field encodes cycle and outcome together; all 35 of its distinct values were enumerated from the data rather than assumed. The Status field encodes cycle and outcome in one string. All values were enumerated from the data rather than assumed. 'Entry level' is a real outcome that occurs only in the earliest cycles; a parser assuming four outcomes would mis-bucket it.

Read this finding with

• 'Standards exceeded' means different things in different sectors and is counted here only as a published assessment.
• The timing figures describe the most recent assessment on each row, not every assessment filed in the cycle.
• The lapse-depth table shows that the lapsed group is not one thing: some stopped last year, some stopped in the toolkit's first cycle.

What we could not explain

Two things in this data are clear, large, and unexplained by anything published. They are set out here with their numbers rather than left out or dressed up as findings.

Scroll the table sideways to see every column →

Neither open question is used in any headline, and neither is presented as a judgement about the organisations concerned. As its own category, never folded into a geography and never presented as a region's performance.

Read this finding with

• Neither is used in a headline, and neither is presented as a judgement about the organisations concerned.

Registered is not the same as required

The DSP Toolkit is information standard DAPB0086, published under section 250 of the Health and Social Care Act 2012, and the requirement is broad. The register is not a list of who is required to comply: it is a list of who registered. Nothing published by NHS England states how many organisations in any sector are required to register, so no denominator for the required population exists, and this study does not construct one.

The toolkit is not optional for the organisations it reaches. NHS England’s help page puts the hook in a contract: “Completion of the DSPT is therefore a contractual requirement specified in the NHS England Standard Conditions contract”. The clause is General Condition 21.2 of the NHS Standard Contract and it binds the Provider. A sub-contracted supplier is reached through the Provider's own due-diligence duty, not directly. But the register is still a list of who signed up, and the gap between the two is large: 214,335 of the 306,926 NHS Organisation Data Service records carry no row on it, 137,503 of them still Active. The two populations are not like-for-like and the gap reads larger than it is. The DSP Toolkit is an England scheme — its own organisation-types guidance says organisation types are reviewed 'against the prevailing NHS and Local Authority structures in England' — while ODS is UK-wide and also carries Isle of Man records. At least 2,619 of the records with no row on the register (2,222 of them Active) are identifiably outside England from their ODS primary role alone — Scottish and Northern Ireland GP practices, Welsh local health boards and their sites, Isle of Man directorates — and the true number is larger, because most ODS role descriptions name no nation. Beyond that, most of these records are not organisations that ought to have registered at all: ODS contains sites, branches, prescribing cost centres and schools, and a headquarters assessment can cover its sites. The count is given to show the scale of what the register does not see, not as a count of non-compliance.

Scroll the table sideways to see every column →

The ten largest roles only. This table is here to show the scale of what the register does not see, not to count non-compliance — most of these records are sites, branches, prescribing cost centres and schools, and a headquarters assessment can cover its sites. The two populations are also not like-for-like on geography: the toolkit is an England scheme and NHS ODS is UK-wide and carries Isle of Man records. 2,619 of the records with no row on the register (2,222 of them Active) are identifiably outside England from their ODS primary role alone, and the true number is larger because most role descriptions name no nation.

Read this finding with

• This distinction decides what the study can say. Everything here is 'of the organisations registered on the toolkit'.
• There are consequences on paper. Information standard DAPB0086 states that it is 'published under Section 250 of the Health and Social Care Act 2012, as amended by the Health and Care Act 2022, and persons subject to this information standard must comply with the information standard where it is relevant and may be subject to enforcement action if they fail to do so within the required timeframes', and its scope reaches 'All organisations which provide support services directly to an NHS organisation'. What no source collected for this study shows is any record of enforcement action having been taken, or any automatic penalty that follows from not publishing. The NHS cyber security supply chain charter, which is a separate thing, is explicitly voluntary and self-declared.

What was cross-checked, where we disagree with others, and what a checker should attack

How much the register moves

The register refreshes continuously, so a census of it is a photograph. A second complete pull was taken 10 minutes after the first and compared row by row on Status and on Date Of Publication. That window is short — the toolkit's help says the organisation search is updated every ten minutes — so it can show that no bulk republication happened during collection and nothing more than that. The two pulls are 10 minutes apart — 2026-09-25T09:06:54Z and 2026-09-25T09:17:23Z — and the toolkit's own help says the organisation search is refreshed every ten minutes, so this check shows only that no bulk republication happened during collection. It is not a measure of how much the register moves over a day, and nothing here should be read as one. Over that window 1 of 93,260 rows changed status, 2 changed publication date (2 rows changed on either field), and no organisation code was added or removed. Only Status and Date Of Publication were compared; the other columns were not. The register is live, so every figure in this study is dated to the first pull and a later read will differ. The file hash differs between the two pulls, so verification has to run against the stored snapshot rather than a fresh download.

Scroll the table sideways to see every column →

Status and Date Of Publication were the fields compared; the other columns were not. The interval is ten minutes and the toolkit’s own help says the organisation search is updated every ten minutes, so this check can show that no bulk republication happened during collection and nothing beyond that. It is not a measurement of how much the register moves over a day.

Pre-registered measures, and whether they reproduce

Scroll the table sideways to see every column →

Any pre-registered headline that does not reproduce within its stated tolerance is cut, not caveated. Tolerance 0.1 percentage points unless a measure states otherwise. The CSV alone is sufficient to recompute every one of them, and the analysis makes no network request.

Where this study disagrees with its own brief, or with other published work

• How many suppliers are on the DSP Toolkit register? This study's brief, pre-registered before collection — 1,279 (inferred from the search page's pagination) · This study, from the register export — 17 carry the present-day 'Supplier' label and 770 its predecessor 'IT Supplier'; 1,824 carry any supplier-era label including the retired 'Company' and 'NHS Business Partner' (a count of the Primary Sector field on all 93,260 rows). No subset of the supplier-era labels sums to 1,279. The pre-registered figure is reported here and is not used anywhere in the study. The counts from the export are published, with the warning that none of them is a supplier population.
• What share of registered suppliers has no assessment from 2025-26 or later? This study's brief, pre-registered before collection — 51.8% (662 of 1,279) (a pre-collection estimate) · This study, pooled Supplier label — 21.73% (171 of 787) ('Supplier' pooled with its version 6-8 predecessor 'IT Supplier', among entries that have published at least once). The pre-registered figure does not reproduce and is not published as a finding. Neither figure is a measure of supplier compliance, for the reasons set out in the supplier section.
• How many registered suppliers have never published an assessment? This study's brief, pre-registered before collection — 398 (31.1% of 1,279) (a pre-collection estimate) · This study, from the register export — not derivable, for any sector (the never-published set and the 'No Sector Identified' set are the same 5,436 rows). The claim is dropped entirely rather than softened. A whole-register never-published figure is published in its place, with the explanation of why it cannot be broken down.
• What share of GP practices and local authorities on the register has no current assessment? This study's brief, pre-registered before collection — GP practices 15.2%, local authorities 21.6% (pre-collection estimates) · This study, pooled labels — general practice 13.95% (971 of 6,961), local authorities 20.59% (257 of 1,248) (retired labels pooled into their present-day equivalent, among entries that have published at least once) · This study, present-day label only, no pooling — general practice 9.69%, local authorities 20.59% (the raw Primary Sector label, which is the circular reading). All three are given. The pooled figures are the ones used in the sector table; the unpooled ones are published beside them so the effect of the pooling is visible. The pre-registered estimates do not reproduce and are not used.
• How compliant is adult social care? Digital Care Hub, July 2026 — almost 76.5% of CQC-registered adult social care services in England had an up-to-date DSPT at the 30 June 2026 deadline (a CQC denominator: services that never registered on the toolkit are counted as non-compliant) · This study, register denominator — 75.04% of the 35,087 social care entries on the register that have published at least once have an assessment from 2025-26 or later (a register denominator: organisations that never registered are invisible). These measure different populations and cannot be reconciled. Both are given with their denominators. The Digital Care Hub figure is the stronger measure of the sector because it has a denominator; this study has no such denominator for any sector and does not pretend to.
• How many community pharmacies had filed? Pharmacy Magazine, June 2026, before the deadline — 7,409 of 10,293 pharmacies in England had yet to file their 2026 toolkit assessment (a pre-deadline snapshot against a count of pharmacies in England, taken from the article's headline and meta description because the body is behind a registration wall) · This study, three months after the deadline — 28.72% (4,503 of 15,678) of pharmacy entries on the register that have published at least once have no assessment from 2025-26 or later (a post-deadline census with a register denominator). Different date, different denominator and different question. Both are given. The denominators differ by more than half: this study counts 15,678 pharmacy entries on the register against that article's 10,293 pharmacies in England, and the likeliest reason is the mechanism this study warns about elsewhere — the toolkit's own help describes headquarters assessments for 'Social Care, Pharmacy or Optician organisations' under which 'the list of sites related to the HQ will be displayed', and ODS carries PHARMACY HEADQUARTER as a role in its own right. The two numbers are not measuring the same population. The gap between a pre-deadline and a post-deadline reading is a further reason to date every figure.
• How many sectors does the register have? The toolkit's own public search filter — 16 options (the sector filter on the organisation search page) · The register export, same day — 36 distinct values (the Primary Sector field on all 93,260 rows, including retired labels the filter no longer offers). The export's vocabulary is used, because the filter cannot reach every row. The discrepancy is itself the evidence that sector labels are frozen at the last assessment.
• Which cycle is the current one? This study's brief — 2025-26 (version 8) is the current cycle (written before collection) · This study, from the register — 2025-26 is the most recently closed cycle; 2026-27 (version 9) is open and 1,350 entries have already filed under it (publication dates on the register). 'Current' is defined as version 8 or later and the brief's wording is corrected throughout. Requiring version 9 a month after it opened would be an unfair test.

The headline this study was briefed to produce — 51.8% (662 of 1,279) of registered suppliers with no current assessment, and 398 (31.1% of 1,279)that had never published one — is refuted on three counts and is not published as a finding. It is kept here, beside the figures that replaced it, so the change is visible rather than quietly dropped.

Things a checker should try to break

• The version-8 threshold. Recompute with version 9 as the cut and the picture inverts; the study says why that would be unfair, and a checker should decide whether that reasoning holds.
• The sector pooling. Fifteen of the twenty mappings are our inference. Recompute the sector table unpooled — both versions are published — and see how much changes.
• The ODS-Active adjustment. It assumes an Inactive ODS record means the organisation no longer needs an assessment. That is an assumption, not a fact, and the unadjusted figure is published beside it for that reason.
• The claim that no supplier population exists. Every supplier-era label count is published; try to build 1,279 from them.
• The two open questions. If a published source explains the 'OES Independent Provider' result, or establishes the direction of the missing-ICB effect, the study is wrong to leave them open and should be corrected.

How to check this study

• Rerun scripts/research/nhs-dsp-toolkit-supplier-compliance-2026/analyse.py against the stored snapshot in data/research/nhs-dsp-toolkit-supplier-compliance-2026/. It makes no network request. The CSV, this JSON and the README are rewritten and should be byte-identical apart from the 'built' timestamp.
• Verify the source export against its recorded sha256, d87a279bc9f7a6d1fc508708097cb02abf2f064ae62afa0992ea14c1fb0ee5ec. A fresh download will NOT match: the register is live and changed by one row within 25 minutes of collection. Verification has to run against the stored snapshot, or accept drift and restate the date.
• Recompute every pre-registered metric from nhs-dsp-toolkit-supplier-compliance-2026.csv alone, using the how_to_recompute string on each one. The CSV is sufficient for all of them.
• Check that current + lapsed + never_published equals 93,260 exactly.
• Check that the set of codes with status_raw == 'Not Published' is identical to the set with primary_sector_raw == 'No Sector Identified'. If that ever stops being true, the sector caveats need rewriting.
• Check that every retired sector label's maximum observed version is below 8, which is what makes the unpooled sector cut circular.
• Re-enumerate the distinct Status values from the raw export and check the count against the JSON. If the source vocabulary has changed, the parser is written to stop rather than guess.
• Audit the prose for the registered-versus-required distinction: every figure must be qualified 'of the organisations registered on the toolkit'.
• Audit the prose for any sentence that implies a named organisation, or any organisation, is insecure. There should be none, and no organisation on the register should be named at all. The only organisation names anywhere in the outputs are the 36 Integrated Care Boards, which the register carries as a geography label on a row.
• Audit the licence wording. The DSP Toolkit is Crown copyright with a free-reproduction permission. If the page, the README or this JSON anywhere calls it the Open Government Licence, that is an error.
• Check that no registered organisation's name and no postcode appears in the CSV. The only names in it are the Integrated Care Board names in the icb column, which is the register's own commissioning-geography label.

What to audit in the sector table

• Any sector whose rate is driven by pooling: check pct_from_a_retired_label on each row.
• Any sector marked current_by_construction being read as good performance.
• Any sector with small_n set being quoted as a rate.
• Any sector whose ODS role mix shows the label means something other than it says.

What was measured, when, and how

The words this study uses, and what they mean here

Scroll the table sideways to see every column →

Limits

• This is a census of a register, not of a sector. It counts organisations that registered on the NHS Data Security and Protection Toolkit. NHS England's guidance describes registration as something an organisation does for itself — 'To register, you will need an email address and your organisation's ODS code' — and nothing published by NHS England identifies which rows are on the register by requirement rather than by choice, or lists the organisations required to complete the toolkit. An organisation that never registered leaves no row and is invisible to this study. Every figure here is 'of the organisations registered on the toolkit', and nothing in this study says anything about the 214,335 ODS records that are not on the register.
• No current assessment does not mean insecure. It means no assessment from the 2025-26 cycle or later appears on the public register on 25 September 2026. An organisation may hold Cyber Essentials Plus, ISO 27001 or a current assessment under another regime; it may have merged, closed, or stopped handling NHS data altogether. 45.61% of the entries whose last assessment predates 2025-26 are marked Inactive in NHS ODS, against 1.55% of current ones — so for a large part of the lapsed group the organisation itself appears to be gone.
• Nothing in this study is a security test. No system was scanned, probed or accessed. The only measurements are of what a public register publishes.
• No organisation on the register is named, and no finding is attached to a registered organisation by name. The register publishes organisation names and this study reproduces none of them, no email address and no postcode. The 36 Integrated Care Boards are named, because the board is the commissioning-geography label NHS ODS puts on a row rather than the identity of the row, and a board figure is a figure about the entries in a geography rather than about the board. The organisation code is not anonymous and is not presented as if it were: it is an identifier that resolves to an organisation name through the public ODS API this study documents and uses, so the published file is a code-level extract of an already-public register, released so the census can be reproduced. Some entries on the source register are sole traders whose organisation name is a person's name, which is the reason names are dropped. The file must not be republished as a named list of organisations without a current assessment.
• The unit is a registered entry, not an organisation and not an assessment. NHS England lets a headquarters publish one assessment and apply it across its listed sites, so one assessment can make many rows current, and a large organisation can appear many times.
• Sector is self-assigned at registration, not assigned by NHS England: 'you will be asked to choose the most appropriate sector for your organisation'. 'Supplier' means whoever chose that label.
• The self-assigned label frequently disagrees with what NHS ODS records the same organisation as, and where they disagree the label is the weaker of the two. Of the 315 entries pooled into the 'NHS Trust' label (294 of them carry that label raw, the rest arriving from the retired trust-type labels), 64.44% carry the ODS role NHS TRUST; the rest are sites, independent-sector providers and social care records. The ODS role mix for every sector is published alongside the sector table so this can be checked rather than taken on trust.
• Two sector labels are current by construction, because the label itself did not exist before the 2025-26 cycle. No row carrying one can be lapsed. They are marked in the data and must not be read as sectors that are performing well.
• One large result is unexplained. The 'OES Independent Provider' label has far the highest share with no current assessment of any present-day label, and no published source collected for this study explains why. It is reported as an open question with its numbers, is not used in any headline, and is not presented as a judgement about those organisations.
• The supplier population cannot be isolated, and this is the study's central negative finding rather than a footnote. The staff and turnover threshold is published against the retired label, not the present-day one, and the distinction matters. NHS England's 2024-25 organisation-types guidance — the most recent edition published at the snapshot date, which opens 'This document defines the organisation types within the Data Security and Protection Toolkit in 2024-25' — reserves the label in force for versions 6 to 8, 'IT Supplier', for companies with '50+ staff, a turnover of £10m+' that supply digital goods and services, and tells everyone smaller to register as 'Other (including charities, some companies and NHS Business Partners)'. The word 'Supplier' does not appear as a standalone organisation type anywhere in that document, and no published source collected for this study defines the version 9 label 'Supplier' at all, so carrying the threshold across to it is our inference and is flagged as one wherever it appears. Smaller suppliers are therefore mixed into a bucket of 12,041 entries alongside charities, hospices and NHS business partners, and cannot be separated. NHS ODS cannot separate them either: it has no IT-supplier role, and commercial suppliers sit under the generic RO157 NON-NHS ORGANISATION.
• A sector label is frozen at the cycle in which the organisation last published, so it is not a live attribute. Retired labels are therefore lapsed by construction: 19 of the register's sector labels have no assessment from 2025-26 or later at all, because the label itself was withdrawn before that cycle opened. Every sector figure in this study pools retired labels into their present-day equivalent before counting, and publishes both the pooled and the unpooled counts and the mapping used. Even pooled, a sector rate is weaker evidence than the ICB cut.
• No never-published figure can be given for any sector. The register reveals a sector only once an assessment is published: all 5,436 rows with the status 'Not Published' carry 'No Sector Identified', and all 5,436 rows carrying 'No Sector Identified' have the status 'Not Published'. The two sets are identical. Any sector-level never-published figure, including the one this study's own brief expected, is not computable from this source.
• Sector denominators exclude the never-published rows by construction. Every per-sector figure is computed among entries that have published at least once (n = 87,824), not against the whole register.
• The ICB cut is the sound one, because the Integrated Care Board on a row is supplied from NHS ODS at export time — the column is headed 'Integrated Care Board (where available, from ODS)' — rather than frozen at the last assessment. But coverage is uneven: ICB is present on only 67,919 of 93,260 rows (72.83%), and the missing share varies sharply by sector, so boards are not strictly like-for-like.
• The entries with no ICB recorded are a category in their own right, not a residual. 63.04% of them have no current assessment, against a range of 13.17% to 27.09% across the named boards — but that comparison is not like-for-like, because this bucket holds 12,906 of the register's 12,913 ODS-Inactive entries. Restricted to entries still Active in NHS ODS on both sides it is 31.12% (3,662 of 11,766) against 20.34% for entries that do carry a board, and that is the figure to quote. They are reported separately and never folded into a geography.
• 'Current' is defined here as an assessment published in the 2025-26 (version 8) cycle or later. That is a judgement, and it is the most consequential one in the study. 2025-26 is the most recently closed cycle; its deadline of 30 June 2026 has passed. The 2026-27 (version 9) cycle opened in late August 2026, a month before this snapshot, and 1,350 entries have already filed under it — so requiring version 9 would be an unfair test and is not what is measured.
• The study brief called 2025-26 'the current cycle'. On the data it is the most recently completed cycle, and the wording has been corrected throughout.
• The register is live and refreshes continuously, and NHS England's toolkit help says the organisation search is updated every ten minutes. A second complete pull 10 minutes after the first returned the same 93,260 organisation codes, with 1 row's status changed and 2 rows' publication dates changed, and none added or removed. That window is too short to say how much the register moves over a day; it shows only that no bulk republication happened during collection. Every figure is dated to 25 September 2026 at 09:06 UTC and a later read will differ.
• A published status is not frozen. The toolkit's own improvement-plan notice for 2025-26 (dsptoolkit.nhs.uk/News/Improvement-Plans-25-26, 7 May 2026) says that after a plan is reviewed, 'if approved, your 25-26 DSPT status will be amended to Approaching Standards. Once you have implemented all of the actions in your improvement plan, your 25-26 DSPT status will be amended to Standards Met.' So a row read on one date can differ from the same row read later for reasons that have nothing to do with a new assessment.
• A status can be absent from the public site for reasons of process. The toolkit's news item of 12 July 2025 (dsptoolkit.nhs.uk/News/24-25-DSPT-Status), headed '24-25 Data Security and Protection Toolkit Status for large NHS Organisations will not be displayed during the month of July 2025', says it 'will impact NHS Trusts, Integrated Care Boards (ICBs), Commissioning Support Units (CSUs), Arms Length Bodies' and that 'their DSPT status will not be visible on the external DSPT site during the month of July 2025', to give those organisations time to agree improvement plans. This snapshot is outside that window, but it is a reason not to read any single sector's figure as a security judgement.
• The outcome 'Standards exceeded' does not mean the same thing everywhere. On NHS England's toolkit help, for the CAF-aligned Category 1 bodies it means exceeding forecast achievement levels; for everyone else it is 'Standards met' plus a recorded Cyber Essentials Plus certificate. It counts as a published assessment either way, and this study counts publication and recency, not the strength of the outcome.
• The publication date is the date the most recent assessment was published, not the date it was completed, and not a full record of filing history. Interim publications exist mid-cycle. A row shows one date; an organisation may have filed several times.
• The register carries more rows for some sectors than those sectors plausibly have members — 294 entries carry the raw label 'NHS Trust', and 315 once the retired trust-type labels are pooled in — because dissolved and merged bodies persist as rows, and because a headquarters and its sites can each hold a row. That is why every headline is given both across the whole register and restricted to organisations still Active in NHS ODS.
• 669 registered codes (0.72%) do not resolve in the ODS organisation list used here, and why is not established. They cannot be checked for activity and are reported as their own group, never merged into either side. The join is case-folded on both sides, because the register prints the code as the organisation typed it and ODS publishes it upper-cased: 66 register codes are not all upper case and a case-sensitive join would have discarded every one of them; 35 of them do resolve in ODS once the case is folded.
• The comparison with adult social care is not like-for-like and is reported as a disagreement, not resolved. Digital Care Hub measures adult social care against a CQC denominator, so services that never registered on the toolkit count as non-compliant. This study has no such denominator for any sector and measures only what is on the register.
• We found no published count of DSP Toolkit compliance for the supplier sector, for general practice, for local authorities or for the register as a whole. That is a negative search result, not proof that none exists. It is not described as a first.
• The source is Crown copyright with a free-reproduction permission, not the Open Government Licence. The permission is conditional on accurate reproduction and on not using the material in a misleading context, which is why the registered-versus-required distinction is stated on every figure rather than kept in a footnote.

Prior work, and what this adds

We found no published count of DSP Toolkit compliance for the supplier sector, for general practice, for local authorities, or for the register as a whole. Adult social care is counted annually by Digital Care Hub against a CQC denominator, and community pharmacy ad hoc by Pharmacy Magazine from a third-party tool reading the same register. Searches across NHS England, NHS England Digital, the toolkit's own news and help sections, standards.nhs.uk, gov.uk statistics collections, the National Audit Office, sector bodies and trade press turned up nothing for the other sectors or for the register as a whole. This is not described as a first. The absence of prior work is a negative search result, not proof that none exists.

• A dated, whole-register census rather than a single-sector count.
• The separation of a lapsed assessment from none at all, which no prior work collected here makes.
• The join to NHS ODS, which shows how much of the missing-assessment count is entries whose organisation code is no longer marked Active.
• The finding that the register's own structure prevents it from measuring supplier compliance, with the evidence set out so it can be checked.

• Record numbers of care services have DSPT (Digital Care Hub, 2026-07-01): Toolkit completion across CQC-registered adult social care services in England at the 30 June 2026 deadline, against a CQC denominator. How ours differs: Adult social care is the one sector where compliance is reported, and it is reported against a denominator of registered services, so a service that never signed up to the toolkit counts as non-compliant. No equivalent register exists for any other sector, so this study counts only organisations that appear on the toolkit register and says so on every figure. It also covers the whole register rather than one sector, cuts by Integrated Care Board, and separates a lapsed assessment from none at all. Licence: All rights reserved by the publisher; cited as prior work only.
• Over 70pc of English pharmacies yet to file DSPT as deadline looms (Pharmacy Magazine, 2026-06): A pre-deadline count of community pharmacy filings. The article body is behind a registration wall and was not retrieved, so only the headline and the page's own meta description were readable: 'With the end of the month deadline looming, 7,409 out of 10,293 pharmacies in England have yet to file their 2026 DSPT.' How ours differs: It is the closest prior work in subject, and on the readable evidence it is a pre-deadline count for one sector against a count of pharmacies in England. Nothing further can be said about its method, its outcome breakdown or its sourcing, because the body was not accessible. Ours is a post-deadline census of the whole register that separates lapsed from never-published, cuts by sector and by Integrated Care Board, and publishes the underlying rows. Licence: All rights reserved by the publisher; cited as prior work only.
• Building NHS Resilience to Ransomware: Central Oversight and Shared Capability (Cyber Security Research Group, King's College London, 2026-03): A qualitative assessment of the toolkit regime rather than a count: 'There are in practice few meaningful consequences for not reaching the minimum standard.' How ours differs: Qualitative assessment of incentives versus a dated census of published status. We cite it for the incentive point and supply the counts it does not contain. Licence: All rights reserved by the publisher; cited as prior work only.
• Government cyber resilience (HC 546) (National Audit Office, 2025-01-29): Whether government's cyber resilience work keeps pace with the threat. It explicitly excluded the NHS, adult social care and departmental supply chains from its fieldwork. How ours differs: Cited as evidence of the gap, not as a source of numbers. It contains no toolkit figures. Licence: Open Government Licence v3.0.
• Cyber security charter for suppliers to the NHS — signatory list (NHS England and the Department of Health and Social Care, list last updated 2026-09-03): Which suppliers have voluntarily declared they will meet eight cyber commitments, one of which is to maintain at least 'Standards Met' on the toolkit. It publishes names, not counts, and NHS England says it is self-declared and not a guarantee of current compliance. How ours differs: The charter records an intention; the register records a published assessment. We count what was published. Licence: Open Government Licence, current version, as NHS England states it.

Sources

• NHS Data Security and Protection Toolkit — organisation search CSV export (NHS England, retrieved 2026-09-25T09:06:54Z) — Every row of the public register: code, status, date of publication, primary sector and Integrated Care Board. The organisation name column was read only to check the field count and was then discarded; it appears in no output. Licence: Crown copyright with a free-reproduction permission — NOT the Open Government Licence. Required attribution: “Contains material from the NHS Data Security and Protection Toolkit, Crown copyright, reproduced free of charge under the terms published at https://www.dsptoolkit.nhs.uk/Home/TermsAndConditions.” Robots: Permitted. https://www.dsptoolkit.nhs.uk/robots.txt contains only Allow directives, including Allow: /OrganisationSearch, and no Disallow at all. Access: One anonymous GET. No authenticated access was attempted at any point. HEAD returns HTTP 405 on this endpoint, so only GET works. SHA-256 of what was fetched: d87a279bc9f7a6d1fc508708097cb02abf2f064ae62afa0992ea14c1fb0ee5ec.
• NHS Data Security and Protection Toolkit — organisation search CSV export, second pull (NHS England, retrieved 2026-09-25, later the same morning) — The same export again, to measure how fast the register moves. Licence: Crown copyright with a free-reproduction permission. Required attribution: “Contains material from the NHS Data Security and Protection Toolkit, Crown copyright.”
• NHS Organisation Data Service — ORD API, organisation list (NHS England, retrieved 2026-09-25) — 306,926 organisation records: code, active/inactive status and primary role. Postcode is present in the source and was deliberately not read, because a postcode against a sole trader is a home address. Licence: Open Government Licence. NHS England states that ODS data is published under the Open Government Licence and asserts no version number, so no version is cited here.. Required attribution: “Contains information from NHS England, licenced under the current version of the Open Government Licence” Robots: Permitted. https://directory.spineservices.nhs.uk/robots.txt returns HTTP 404, so nothing is disallowed. Access: Paged GETs at about three requests a second on a single connection, with an identifying User-Agent. Limit caps at 1,000; Offset=0 returns HTTP 406, so the first page omits Offset.
• NHS Data Security and Protection Toolkit — help: overview (NHS England, retrieved 2026-09-25) — How registration works, the 30 June deadline, the contractual hook, the statement that sector is chosen by the registering organisation, the headquarters-assessment mechanism under which one assessment covers many listed sites, and the statement that the organisation search is 'updated every 10 minutes'. Licence: Crown copyright with a free-reproduction permission. Required attribution: “Contains material from the NHS Data Security and Protection Toolkit, Crown copyright.”
• NHS Data Security and Protection Toolkit — help: organisation types (NHS England, retrieved 2026-09-25) — The 50-staff and £10m turnover threshold that decides whether a company registers under the retired label 'IT Supplier' or under 'Other', and the published mapping of five retired labels into 'Other'. Licence: Crown copyright with a free-reproduction permission. Required attribution: “Contains material from the NHS Data Security and Protection Toolkit, Crown copyright.” The page is the 2024-25 edition: it opens 'This document defines the organisation types within the Data Security and Protection Toolkit in 2024-25' and is headed 'DSPT 2024-2025 for IT Suppliers and Independent Providers who are designated Operators of Essential Services'. Its organisation-type list contains 'IT Supplier' and no standalone 'Supplier'. Every claim taken from it is attributed to the label it is published against.
• NHS Data Security and Protection Toolkit — news: 24-25 DSPT status for large NHS organisations will not be displayed during July 2025 (NHS England, retrieved 2026-09-25T09:12:21Z) — The statement that for CAF-aligned organisations 'their DSPT status will not be visible on the external DSPT site during the month of July 2025', and the list of sectors it affected. This is the evidence for the limit that a status can be absent for reasons of process. Licence: Crown copyright with a free-reproduction permission. Required attribution: “Contains material from the NHS Data Security and Protection Toolkit, Crown copyright.” SHA-256 of what was fetched: 7b22659b1e14c20487f1ac99307329c4e8be6fc739ae6a12be735f2b38fc5047.
• NHS Data Security and Protection Toolkit — news: improvement plans 2025-26 (NHS England, retrieved 2026-09-25T09:12:22Z) — The statement that an approved improvement plan amends a published 2025-26 status to 'Approaching Standards', and a completed one to 'Standards Met'. This is the evidence for the limit that a published status is not frozen. Licence: Crown copyright with a free-reproduction permission. Required attribution: “Contains material from the NHS Data Security and Protection Toolkit, Crown copyright.” The stored snapshot is redacted at source under this desk's house rules: individual NHS staff names and staff email addresses were replaced with placeholders before storage. Nothing quoted here touches the redacted text.
• NHS Data Security and Protection Toolkit — terms and conditions (NHS England, retrieved 2026-09-25) — The verbatim licence wording quoted throughout this study: the Crown copyright clause, the attribution clause, and the third-party materials clause restricting donated help-article material to personal or non-commercial use. Licence: Crown copyright with a free-reproduction permission. The path /Help/TermsAndConditions returns HTTP 500; /Home/TermsAndConditions works. The third-party materials clause was read and does not bite here: the four passages quoted from help articles are NHS England's own operational guidance, not donated material.
• Data Security and Protection Toolkit — information standard DAPB0086 (NHS England, Data Coordination Board, retrieved 2026-09-25) — The statutory basis, the version 8.0.0 identifiers and the 30 June 2026 full conformance date, the 'Applies to' wording that defines who the standard covers, and the enforcement sentence quoted in the limits. Licence: Crown copyright.
• NHS Standard Contract 2026/27, General Conditions (NHS England, retrieved 2026-09-25) — General Condition 21.2, the clause that makes completing the toolkit a contractual requirement, and GC21.16.2, the Provider's supply-chain due-diligence duty. Licence: Open Government Licence, current version, as NHS England states it. Required attribution: “Contains information from NHS England, licenced under the current version of the Open Government Licence”

Known limits of the method itself

• The register is an engagement list. Nothing here measures the population required to comply, because nobody publishes it.
• A row is a registered entry, not an organisation and not an assessment.
• Sector is self-assigned and frozen at the last publication.
• ICB is present on only 72.83% of rows and its coverage varies by sector.
• 669 registered codes do not resolve in the ODS organisation list used here and so cannot be checked for activity. The join is case-folded on both sides; a case-sensitive one would have discarded 35 real matches.
• A published status can be amended after publication, so the register is not a permanent record of what was filed.

Downloads: CSV, 93,260 rows (one row per registered entry on the DSP Toolkit register) · README · JSON. SHA-256 of the CSV: 5284c1b02cac4121e7472e0dae6e7f904fd065b23f0ecf87b06750799bdaddae. Contains material from the NHS Data Security and Protection Toolkit, Crown copyright, reproduced free of charge under the terms published at https://www.dsptoolkit.nhs.uk/Home/TermsAndConditions, joined to NHS Organisation Data Service data published under the Open Government Licence. No registered organisation's name, and no email address or postcode, appears in any output of this study, and ODS postcodes were deliberately never read. The only organisation names in any output are the 36 Integrated Care Boards in the icb column, which is the register's own commissioning-geography label and identifies no registered entry. The organisation code is not anonymous, and this study does not claim it is: it is an identifier that resolves to an organisation name through the public ODS API this study documents and uses. The published file is therefore a code-level extract of an already-public register, released so the census can be reproduced. Some entries on the source register are sole traders whose organisation name is a person's name, which is why no name is reproduced here. No finding in this study is attached to any individual code, and the file must not be republished as a named list of organisations without a current assessment.

Questions about the DSP Toolkit register

The practical work behind a toolkit assertion

This study counts publication and recency; it says nothing about the controls behind any assessment. The assertions organisations usually struggle to evidence are the mechanical ones — a risk register for unsupported systems, a tested restore, and email authentication that actually enforces. Our DSP Toolkit submission guide walks through the ten standards, and the tools below cost and size the work each one implies.

More on the same ground: IT compliance and assurance · IT for healthcare organisations · IT for the public sector · keeping end-of-support servers secure · third-party hardware maintenance.

Related Servnet research: UK public sector email security census 2026 · seven years of UK data breach reports to the ICO · where UK government cloud data is declared to go · what public bodies’ own FOI answers say about Windows Server 2016 · the security fixes a non-ESU Windows 10 PC has missed · more Servnet research