Cyber Essentials for NHS suppliers and the DSPT

Do NHS suppliers need Cyber Essentials?

Yes, for relevant procurements. NHS bodies fall under PPN 014, so higher-risk contracts in procurements commenced from 24 February 2025 require Cyber Essentials, Cyber Essentials Plus or equivalent controls from suppliers.

PPN 014 names NHS bodies alongside central government departments, their executive agencies and non-departmental public bodies. Where a contract involves citizens' personal information, staff personal information, ICT systems holding OFFICIAL data or the day-to-day business of government, the buyer must require the technical controls, and evidence of a certificate or equivalent is required before award. Where certification is required, the supplier must renew it annually for the contract's duration.

Question A1.10 on the self-assessment asks why you are applying, and A1.10.2 asks for the government contracting organisation and contract number. An NHS trust is a government contracting organisation for this purpose.

What is the DSPT and how does it relate?

The Data Security and Protection Toolkit is NHS England's annual online self-assessment against the National Data Guardian's 10 data security standards. Completing it is a contractual requirement under the NHS Standard Contract, and it remains Department of Health and Social Care policy that every organisation processing NHS patient information provides assurance through it. The 2026-27 requirements (version 9) were published on 2 October 2026 and the submission deadline is 30 June 2027. NHS trusts, ICBs, arm's length bodies, CSUs, operators of essential services and genomics organisations complete a version aligned to the NCSC Cyber Assessment Framework (CAF version 4.0); IT suppliers, other organisations and GP practices complete assertions and evidence items.

The link to Cyber Essentials runs through Cyber Essentials Plus, not the basic certificate. In the 2026-27 version 9 requirements for IT suppliers (Category 2), 26 of the 102 mandatory evidence items are marked exempt for organisations holding Cyber Essentials Plus, covering anti-malware, patching critical and high-risk vulnerabilities within 14 days, boundary and personal firewalls, password controls, removal of unnecessary accounts, device builds and remote access. For care providers, GP practices and other category 3 and 4 organisations, three mandatory items are exempt: 4.2.4 (removing or amending people's access), 6.2.1 (antivirus on every device) and 9.1.1 (networking component default passwords changed). The certificate must cover all of your health and care data processing to be recorded in the Organisation Profile.

For organisations other than NHS trusts, ICBs, ALBs, CSUs, genomics organisations and operators of essential services, a 'Standards Met' assessment plus a current Cyber Essentials Plus certificate displays as 'Standards Exceeded'. The DSPT also asks organisations to check their IT suppliers' certification at evidence item 10.2.1, and its guidance names Cyber Essentials, ideally Plus, as suitable.

Checked against the DSPT help pages and the 2026-27 version 9 requirements spreadsheet on dsptoolkit.nhs.uk on 3 November 2026.

Which NHS suppliers need what?

A supplier that never touches NHS data or systems, for example a catering contractor, may fall outside PPN 014 and outside the DSPT. A supplier that hosts a clinical application, provides IT support to a trust or processes patient records is inside both: Cyber Essentials (often Plus) for the contract and the DSPT for the data.

Do NHS suppliers need Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials is the baseline. The buyer specifies Plus where it judges the risk higher, as PPN 014 Annex B advises. For an IT supplier, Plus also exempts 26 mandatory DSPT evidence items and turns 'Standards Met' into 'Standards Exceeded'. Plus adds an independent audit of a sample of devices and cloud services on the same scope as your Cyber Essentials certificate. IASME requires it within three months of that certification, and it takes two to five weeks rather than one to two.

Which DSPT items does Cyber Essentials Plus exempt for an IT supplier?

The 26 exempt items in the 2026-27 category 2 requirements, grouped by what they cover:

The other 76 mandatory items, including data protection, staff training, incident management and supplier due diligence, still need their own evidence.

How do you keep both cycles aligned?

The DSPT deadline is 30 June each year and Cyber Essentials lasts 12 months. Suppliers that align the two, renewing Cyber Essentials Plus a month or two before the DSPT deadline, reuse the same evidence pack for both and have a current certificate to record when they publish. The certificate must be current when you record it in the Organisation Profile. The second year is quicker than the first because the evidence already exists.

How much does Cyber Essentials cost an NHS supplier?

The IASME scheme fee is £320 to £600 ex VAT by headcount. With Precursor, Cyber Essentials is from £1,500 with the fee included and Cyber Essentials Plus from £3,000. The DSPT itself has no fee, but the evidence work is shared, so certifying first usually shortens the DSPT submission.