Cyber Security for Social Care Providers

Why social care providers act on cyber

Care providers hold some of the most sensitive personal data there is — about vulnerable adults and children — often on tight budgets and with little in-house IT. Funders, commissioners and the NHS increasingly want to see it protected.

• The DSPT is expected of you. If you handle health or care data or use NHS systems (like NHSmail), you're expected to complete the Data Security and Protection Toolkit annually. Care homes, domiciliary and community providers fall into the toolkit's community-provider category.
• Local-authority and NHS contracts. Commissioners increasingly make DSPT ‘Standards Met’ a condition of the contract; without it, work can stall.
• Safeguarding data. A breach involving people in your care is a safeguarding and CQC problem, not just an IT one.
• Funded support exists. Sector programmes such as Better Security, Better Care have historically offered free help and funded routes to Cyber Essentials for adult social care — we'll point you to what's available before you spend anything.

DSPT and Cyber Essentials, in the right order

For 2025/26 the DSPT (version 8) is more demanding: it's aligned to the NCSC Cyber Assessment Framework and wants evidence that controls work, not just a policy in a drawer. Cyber Essentials is a clean way to get the technical basics — MFA, patching, access control, backups — into shape, which then makes the DSPT far easier to evidence. We run them in a sensible order.

How we help

We start with a plain-English gap review against your DSPT category, fix the controls that move the most outcomes (MFA, access, patching, backups, an asset register), and assemble an audit-ready evidence pack. Most small providers reach ‘Standards Met’ in a few weeks.

Common questions