You do not pay NHS England a fee to submit the Data Security and Protection Toolkit (DSPT), but completing the work behind your submission uses staff time and can involve external support. Your 2026 budget should cover evidence gathering, policy updates, training and any security gaps you need to fix. Separate those activities from submission itself before you compare quotes.
How much does an NHS DSPT submission cost?
There is no universal, all-in DSPT project cost. Your total depends on the work your organisation needs, who completes it and whether you buy specialist help. A quote for reviewing answers is not equivalent to a quote that includes fixing security controls.
Start with your organisation’s applicable assessment and existing evidence. The guide to preparing for an NHS DSPT submission helps you organise that preparation before you request support.
Use this breakdown to build your 2026 budget. Treat each row as a separate responsibility, even when a supplier bundles several activities together.
| Budget component | What you need to allow for | What to clarify |
|---|---|---|
| Internal coordination | Assigning owners, gathering records and checking answers | Who manages the submission? |
| Policy work | Reviewing, updating and approving relevant documents | Are updates included or only templates? |
| Staff training | Delivering relevant training and retaining completion evidence | Who follows up incomplete training? |
| Security improvements | Addressing gaps identified during preparation | Who implements and verifies changes? |
| External support | Advice, evidence review or project coordination | What deliverables does the engagement include? |
| Assurance | Any review or audit applicable to your organisation | Is this required and separately scoped? |
| Ongoing maintenance | Keeping evidence and controls current | What happens after submission? |
Do not add every possible service automatically. Confirm what applies to your organisation, then assign each task to an owner and a budget line.
Why this matters
A submission quote can describe paperwork while leaving the underlying work with you. That distinction matters more than the headline quote.
You need answers that reflect how your organisation actually handles information. A policy document does not demonstrate that staff follow it, and a list of security actions does not demonstrate that those actions are complete.
Buy a defined outcome, not an undefined promise to handle DSPT. Ask what evidence you will have, what gaps will be addressed and what your team must still approve.
Why DSPT preparation costs vary
The toolkit is not a fixed package of consultancy work. Your preparation effort follows your organisation’s scope, evidence and security arrangements.
These factors determine the work to include in your 2026 plan:
- Applicable assessment: Confirm the requirements shown for your organisation rather than borrowing another organisation’s checklist.
- Evidence readiness: Current, accessible records need a different review from documents that must be created or reconstructed.
- Security gaps: Missing controls require implementation work, not just better wording in an answer.
- Organisational scope: Establish which services, teams, locations and systems your submission covers.
- Internal capacity: Identify who can gather evidence, make technical changes and approve the final responses.
- Assurance requirements: Check whether your organisation needs an independent review or audit, and define its scope separately.
Ask suppliers to explain which factors their proposal assumes. If those assumptions differ, the quotes are not directly comparable.
Which DSPT preparation approach fits your team?
You can organise preparation internally, use specialist support or use software to manage supporting work. These approaches can overlap; the key decision is who owns each task.
| Approach | Best for | Practical advantage | Limitation |
|---|---|---|---|
| Internal preparation | Teams with relevant knowledge and available capacity | Keeps context and decisions inside your organisation | Your staff must coordinate evidence and resolve gaps |
| Specialist support | Teams needing help interpreting requirements or reviewing evidence | Adds focused guidance and a defined review process | Delivery depends on the agreed scope and your inputs |
| Software-supported preparation | Teams managing recurring policies, evidence and actions | Gives supporting work a repeatable structure | You must check requirement coverage and retain accountable owners |
Internal preparation: best for capable teams with available time
Choose internal preparation when your team understands the applicable requirements and can produce reliable evidence. Assign a coordinator, but keep technical and operational decisions with the people who own them.
The advantage is direct access to your organisation’s context. The limitation is capacity: preparation competes with other work, and an internal coordinator cannot resolve every technical or governance question alone.
Recommendation: keep preparation internal when you have both the knowledge and the time. Do not treat staff effort as an invisible resource.
Specialist support: best for targeted expertise
Use specialist support when you need help assessing evidence, interpreting requirements or organising a defined preparation project. Specify whether the engagement includes advice, document changes, implementation support or a final review.
The advantage is focused expertise. The limitation is scope: a consultant reviewing your evidence does not automatically take responsibility for changing your systems or approving your organisation’s answers.
Recommendation: commission specialist help against named deliverables and exclusions. Keep an internal owner responsible for decisions and access to evidence.
Software-supported preparation: best for recurring coordination
Use software when you need to organise policies, actions, risks and supporting records across an ongoing compliance programme. Check the actual functions against your workflow before you select a platform.
The advantage is a structured process for repeatable work. The limitation is that software cannot approve organisational decisions or turn an inaccurate response into an accurate one.
Recommendation: assess software against your evidence workflow, not a promise of automatic compliance. Confirm any DSPT-specific coverage directly.
How do you build a DSPT preparation budget?
Build the budget from tasks before you request a bundled proposal. This makes responsibility clear and gives suppliers the same starting point.
- Confirm scope. Identify the organisation, services and systems covered, then check the applicable assessment requirements.
- Review evidence. Match existing records to the relevant requirements and check whether those records remain accurate.
- Assign actions. Separate missing documentation from controls that need implementation, then name an owner for each action.
- Define support. Decide which activities your team will complete and which need external advice or delivery.
- Approve budget. Include staff effort, purchased support, implementation work and any applicable assurance.
Define the work before you compare supplier proposals.
Record assumptions alongside the budget. State which evidence already exists, which changes remain open and which decisions need approval.
For your 2026 plan, distinguish preparation for the current submission from ongoing maintenance. Combining them into an unexplained total makes it harder to understand what you are buying.
What should a DSPT support quote include?
A useful quote defines deliverables and responsibilities. It also explains what happens when the initial review identifies work outside the agreed scope.
Ask for written answers to these questions:
- Which organisation and services does the engagement cover?
- Which assessment requirements will the supplier review?
- Does the work include reviewing evidence or producing it?
- Will the supplier update policies, or only identify changes?
- Who implements technical fixes?
- Who checks that remediation is complete?
- Does the engagement include any applicable independent assurance?
- Who approves and submits the final responses?
- What support remains available after submission?
Compare like-for-like deliverables before comparing totals. A narrowly scoped review and a preparation project with implementation support are different purchases.
Keep ownership of the final evidence and working documents clear. You need to understand and maintain the submission after the engagement ends.
What work is easy to leave outside the budget?
Evidence gathering is only part of preparation. Give implementation, approval and follow-up their own tasks rather than assuming they happen inside the document review.
Fixing the control, not just documenting it
A gap in access management, patching or incident handling needs an operational response. Updating a policy does not complete the technical change.
Identify who will perform the work and who will verify it. If an IT provider is involved, confirm whether the task falls within its existing agreement.
Getting usable training records
Training delivery and training evidence are separate tasks. Someone must identify the relevant staff, check completion records and follow up gaps.
Keep that responsibility visible. Purchasing training does not, by itself, demonstrate that the relevant people completed it.
Reviewing and approving answers
Your organisation needs to stand behind its submission. Give the appropriate owners time to check statements against actual practice before approval.
Do not leave unresolved questions for the final submission step. Record the decision, supporting evidence and responsible owner while the work is being completed.
Where does compliance automation fit?
OneClickComply is best for growing businesses seeking compliance automation across ISO 27001, Cyber Essentials and SOC 2. Its platform supports security-control auto-remediation, policy generation, risk management and trust centres.
Those functions are relevant when DSPT preparation sits alongside a broader compliance programme. OneClickComply provides compliance automation, but you should confirm DSPT-specific coverage before treating it as a submission solution.
The practical fit is managing supporting compliance work. The boundary is equally clear: OneClickComply does not remove your organisation’s responsibility to validate evidence, approve answers or check applicable assurance requirements.
Choose a platform only after you know which tasks you want it to handle. Keep unsupported requirements out of the purchasing assumptions.
Can you reduce preparation work without weakening the submission?
Yes. Reuse accurate evidence where it genuinely supports the applicable requirement, and avoid recreating documents simply because they sit in another compliance folder.
For 2026 preparation, organise each evidence item around its purpose:
- What requirement does the evidence support?
- Which service or system does it cover?
- Who owns the underlying process?
- Is the record current and approved where necessary?
- What action is needed if the evidence no longer matches practice?
Reuse evidence, not unverified answers. Existing certifications and policies can inform preparation, but you still need to check their scope and relevance to the DSPT requirement.
Keep a clear distinction between evidence you already hold and work you still need to complete. That prevents a tidy document library from hiding unfinished actions.
Frequently asked questions
One last thing
Ask every prospective supplier the same question: What will our team still need to do? The answer exposes scope differences that a headline quote does not show.
For your 2026 submission, budget around evidence you can defend and actions you can complete. Seriously Simple Cyber Compliance.