Cyber Essentials for NHS suppliers: what the NHS expects and how to get certified

If you supply the NHS, whether you provide care under an NHS contract, sell software or services to a trust, or handle NHS data as a subcontractor, you will sooner or later be asked whether you hold Cyber Essentials. This guide explains why the NHS asks, what the difference between Cyber Essentials and Cyber Essentials Plus means for you, how the certification fits alongside the Data Security and Protection Toolkit (DSPT), and how to get certified without disrupting the business.

Why the NHS asks for Cyber Essentials

Cyber Essentials is the UK government-backed scheme, run by IASME on behalf of the National Cyber Security Centre, that certifies an organisation has five basic technical controls in place. The NHS asks for it for three connected reasons.

Government procurement policy. Since 2014, central government has required suppliers bidding for contracts that involve handling personal information or providing certain ICT services to hold Cyber Essentials. NHS bodies and the frameworks they buy through have widely adopted the same expectation, so it appears in tender questionnaires, framework onboarding and contract schedules.

Supply-chain risk. Several of the most damaging cyber incidents to affect the NHS in recent years reached it through suppliers. Trusts, integrated care boards and NHS England now treat supplier assurance as part of their own security, and Cyber Essentials is the simplest common baseline they can ask every supplier to meet.

The DSPT. Every organisation with access to NHS patient data completes the DSPT annually, and its technical assertions map closely onto the Cyber Essentials controls. Some DSPT organisation profiles ask directly whether you hold a current Cyber Essentials certificate, and for some categories of supplier it is treated as expected rather than optional. Check the requirements for your own DSPT profile and for the specific contract or framework you are working under, because expectations vary and change.

Cyber Essentials or Cyber Essentials Plus?

	Cyber Essentials	Cyber Essentials Plus
Method	Self-assessment questionnaire, verified by an assessor	The same questionnaire plus a hands-on technical audit
What is tested	Your answers about the five controls	The controls themselves: vulnerability scans, device checks, email and browser tests
Typical timescale	Days to a few weeks	Weeks, and the audit must be completed within three months of the basic certificate
Cost	Lower	Higher, reflecting assessor time
When the NHS asks for it	The baseline for most suppliers and providers	Increasingly required where a supplier handles patient data, connects to NHS systems or provides IT services

Read the requirement carefully. Many NHS contracts say “Cyber Essentials” and accept the basic certificate. A growing number, particularly for IT suppliers, digital health products and anyone with a connection into NHS networks, specify Cyber Essentials Plus. If the wording is ambiguous, ask the commissioner or framework before you certify, because the Plus audit has to follow the basic assessment within a fixed window and you do not want to do the basic assessment twice. Our comparison of Cyber Essentials and Cyber Essentials Plus goes into more detail.

How Cyber Essentials fits with the DSPT

The two are complementary rather than alternatives:

• The DSPT is an information governance and security self-assessment covering people, process and technology, completed annually by 30 June. It is about how you handle NHS data as a whole.
• Cyber Essentials is a certification of five specific technical controls, valid for twelve months.

Holding Cyber Essentials makes the technical parts of the DSPT much easier to evidence, because you have already demonstrated patching, secure configuration, access control, malware protection and firewall rules to an assessor. Our guide to the DSPT and Cyber Essentials together maps the overlap. For most NHS suppliers and providers the sensible order is Cyber Essentials first, then the DSPT, then renewals of both on a calendar.

Who this applies to

• Care providers delivering NHS-funded care: care homes, home care agencies and supported living. The DSPT is the main requirement, and Cyber Essentials is increasingly asked for by integrated care boards and local authorities alongside it. See our Cyber Essentials for care providers guide.
• Primary care: GP, dental, optometry and pharmacy practices. The DSPT applies to all of them; Cyber Essentials strengthens it and is sometimes required by contract.
• IT, software and digital health suppliers, including managed service providers and SaaS vendors with NHS customers. Expect to be asked for Cyber Essentials Plus, and often for more besides.
• Professional services, facilities and other suppliers who handle NHS staff or patient data in any form.

Getting certified: a practical route

1. Define your scope. Decide whether the certificate covers the whole organisation or a clearly separated part of it. Whole-organisation scope is simpler to explain to an NHS buyer.
2. Inventory your devices and cloud services. Every laptop, phone, server and cloud service in scope needs to be known and supported by its vendor. Unsupported operating systems are the most common reason Cyber Essentials fails.
3. Fix the gaps before you apply. Patching within 14 days, multi-factor authentication on cloud services, removing local admin rights, secure configuration and a working firewall policy.
4. Complete the self-assessment honestly. An assessor reviews it; answers that describe what you intend to do rather than what you do will fail.
5. For Plus, prepare for the audit. External vulnerability scan, sample device checks, and tests of how your systems handle malicious email attachments and downloads. The audit must take place within three months of the basic certificate.
6. Put the renewal on the calendar. Certificates last twelve months. NHS buyers notice lapsed certificates, and re-certifying is faster when the controls have been kept up.

Common mistakes NHS suppliers make

• Certifying the wrong level. Getting basic Cyber Essentials when the contract required Plus, or vice versa.
• Scoping out the devices that matter, such as home workers’ laptops or the server that holds the NHS data.
• Letting the certificate lapse between contract renewals, then scrambling before a tender.
• Treating Cyber Essentials as the whole answer. It is a baseline. NHS buyers may also ask for the DSPT, ISO 27001, evidence of data protection compliance and specific contractual security clauses.

How we can help

We take NHS suppliers and providers through Cyber Essentials and Cyber Essentials Plus from scoping to certificate, fix the gaps that would otherwise fail the assessment, and line the work up with your DSPT so the same evidence serves both. If a contract or framework has asked you for a certificate and you are not sure which one, or how it fits with your other obligations, explore our Cyber Essentials service, Cyber Essentials Plus service and DSPT service, or get in touch for a free, no-obligation conversation.