NHS Supplier Eligibility, DSPT and Bid Readiness
Before a health or care provider can win NHS work it has to be eligible to bid for it: CQC registration for the regulated activities, an ODS code, the Data Security and Protection Toolkit, insurance and financial standing, and the policy set the buyer names. Most first bids fail here, not on the writing.
Key facts at a glance
- CQC registration
- Required for each regulated activity you deliver. From 9 February 2026 CQC rejects incomplete or inaccurate applications at submission rather than querying them
- DSPT
- The Data Security and Protection Toolkit, completed annually by organisations accessing personal information in NHS systems. Version 8 published 18 September 2025, aligned to NCSC Cyber Assessment Framework v3.4
- DSPT deadline
- 30 June each year, with independent assessments for in-scope organisations completed in the January to June window
- NHS Standard Contract
- Makes DSPT completion a contractual obligation, not an optional assurance exercise
- Identifiers
- ODS code, plus performers list positions, professional registrations and controlled drugs registration where the service requires them
- Commercial assurance
- Insurance to the stated limits, financial standing against buyer thresholds, safeguarding and safer recruitment, business continuity, and a Carbon Reduction Plan above the threshold
Most first bids are lost before anything is written
A provider who is not eligible does not get a lower score. They get excluded, usually at the first compliance check, and frequently without a clear explanation of which item failed. The submission is never read. That is the single most expensive thing that happens to a first-time bidder, because the management time, the pricing work and the writing effort are all spent before the disqualification lands.
It is also the most avoidable. Every item on this page is knowable months in advance and fixable given time. None of it is fixable in the week before a deadline, which is exactly when providers discover it.
This is why we treat readiness as separate, earlier work rather than the first section of a bid. It has its own value: it makes every subsequent submission faster, and it is the difference between a business that can bid opportunistically and one that cannot.
CQC registration, and what changed in February 2026
You register for regulated activities, not for a business type. Getting the activity list wrong is a common and costly error: a provider registered for one activity that bids for a service requiring another is non-compliant from the start, and a variation takes months.
From 9 February 2026 CQC changed how applications are handled. Incomplete or inaccurate applications are now rejected at the point of submission rather than returned with questions, so a missing document is a refusal rather than a delay. For a provider working back from a contract start date, that is the difference between a timeline that works and one that does not.
Where registration is the blocker rather than the bid, start at CQC and Ofsted registration support.
The Data Security and Protection Toolkit
The DSPT is the NHS self-assessment for data security and information governance, and it catches far more organisations than expect it. Any provider accessing personal information held in NHS systems completes it annually. That includes NHSmail, GP record proxy access and most clinical system integrations, which means a great many care homes, domiciliary agencies, dental practices, pharmacies and staffing agencies are in scope whether or not they realise it. A provider under an NHS Standard Contract has a contractual obligation to complete it.
The toolkit changed substantially. Version 8, published 18 September 2025, is aligned to the National Cyber Security Centre Cyber Assessment Framework version 3.4, which moved the assessment from assertion-based answers to outcome-based ones. In practice that means evidencing that a control works rather than confirming that a policy exists, and for in-scope organisations it means an independent audit assessment against the CAF-aligned audit framework.
The submission deadline sits at 30 June, and independent assessments run in the January to June window. A provider starting in May is starting late. A provider discovering the requirement inside a tender window has already failed that tender.
Identifiers, insurance and financial standing
An ODS code from the Organisation Data Service identifies you across NHS systems and is frequently requested in submissions. Clinical services carry more: performers list positions for each clinician in dental and medical services, current professional registration, indemnity at the required level, and controlled drugs registration where applicable.
Insurance is a numbers check that providers fail on limits rather than on cover. Public liability, employers liability, professional indemnity and, for transport services, motor and passenger liability all have stated minimums that vary by buyer. Under-insured is excluded, and increasing a limit mid-tender is possible but visibly reactive.
Financial standing is arithmetic done on your filed accounts. Buyers test turnover against contract value, sometimes with a ratio cap, and look at liquidity, net assets and filing history. A provider with abbreviated or late accounts, or with turnover well below the contract value, needs either a different lot, a parent company guarantee or a consortium position. All three are solvable, and none of them are solvable in the submission window.
The policy and assurance set
Safeguarding for adults and children, safer recruitment, whistleblowing, equality and diversity, health and safety, infection prevention and control, information governance including a named data protection lead and completed impact assessments, business continuity and disaster recovery, modern slavery, and anti-bribery. Buyers ask for these by name and they are scored on substance, not on existence.
Two carry specific thresholds. A Carbon Reduction Plan is required for central government contracts above the published threshold and increasingly requested below it, covered on our Carbon Reduction Plan page. Cyber Essentials, and sometimes Cyber Essentials Plus, is a common condition where the contract involves any data handling, covered on ISO and Cyber Essentials compliance.
The mistake is downloading a template set. Evaluators read for whether the policy describes your actual operation, and a generic policy with another organisation name still in it is a marked event, not a neutral one.
Readiness first, bids second
We run a compliance gap analysis against the specific buyers and contracts you intend to bid for, and produce a list of what would disqualify or mark you down today, what it takes to close each item, and how long each will realistically take. That is a deliverable in its own right, and for most first-time bidders it is the more valuable of the two pieces of work.
Where gaps exist we close them: registration applications, the DSPT submission, the policy set written to your operation, the financial standing position and the consortium or guarantee route where the numbers do not reach.
Then, and only then, the bidding. Fixed fees, quoted separately for readiness and for bid management, because bundling them dilutes both. If you want a straight read on whether a specific tender is winnable for you as you stand today, send it to us through upload a tender or call 020 3668 5488.
Who should apply?
This page is written for organisations preparing to bid for health and care work:
Frequently asked questions
What do I need in place before bidding for an NHS contract?
CQC registration for the regulated activities you will deliver, an ODS code, the Data Security and Protection Toolkit where you access NHS-held personal data, insurance to the stated limits, financial standing that meets the buyer thresholds, and the policy set the buyer names. Clinical services add performers list positions, professional registration and indemnity.
Does my care company need to complete the DSPT?
If you access personal information held in NHS systems, including NHSmail or GP record proxy access, yes, and annually. Providers operating under an NHS Standard Contract have a contractual obligation to complete it. The deadline is 30 June, and version 8 moved the assessment to an outcome-based model aligned to the NCSC Cyber Assessment Framework.
What happens if we bid without one of these in place?
You are usually excluded at the compliance check and your responses are never evaluated, often without a detailed explanation of which item failed. The submission effort is lost entirely, which is why the readiness position is worth establishing before a tender window rather than during one.
How long does it take to become eligible?
It depends on the gap. Policies and portal registration are days. Insurance limits are days to weeks. DSPT is weeks, longer if an independent assessment is required. CQC registration is months, and since 9 February 2026 an incomplete application is refused rather than queried, which restarts that clock rather than pausing it.
Our turnover is below the contract value. Can we still bid?
Sometimes, through a smaller lot, a consortium, a subcontract position or a parent company guarantee. What does not work is bidding a contract several times your turnover with no structure behind it, because the financial standing test is arithmetic and it is applied before the quality responses are read.
What does a readiness review cost?
It is a separately quoted fixed fee, scoped to the buyers and contracts you are targeting. We keep it separate from bid management deliberately: bundling the two dilutes both, and the readiness work has value whether or not you bid this cycle. Call 020 3668 5488.
Open and upcoming framework deadlines
Verified against the contracting authority. Dates marked expected are an anchor for a round that has not published one yet, not a countdown.
Closes 21 September 2026, tomorrow.
Delayed. Tender notice now expected mid to late November 2026; enquiries close 4 December 2026; submissions 8 January 2027; award 20 October 2027; framework runs 8 December 2027 to 7 December 2031.
Find out what would disqualify you, before it does
Tell us which contracts you want to bid for. We will check your registration, assurance, insurance, financial standing and policies against what those buyers actually ask for, and tell you what to fix and in what order. Call 020 3668 5488.