Cyber Essentials for healthcare and care providers
Who asks healthcare and care providers for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- NHS England (Data Security and Protection Toolkit); Better Security, Better Care; NHS bodies as buyers
- Typical scope
- Clinical and medical devices, Shared clinical accounts, Care workers' own phones, NHS-supplied and managed kit
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
Organisations with access to NHS patient data complete the Data Security and Protection Toolkit, which does not require Cyber Essentials but exempts some evidence items for holders of Cyber Essentials Plus. NHS bodies buying under PPN 014 can require it of suppliers. Scope includes clinical systems, care-planning apps and every staff device.
Do healthcare and care providers need Cyber Essentials?
Yes, where the work falls under one of these requirements. NHS England (Data Security and Protection Toolkit), Better Security, Better Care and NHS bodies as buyers require or expect Cyber Essentials; each source is listed below with the date it was checked.
NHS England (Data Security and Protection Toolkit)
Source checkedOrganisations with access to NHS patient data complete the DSPT each year. In the 2026-27 version 9 requirements (2 October 2026, deadline 30 June 2027), a current Cyber Essentials Plus certificate exempts 3 mandatory evidence items for care providers, GP practices and other organisations in categories 3 and 4, and 26 of 102 for IT suppliers. Basic Cyber Essentials carries no exemption (checked 3 November 2026).
Source: NHS England, DSPT 2026-27 version 9 assertions and evidence items
Better Security, Better Care
Source checkedA national programme for adult social care providers in England, run through the Digital Care Hub, that helps providers complete the DSPT and improve their data and cyber security. It promotes the DSPT rather than requiring Cyber Essentials (checked 3 November 2026).
NHS bodies as buyers
Source checkedPPN 014 tells NHS bodies to require Cyber Essentials, Plus or equivalent controls on contracts that handle citizens' personal information, in procurements from 24 February 2025 (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do healthcare and care providers need Cyber Essentials or Cyber Essentials Plus?
For the DSPT, only Cyber Essentials Plus counts: it exempts evidence items and turns a 'Standards Met' result into 'Standards Exceeded'. If no contract or toolkit benefit applies, Cyber Essentials is the baseline.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should healthcare and care providers gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Your DSPT organisation code and current toolkit status, so the certificate can be recorded in the Organisation Profile once issued.
- A list of clinical and care systems (GP clinical system, dental practice software, pharmacy system, electronic care records) and whether each is cloud-hosted or on a local server (A2.7, A2.9).
- An inventory of medical and diagnostic equipment with an attached PC, its operating system and how it connects to the network (A2.2.1, A6.7).
- The care workers' phones or tablets that run care-planning or rostering apps, and who owns each one (A2.8).
- Where an ICB, CSU or other NHS body supplies and manages devices, a written note of which devices are in your scope and who evidences their controls.
What scope problems do healthcare and care providers bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Clinical and medical devices
Imaging PCs and dental equipment controllers often run vendor-locked, unsupported operating systems. They need a sub-set with no internet access, described in A2.2.2, or they fail A6.1.
Shared clinical accounts
Nursing-station or reception PCs with one login for everyone fail the unique-credentials requirement.
Care workers' own phones
Care-planning and rostering apps on personal phones bring those phones into scope. Each needs a supported operating system and a screen lock.
Which questions do healthcare and care providers commonly fail?
Questions healthcare and care providers commonly fail include A7.2, A6.7 and A5.9. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A7.2Are all your user and administrative accounts accessed by entering unique credentials? | Shared logins on clinical desktops are a common finding in care and practice assessments. | Give every user a named account and use fast user switching or smartcard sign-in on shared workstations. |
| A6.7Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this. | Medical equipment on unsupported Windows is left on the main practice network. | Move it to a VLAN with no internet access and describe how in A2.2.2. |
| A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed? | Care workers' personal phones used for rostering and care notes are frequently left without a screen lock. | Require a passcode of at least 6 characters or a biometric through the care app's device policy or the phone settings. |
Frequently asked questions
No. The DSPT is the NHS requirement for anyone with access to NHS patient data. A current Cyber Essentials Plus certificate recorded in the toolkit exempts some evidence items, 3 of the mandatory items for care providers and GP practices in 2026-27, and the evidence gathered for Cyber Essentials covers much of the same ground on anti-malware, firewalls and passwords.
Yes if they are on a network with internet access or reach organisational data. Most cannot be updated by the practice, so the usual approach is a sub-set with no internet access, segregated by a firewall or VLAN and documented in A2.2.1 and A2.2.2.
In the 2026-27 version 9 requirements for category 3 and 4 organisations, Plus exempts three mandatory items: 4.2.4 on removing or amending people's access, 6.2.1 on antivirus on every device, and 9.1.1 on networking component passwords. The certificate must cover all of your health and care data processing to be recorded.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Android setupScreen lock and updates on care workers' phones
- iOS and iPadOS setupPasscode and supported versions
- Windows 10 support statusESU rules for older practice PCs
- Microsoft Intune setupManaging shared and mobile devices
- Cyber Essentials and the NHS DSPTThe deep page on this mandate.
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for construction and contractors
- Cyber Essentials for manufacturing
- Cyber Essentials for MSPs and IT providers
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- dsptoolkit.nhs.ukNHS England, DSPT 2026-27 version 9 assertions and evidence itemsRead on dsptoolkit.nhs.uk (opens in a new tab)
- digitalcarehub.co.ukDigital Care Hub, Better Security, Better CareRead on digitalcarehub.co.uk (opens in a new tab)
- GOV.UKCabinet Office, Procurement Policy Note 014Read on gov.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh