DSPT 'Standards Met' vs 'Approaching Standards' explained

When you complete the Data Security and Protection Toolkit (DSPT), you don’t simply “pass” or “fail” — you reach a status that describes how fully you meet the expectations. The two you’ll hear about most are Standards Met and Approaching Standards. This guide explains what each means and how to move from one to the other.

Standards Met

Standards Met is the status you’re aiming for. It indicates that you’ve satisfied the mandatory assertions that apply to your organisation profile and can evidence the controls behind them. In plain terms, it says you’re handling NHS health and care data to the expected standard.

For most providers, Standards Met is the outcome that keeps NHS data flows switched on, reassures commissioners, and demonstrates good information governance to regulators and families alike.

Approaching Standards

Approaching Standards means you’ve engaged with the toolkit and completed your assessment, but you haven’t yet met every mandatory requirement. It’s a recognition of progress — you’re on the way — coupled with an acknowledgement that work remains outstanding.

Approaching Standards is not a disaster, and in some situations it’s an honest reflection of where an organisation genuinely is. But it shouldn’t be treated as the finish line. It signals to you, and to anyone reviewing your status, that there are gaps still to close.

The key difference at a glance

	Standards Met	Approaching Standards
Mandatory assertions	All satisfied and evidenced	Some outstanding
What it signals	Expected standard reached	Progress, with gaps remaining
Your next step	Maintain and renew annually	Close the remaining gaps
How partners read it	Reassuring	Acceptable but incomplete

Why you shouldn’t settle for Approaching Standards

It can be tempting to submit at Approaching Standards to “get it done”, especially near the 30 June deadline. But the outstanding items don’t disappear — they carry forward, and the status remains visible to those who rely on it. Aiming for Standards Met means:

• Your NHS system access rests on firmer ground
• Commissioners and partners see a complete picture
• You have a genuine, evidenced information-governance position
• Next year’s renewal starts from a stronger base

If the deadline is close and you can’t reach Standards Met in time, submitting at Approaching Standards with a clear plan to finish is far better than not submitting at all. See what happens if you miss the deadline for more on that scenario.

Moving from Approaching to Standards Met

Closing the gap is usually a matter of evidence rather than sweeping change. A practical route:

1. List the unmet assertions. Be specific about what each one is asking for.
2. Identify the missing evidence. Often it’s a training log, a tested backup, a leavers record or an information asset register — our DSPT evidence checklist maps these out.
3. Close the smallest gaps first. Quick wins build momentum and reduce the outstanding count fast.
4. Tackle the bigger items with a plan. Where a control genuinely needs building, put a realistic timeline against it.
5. Update the toolkit as you go. Re-confirm assertions as the evidence falls into place.

Many of the gaps that hold providers at Approaching Standards trace back to the same common DSPT mistakes — so reviewing those can shortcut your progress.

Cyber controls and your status

Several assertions relate to technical controls such as patching, anti-malware, secure configuration and access management. Holding Cyber Essentials provides independent evidence for a number of these, which can make reaching Standards Met more straightforward. Our guide on how the DSPT and Cyber Essentials relate explains the overlap.

Maintaining Standards Met year on year

Reaching Standards Met is an achievement, but it isn’t permanent — the toolkit resets each year, so the status needs re-earning at every renewal. The good news is that maintaining it is far easier than reaching it the first time. If you keep your evidence pack live and review it through the year, renewal becomes a matter of refreshing dates and confirming controls rather than rebuilding from scratch. Providers who slip back to Approaching Standards at renewal usually do so because training lapsed, a supplier changed, or a leaver’s access wasn’t removed — all avoidable with a light annual routine. Our guide to the DSPT deadline and annual cycle sets out that rhythm.

What each status means for others

It helps to remember that your status isn’t just for you — commissioners, NHS partners and, increasingly, service users and their families may see or ask about it. Standards Met sends a clear, reassuring message that you handle health and care data to the expected standard. Approaching Standards is honest and acceptable as a stepping stone, but it invites the question “what’s still outstanding, and when will it be resolved?” Being able to answer that question with a clear plan matters as much as the status itself. Transparency about where you are, paired with visible progress, builds more trust than a status alone.

Check your position

Not sure how far you are from Standards Met? Our DSPT readiness checker gives you a quick read, and the glossary explains any unfamiliar terms along the way.

How we can help

Getting from Approaching Standards to Standards Met is usually about knowing exactly what’s missing and working through it methodically. We offer a clear, fixed-fee engagement that pinpoints your outstanding assertions, helps you assemble the evidence, and supports you through to submission. If that would help, explore our DSPT service or get in touch for a friendly, no-obligation chat.