Skip to content
360 Cyber Compliance
Services Sectors Guides Tools Resources Pricing Free readiness check

DSPT: the annual deadline is 30 June — plan ahead

DSPT & cyber compliance for UK care providers — sorted.

We make the NHS Data Security & Protection Toolkit, Cyber Essentials, ISO 27001 and UK GDPR simple for care homes and GP, dental & pharmacy practices. Plain English. Fixed prices. Done remotely.

Free readiness check Check if you're DSPT ready

We reply within one working day · UK-wide, remote delivery

We help you achieve

  • NHS DSPT
  • Cyber Essentials
  • ISO 27001
  • IASME
  • PCI DSS
  • UK GDPR
One clear process — from readiness check to ongoing support.

Compliance services

Every standard a UK care or health provider is likely to need — under one roof.

All services →

DSP Toolkit (DSPT)

The DSPT is the NHS's mandatory annual self-assessment for any organisation that handles health and care data — care homes, GP, dental and pharmacy practices, and domiciliary care. We take you from 'Not started' to 'Standards Met' before the 30 June deadline, without the jargon.

Typical time
Often 2–4 weeks
Ideal for
Care & NHS-data handlers
Learn more →

Cyber Essentials

Cyber Essentials is the UK government-backed scheme (delivered by IASME for the NCSC) that proves you have the five core technical controls in place. It is increasingly required to win NHS, local-government and supply-chain contracts.

Typical time
Often 1–3 weeks
Ideal for
Any org needing baseline cyber
Learn more →

Cyber Essentials Plus

Cyber Essentials Plus adds an independent technical audit — vulnerability scans and device sampling — on top of the core Cyber Essentials assessment. It is the stronger assurance many NHS and government contracts now expect.

Typical time
Typically 2–6 weeks
Ideal for
Higher-assurance contracts
Learn more →

ISO 27001

ISO 27001:2022 is the international gold standard for managing information security. We build a right-sized Information Security Management System (ISMS) and guide you through to certification by a UKAS-accredited body.

Typical time
Typically 3–6 months
Ideal for
Growing SMEs & software firms
Learn more →

IASME Cyber Assurance

IASME Cyber Assurance is a comprehensive, SME-friendly standard that covers information security and data protection (GDPR) at Level 2. It's a cost-effective stepping stone between Cyber Essentials and ISO 27001.

Typical time
Often 4–8 weeks
Ideal for
SMEs wanting an ISO alternative
Learn more →

PCI DSS

If you take card payments, PCI DSS v4.0.1 applies. We identify the right Self-Assessment Questionnaire (SAQ) for how you process cards and get you compliant with the least possible scope.

Typical time
Varies by SAQ
Ideal for
Anyone taking card payments
Learn more →

Data Protection & UK GDPR

From gap audits and DPIAs to policies, data-processing agreements and staff training, we make UK GDPR and the Data Protection Act 2018 manageable — with the NHS Information Governance context care providers need.

Typical time
Project-based or ongoing
Ideal for
Every UK organisation
Learn more →

Outsourced DPO

Get qualified Data Protection Officer expertise without hiring in-house. We act as your outsourced DPO — monitoring compliance, advising on DPIAs, handling data subject requests and being your ICO point of contact.

Typical time
Ongoing retainer
Ideal for
Orgs needing DPO expertise
Learn more →

Trusted experience, delivered UK-wide

years in IT & compliance
20+years in IT & compliance
professional certifications
25+professional certifications
remote delivery
UK-wideremote delivery
2025 award (IDC)
NEXT CIO2025 award (IDC)

Why choose 360 Cyber Compliance?

Care & health specialists

DSPT, CQC expectations and NHS data flows are our day job, not a sideline.

Transparent fixed-fee engagements

A clear scope and price agreed up front — no open-ended day rates.

Remote delivery, UK-wide

Almost everything is done remotely, wherever you are in the country.

Award-winning expertise

Led by a BCS Fellow and NEXT CIO 2025, with 20+ years in IT, cyber security and compliance.

Practical, plain-English support

Clear guidance and templates throughout the assessment — no jargon.

Ongoing support

Annual renewals, surveillance audits and everyday advice after you are certified.

Led by an award-winning compliance team

Real people with real credentials — over 20 years each in IT, cyber security and compliance.

Name on request

Lead Consultant — IT Compliance & Cyber Security

20+ years’ experience

Our lead consultant is a creative technology leader with over 20 years’ experience aligning IT strategy with organisational goals to drive innovation, resilience and growth. They have a proven track record of turning underperforming IT functions into strategic enablers, influencing board-level decisions, and leading change across infrastructure, cyber security, digital platforms and service delivery.

Awarded NEXT CIO 2025 by IDC

  • NHS DSPT
  • Cyber Essentials & CE Plus
  • PCI DSS
  • ISO 27001
  • UK GDPR & Data Protection

Key credentials: Certified Information Systems Auditor (CISA) — ISACA · ISO 27001 Practitioner — APMG International · PCI DSS Implementation & Maintenance — Board of IT Governance.

Name on request

Senior Consultant — Information Security & Infrastructure

20+ years’ experience

A dedicated information security and network specialist with over 20 years’ experience in system administration, infrastructure and security. A natural troubleshooter, they design and run secure computing environments built around the core principles of confidentiality, integrity and availability.

  • Information security
  • Network & infrastructure security
  • Risk assessment
  • Business continuity & DR
  • Incident response

Key credentials: Certified Information Systems Security Professional (CISSP) · Associate, Institute of Information Security Professionals (IISP) · Cisco Certified Network Associate (CCNA).

Read the full team profiles →

A clear delivery process

The same structured path every engagement follows — so you always know what happens next.

  1. 1

    Discovery call

    A short, free conversation to understand where you are and what you need.

  2. 2

    Gap assessment

    We review your current position against the standard and map what is missing.

  3. 3

    Action plan

    A clear, fixed-price plan with scope, timeline and priorities against your deadline.

  4. 4

    Evidence & implementation

    We help gather evidence, write policies and put the required controls in place.

  5. 5

    Review

    We check everything against the standard before anything is submitted or audited.

  6. 6

    Submission / certification

    We support you through submission or the certification audit itself.

  7. 7

    Ongoing support

    Annual renewals, surveillance audits and day-to-day advice so you stay compliant.

Built for your sector

All sectors →

Care Homes

Residential and nursing homes handle some of the most sensitive personal data there is — and CQC, commissioners and families all expect it to be protected. We bundle DSPT, Cyber Essentials and GDPR into one plain-English programme built for care home teams.

GP Practices

GP practices and PCNs live and breathe NHS data. We keep your DSPT 'Standards Met', tighten your cyber controls and handle the information-governance detail so the clinical team can focus on patients.

Dental Practices

Whether you're NHS, mixed or fully private, dental practices process patient and payment data that needs protecting. We cover DSPT, Cyber Essentials, PCI DSS and GDPR in one coordinated package.

Pharmacies

Community and online pharmacies handle NHS data, prescriptions and payments. We get your DSPT done, your cyber controls certified and your data-protection house in order.

Domiciliary Care

Home-care agencies manage care records on the move, across many devices and carers. We make DSPT, mobile cyber security and data protection workable for a distributed workforce.

Supported Living

Supported living and specialist care providers balance person-centred records with strict confidentiality. We deliver right-sized compliance — DSPT, cyber certification and GDPR — without the enterprise overhead.

Charities

Charities and non-profits hold supporter, beneficiary and sometimes health data — often with limited IT resource. We deliver proportionate data protection and cyber certification that reassures funders and trustees without stretching your budget.

SMEs

Small and medium businesses increasingly need Cyber Essentials, IASME or ISO 27001 to win contracts and reassure customers. We provide right-sized certification and data protection without the enterprise price tag or jargon.

Software & SaaS

Software and SaaS companies are asked for ISO 27001 by enterprise customers earlier than ever. We build a right-sized ISMS, get you certified, and keep the process proportionate so it supports growth rather than slowing it.

Organisations often come to us when…

  • Your DSPT deadline is approaching and you are behind on evidence.
  • You have inherited incomplete or out-of-date compliance documentation.
  • Policies have not been reviewed for several years.
  • Staff training records are inconsistent or missing.
  • A previous consultant or IT provider is no longer available.
  • You need a certification to win or keep a contract.
  • An audit or assessment has flagged gaps you need to close.
  • You simply do not have the in-house time or specialist knowledge.

Recognise your situation? Book a free readiness check and we’ll map out the next steps.

Example engagements

Illustrative examples of the work we do — not named clients.

All case studies →
Example engagement Residential care home (~35 beds)

Helping a small care home reach Standards Met before the DSPT deadline

A residential home relied on NHSmail for GP and pharmacy correspondence but had never completed the toolkit, and its NHS data flows were at risk with the 30 June deadline approaching.

The home reached a Standards Met submission ahead of the 30 June deadline and kept its NHSmail access uninterrupted.

Read the example →
Example engagement GP practice (~9,000 patients)

A GP practice catching up on a lapsed DSPT submission

A busy general practice had let its toolkit slip after a change of practice manager, leaving a lapsed status while it depended on GP Connect and the Electronic Prescription Service every day.

The practice restored a current Standards Met status and protected its ongoing access to national NHS systems.

Read the example →
Example engagement Domiciliary care provider (~120 care workers)

DSPT for a domiciliary care provider with a mobile workforce

A home care agency whose staff worked from personal and shared mobile devices in the community struggled to show it controlled access to service-user data across a dispersed team.

The provider achieved a Standards Met submission with access controls that genuinely reflected how its mobile team works.

Read the example →

Frequently asked questions

Who do you work with?

Care homes, domiciliary care and supported living, plus GP, dental and pharmacy practices — and SMEs that need Cyber Essentials or ISO 27001 for contracts.

Is everything done remotely?

Almost all of it — DSPT, Cyber Essentials, ISO 27001, IASME, PCI DSS and GDPR are delivered remotely across the UK. Cyber Essentials Plus is remote or hybrid.

Do you publish fixed prices?

We give a clear, fixed-price quote up front for every engagement — no open-ended day rates.

When is the DSPT deadline?

The standard annual deadline is 30 June. We build in time to reach “Standards Met” comfortably before it.

Book your free readiness check

Tell us where you are and we’ll come back within one working day with clear, no-obligation next steps.

  • Plain-English, jargon-free advice
  • Fixed-price quotes — no surprises
  • Delivered remotely across the UK

By submitting you agree to our privacy policy. We never share your details.