This comprehensive guide is designed for NHS suppliers, healthcare vendors, IT and digital service providers, and any organisation involved in NHS procurement. If you are searching for information about Cyber Essentials NHS or Cyber Essentials for NHS suppliers, you are in the right place. This guide explains what Cyber Essentials is, why it matters for NHS procurement, and how it impacts your organisation’s ability to supply products or services to the NHS.
Cyber Essentials is the UK government’s minimum cybersecurity standard, aimed at protecting organisations from common online threats. It includes five key technical controls: firewalls, secure configuration, user access control, malware protection, and patch management. These controls form the foundation of the scheme and are essential for demonstrating basic cyber hygiene.
In this guide, you will learn:
- Who needs Cyber Essentials or Cyber Essentials Plus to supply the NHS
- How Cyber Essentials aligns with NHS Supply Chain requirements and the Data Security and Protection Toolkit (DSPT)
- What happens if you do not hold Cyber Essentials Plus
- How Cyber Essentials interacts with DSPT, DTAC, and ISO 27001
- Common scope challenges for healthcare suppliers
- How to plan and achieve certification before a tender
Whether you are a health tech company, medtech supplier, diagnostics provider, or a new entrant to NHS frameworks, this guide will help you navigate the requirements and prepare for successful certification.
Key Takeaways
- NHS Supply Chain asks suppliers in scope of Procurement Policy Note 014 (PPN 014) to demonstrate Cyber Essentials Plus, or equivalent assurance against the same criteria. That is NHS Supply Chain’s position, not a legal requirement on every NHS supplier.
- You are in scope if you process NHS Supply Chain personal data or supply IT or digital products and services. Routine business email alone does not bring you in.
- In-scope suppliers without Plus are asked to complete an Information Security Third Party Questionnaire (ISTPQ) and a risk-based decision follows. ISO 27001 cannot be offered as an alternative.
- Cyber Essentials Plus, the Data Security and Protection Toolkit (DSPT) and DTAC (developed by NHS Digital and DHSC) answer different questions, and none replaces the others.
If you supply the NHS, the short answer is this: NHS Supply Chain asks suppliers in scope of PPN 014 for Cyber Essentials Plus; you are generally in scope if you process its personal data or supply IT or digital products and services, and suppliers without Plus may be asked to complete an ISTPQ.
This guide covers that requirement and who it reaches, what happens if you do not hold Plus, how Cyber Essentials sits alongside the DSPT and DTAC, the scope problems that catch healthcare suppliers, and how to plan certification before a tender. Cyber Essentials itself is the UK government-backed certification for five basic technical controls; for the scheme in full, see what is Cyber Essentials?
It is written for suppliers to the NHS: IT and digital vendors, health tech companies, pathology and diagnostics providers, and the medtech, consumables and services suppliers on NHS Supply Chain frameworks who have never needed a cyber certificate before. It also goes into broader assurance programmes that may include DSPT, DTAC, ISo 27001 and other cybersecurity frameworks of relevance to the healthcare sector across the UK.
Does NHS Supply Chain require Cyber Essentials Plus?
Cyber Essentials Plus is not a universal requirement for every NHS supplier. However, NHS Supply Chain’s stated position is that suppliers within the scope of PPN 014 should demonstrate Cyber Essentials Plus. If an in-scope supplier does not hold it, NHS Supply Chain may use the ISTPQ and make a risk-based decision. Individual trusts and frameworks may specify a different requirement.
The policy behind it is PPN 014 (gov.uk), which applies to central government departments, executive agencies, non-departmental public bodies and NHS bodies, and replaced PPN 09/14 and PPN 09/23 from 24 February 2025. The note itself allows either level: contract requirements should “include either Cyber Essentials or Cyber Essentials Plus certification”, and its Annex B says Plus “should be used when there is a higher risk of cyber security threats”.
NHS Supply Chain made its choice on 6 August 2025 in “Cyber Security: Expectations of Suppliers” (NHS Supply Chain): every supplier in scope is asked to demonstrate compliance with Cyber Essentials Plus, or to show that it meets the same criteria.
The reason is independent verification. The basic level is a self-assessment marked by an assessor; Plus tests the same technical controls designed to protect organisations against common online threats. Basically, it takes into account Internet-borne common cyber threats. The CE Plus level includes a layer of verification from an IASME-qualified assessor on a sample of your devices and on every cloud service. For a buyer giving a supplier access to personal data, or connecting its products to clinical systems, that difference is the point. You can obtain a quote for Cyber Essentials Plus certification from an accredited certification body like Cyphere.
Healthcare suppliers can be a route into NHS systems or a point of failure in service delivery. The June 2024 ransomware attack on pathology provider Synnovis, which delayed more than 11,000 outpatient and elective appointments (NHS England), illustrates the operational impact of a supplier incident, although Cyber Essentials is designed to protect against the most common cyber threats rather than guarantee protection from every attack.
Next, we explain who is considered in scope for these requirements.
Who is in scope?
PPN 014 reaches well beyond IT suppliers because the catalyst for this requirement is the data you handle and the products you supply, not the sector you are in.
Is Cyber Essentials mandatory?
NHS Supply Chain’s page puts a supplier in scope where it handles or processes NHS Supply Chain personal data (including that of employees, customers or other suppliers), or supplies IT or digital products and services. Routine email correspondence with other organisations does not, on its own, count as processing sensitive data.
|
Your situation |
Likely position |
|---|---|
|
You supply IT or digital products or services |
Cyber Essentials Plus expected |
|
You process or have ongoing or privileged access to NHS Supply Chain personal data |
Cyber Essentials Plus expected |
|
You only exchange routine business emails |
Not in scope on that basis alone |
|
You are in scope but do not hold Plus |
ISTPQ and risk-based review may follow |
|
You handle patients’ personal information, such as home addresses |
DSPT may also apply |
In practice, that often catches a medical device that stores patient data, a services company holding staff records, and any vendor whose product connects to NHS systems. For other public sector buyers, see is Cyber Essentials mandatory?
Now that you know who is in scope, let’s look at what happens if you do not hold Cyber Essentials Plus.
What happens if you do not hold Plus?
Where an in-scope supplier does not hold Cyber Essentials Plus, NHS Supply Chain asks it to complete an Information Security Third Party Questionnaire (ISTPQ), which it also uses to check DSPT scope.
For new suppliers this happens at the Supplier Questionnaire stage of procurement; for existing suppliers it has been rolled out since 8 September 2025. A risk-based decision then follows, depending among other things on the products and services supplied, rather than automatic exclusion.
The same page says basic Cyber Essentials “will be sufficient if details/evidence are shared to provide the assurance in place of an external audit”. A Plus certificate may provide the external assurance NHS Supply Chain is seeking, and in our experience it is the quicker route, but suppliers should follow the specific instructions in the questionnaire and tender documents.
A valid Cyber Essentials Plus certificate provides independent evidence for the Cyber Essentials requirement, although the buyer may still request other information.
ISO 27001 does not change this. NHS Supply Chain’s page is explicit: “Procurement Policy Note 014 does not cover ISO 27001, nor can ISO 27001 be offered as an alternative to Cyber Essentials Plus.” PPN 014 itself says ISO 27001 holders do not automatically conform to Cyber Essentials. Keep the ISO 27001 certificate; add the Plus audit. Cyber Essentials vs ISO 27001 covers why the two differ.
Next, we’ll explore how Cyber Essentials Plus, DSPT, and DTAC differ and how they work together.
Cyber Essentials Plus, DSPT and DTAC: what is the difference?
They answer different questions and are assessed differently, and none replaces the others. The one thing they share is that Cyber Essentials sits inside both NHS frameworks: the DSPT uses it as evidence, and DTAC asks for the certificate outright.
The Data Security and Protection Toolkit (DSPT) is NHS England’s annual online self-assessment against the National Data Guardian’s ten data security standards: personal confidential data, staff responsibilities, staff training, managing data access, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection and accountable suppliers (NHS England assessment guides, linked). Suppliers with access to patient data or NHS systems complete it on the DSPT portal and are published with a status: Standards Met, Standards Exceeded, Approaching Standards or Standards Not Met. NHS trusts and other large NHS organisations now complete a version aligned to the NCSC’s (National Cyber Security Centre) Cyber Assessment Framework; suppliers complete the version built on the ten standards.
Cyber Essentials aligns with the Data Security and Protection Toolkit (DSPT). Cyber Essentials Plus evidence speaks to three of the ten (managing data access, unsupported systems, IT protection); the other seven are about governance, people and process, so the certificate supports a DSPT submission without replacing it.
The Digital Technology Assessment Criteria (DTAC) is the assessment framework for digital health technologies, meaning software, apps and SaaS “designed or marketed to improve health outcomes, or how the health and care system functions”. Version 2.0, dated 24 February 2026, has been the required version since 6 April 2026. Sections C1 to C4 (clinical safety, data protection, technical security, interoperability) are pass or fail; section D (usability and accessibility) is scored, not pass or fail.
The data protection section asks for the DSPT: question C2.1 requires “Standards Met or Exceeded status for the current year, or previous year” wherever your organisation “has or will have direct or remote access to any patient data or NHS systems”. The technical security section (C3) then asks for:
|
DTAC question |
What it asks for |
Pass criterion in the official form |
|---|---|---|
|
C3.1 |
Your Cyber Essentials certificate |
“a valid Cyber Essentials certificate”, in date and “validated against the IASME database”; the scope “should include all systems and services under the supplier’s control that support the development, production, use and operational management” of the product |
|
C3.2 |
Whether you have signed the Cyber Security Charter for Suppliers to the NHS |
A “Yes” lets you skip the rest of C3; a “No” means answering C3.3 to C3.6 |
|
C3.3 |
For internet-accessible products, an external penetration test summary from the previous 12 months covering the OWASP Top 10 |
Third-party testing with “no vulnerabilities that score 7.0 or above” on CVSS |
|
C3.4 |
Adherence to the DSIT and NCSC Software Security Code of Practice |
Confirmation that development aligns to the code and commits to its principles |
|
C3.5 and C3.5.1 |
A plan for MFA on all account types, and MFA on supplier accounts with privileged access to the product |
Confirmation: MFA “must be enforced on all privileged access connections to the product, and on all remote access connections” |
|
C3.6 |
Defined logging and reporting requirements |
Confirmation that logging, such as audit trails of all access, is in place |
Two things to take into account if you are a digital health supplier. DTAC asks for a Cyber Essentials certificate at either level, so standard Cyber Essentials certification (self-assessment questionnaire based) passes C3.1; NHS Supply Chain’s Plus requirement is the stricter of the two, and a Plus certificate satisfies both.
In our experience, Plus is becoming the norm for healthcare suppliers regardless, because buyers in regulated sectors give more weight to its independent audit and insurers look more favourably on it when pricing cyber cover.
DTAC’s penetration test is a separate deliverable from the Plus audit: the audit scans and tests your organisation’s devices and cloud services, while C3.3 wants an OWASP Top 10 test of the product itself.
|
Requirement |
Who it applies to |
What it shows |
How it relates to Cyber Essentials Plus |
|---|---|---|---|
|
Cyber Essentials Plus |
Suppliers in scope of PPN 014 (NHS Supply Chain’s position) |
Independently tested technical controls |
The baseline NHS Supply Chain asks for |
|
Data Security and Protection Toolkit (DSPT) |
Suppliers with access to patient data or NHS systems, and NHS organisations themselves |
Annual self-assessment against the ten data security standards such as policies, staff training, data security measures, patch management, incident management, and systems architecture |
Separate; Plus evidence supports the data access, unsupported systems and IT protection standards only |
|
Digital Technology Assessment Criteria (DTAC) |
Suppliers of digital health technologies, assessed by the buying organisation |
Clinical safety, data protection, technical security, interoperability, usability |
C3.1 requires a valid Cyber Essentials certificate at either level; C2.1 requires the DSPT; C3.3 requires a product penetration test |
Cyphere’s DSPT audit services cover the toolkit side.
From the assessor’s desk
For healthcare suppliers, we do Cyber Essentials Plus first, then the pen test and the DSPT (if applicable) if you supply digital health technology. DSPT might be CAF aligned and may require independent assessment based on your category and organisation size.
Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere
Next, let’s address common scope problems that healthcare suppliers face when preparing for Cyber Essentials Plus.
Common scope problems for healthcare suppliers
NHS suppliers must meet the same five technical controls in both Cyber Essentials and Cyber Essentials Plus; the full list is in our Cyber Essentials Plus requirements guide. The healthcare-specific challenge is scoping.
Many of the suppliers who come to us with the questionnaire make or move physical products, and the estate that fails a Plus audit is rarely the office network. It is the parts of the business nobody thought of as IT. Secure configuration ensures systems are set up safely. Security update management keeps systems patched and up to date:
Unsupported Devices
-
Unsupported clinical, laboratory or factory-floor devices: a machine controller on an old Windows version, a label printer’s PC, a scanner workstation. Unsupported software is an automatic fail; the device has to be replaced or placed in a sub-set separated by a firewall or VLAN that blocks all internet traffic.
Shared Accounts
-
Shared accounts and devices: warehouse or shop-floor PCs logged in with one account all day, and portal or ordering accounts several people share with no MFA (multi-factor authentication) and no leaver process. User access control means access should be limited by role and need.
Cloud Services Out of Scope
-
Cloud services, personal devices or MSP-managed systems left out of the scope: a SaaS tool one department signed up to, sales staff’s personal phones with work email, and systems run by an IT support company. The requirements are clear that “All accounts that your organisation owns are in scope, even when those accounts are used by a third party, such as a supplier, contractor or Managed Service Provider (MSP) to manage or support your infrastructure”.
Malware protection is there to identify and immobilise malicious software on in-scope systems.
If your product runs on your own IaaS or PaaS environment, that environment is in scope, and the shared-responsibility table in the requirements sets out which controls you implement and which the provider does.
The scope wording on the certificate is what the buyer sees, so a sub-set that leaves out the part of the business doing the NHS work will not answer the question. Our Cyber Essentials scope guide covers both.
Encryption is not a Cyber Essentials requirement, and backups are not assessed, so if a tender asks about either, answer it separately rather than pointing at the certificate.
Next, we’ll walk through how to plan your Cyber Essentials certification before a tender.
How to plan cyber essentials certification before a tender
Planning for Cyber Essentials Plus certification is crucial for NHS suppliers. Here’s how to approach it:
Certification Timeline
- Start before the tender deadline: fixing unsupported devices, correcting cloud-service MFA, and arranging an audit all take time, and certification body diaries fill before major tender windows.
- Complete the basic Cyber Essentials self-assessment as the first step.
- Schedule the Plus technical audit, which must be completed within the 90-day window after the basic assessment.
Annual Renewal
- Certificates last 12 months from the day the application is assessed and marked as a pass, so annual renewal for Cyber Essentials Plus means another external audit to stay current.
- Plan your DSPT submission on the same timeline to streamline compliance efforts.
Insurance Benefits
-
CE-certified organisations also see 92% fewer cyber insurance claims, making certification beneficial beyond compliance.
NHS England recommends Cyber Essentials for securing internal networks and cloud platforms. Start as soon as an NHS opportunity is on the horizon, not when the questionnaire arrives, because cyber attacks can disrupt operations and patient care. How long Cyber Essentials takes sets out the timeline, and the cost guide the price bands; your sector does not change either.
Next, we answer some of the most frequently asked questions about Cyber Essentials for NHS suppliers.
Cyber Essentials NHS FAQs
Do all NHS suppliers need Cyber Essentials Plus?
No. NHS Supply Chain asks suppliers in scope of PPN 014 for Cyber Essentials Plus, and a risk-based decision is made where an in-scope supplier does not hold it. A trust or framework running its own PPN 014 tender may ask for either level, so read the tender; most organisations start with the basic Cyber Essentials certification before moving to Plus if a contract or risk profile requires it.
Does basic Cyber Essentials count for NHS Supply Chain?
Only if you evidence the Cyber Essentials controls yourself through the ISTPQ, which NHS Supply Chain accepts “in place of an external audit”. Cyber Essentials Plus provides that audit.
We hold ISO 27001. Do we still need Cyber Essentials Plus?
Yes, if you are in scope. NHS Supply Chain states that ISO 27001 cannot be offered as an alternative to Cyber Essentials Plus. It may still help suppliers pursuing larger NHS contracts, but it does not replace Cyber Essentials Plus where Plus is required.
What happens if we do not respond to the ISTPQ?
NHS Supply Chain does not set out a penalty on its page. It says a risk-based decision is made about in-scope suppliers without certification, and that for new suppliers the requirement sits at the Supplier Questionnaire stage, before award. An unanswered questionnaire leaves the buyer with no assurance to base that decision on.
Do GP practices, social care providers and NHS trusts need Cyber Essentials?
They usually sit on the other side of the relationship and work to the DSPT because they access NHS patient data and systems, and it is used to provide assurance that organisations are practising good data security. Cyber Essentials does not replace the DSPT for them; where the toolkit asks about the technical controls, a certificate supports the toolkit’s assurance of good data security rather than replacing it.
Does Cyber Essentials cover medical devices?
Yes, if they are in scope. A connected medical device that can reach, or be reached from, the internet has to meet the same controls as any other device, and where the manufacturer no longer supports its software, the sub-set rule applies. See our Cyber Essentials scope guide.
What happens if our certificate expires mid-contract?
You are no longer certified from the expiry date, and the IASME register shows it. For a supplier whose contract relies on Cyber Essentials Plus, that is a compliance issue with the customer. See our renewal guide for when to start.
How can a trust check whether a supplier holds Cyber Essentials Plus?
On the public IASME certificate search, which shows current certification and the level held. Our certificate check guide walks through it.
How Cyphere helps NHS suppliers
Need help preparing for Cyber Essentials Plus, the DSPT or an ISTPQ? We provide practical support through the assessment process, from reviewing your scope and identifying the issues likely to fail the audit to preparing for certification and renewal, with Plus and DSPT preparation run as one engagement around your tender deadline. Received the ISTPQ? Send it over, and we will tell you whether Cyber Essentials Plus answers it. Book an NHS supplier readiness call
Related Cyber Essentials guides
- What is Cyber Essentials?
- Is Cyber Essentials mandatory?
- Cyber Essentials vs Cyber Essentials Plus
- Cyber Essentials Plus requirements
- Cyber Essentials vs ISO 27001
- Cyber Essentials scope
- Cyber Essentials cost
- How long does Cyber Essentials take?
- Cyber Essentials renewal
- Checking a Cyber Essentials certificate
