Cyber Essentials for NHS Suppliers: CE, CE Plus and DSPT

Where the requirement appears

• Trust and Integrated Care Board procurement questionnaires and PQQs.
• NHS framework call-offs and Government Commercial Agency agreements used by health bodies.
• Data processing agreements where the supplier handles patient or staff personal data.
• Digital and clinical system integrations that touch NHS networks.

Cyber Essentials or Cyber Essentials Plus?

Standard Cyber Essentials clears most NHS supplier questionnaires. Cyber Essentials Plus is commonly named where you will process patient identifiable data at volume, host a clinical system, or hold privileged access into trust infrastructure. Because Plus requires a valid standard certificate first, plan both together rather than sequentially at the last minute. See CE vs CE Plus.

How it relates to the DSP Toolkit

The DSP Toolkit is an annual self-assessment against the National Data Guardian standards. It is broader than Cyber Essentials and covers policy, training and information governance as well as technical controls. Cyber Essentials does not complete the Toolkit for you, but it provides independently assessed evidence for the technical assertions – patching, access control, malware protection and secure configuration. Detail in NHS DSPT supplier requirements.

What NHS-facing suppliers get asked to prove

• MFA enforced across all cloud accounts, including shared and service accounts where technically possible.
• No unsupported operating systems anywhere in scope.
• High and critical security updates applied within 14 days.
• Administrator accounts separated and justified.
• A scope covering the actual delivery team, their devices and the cloud platforms used.

Typical timeline for an NHS bid

• Prepared supplier: standard Cyber Essentials in 24 to 48 hours.
• Needing an MFA rollout or device replacement: two to four weeks.
• Cyber Essentials Plus: one to three weeks after the standard certificate, £1,400 + VAT.

If your submission date is close, read urgent tender deadlines.