Cyber Essentials for hospitals, social care and NHS suppliers

In short. Hospitals, care providers and NHS suppliers face three separate sets of expectations: the mandatory Data Security and Protection Toolkit, the NHS Cyber Security Charter for suppliers, and Cyber Essentials Plus where NHS Supply Chain requires it under procurement policy. The Cyber Security and Resilience Bill changes regulators’ powers but does not make Cyber Essentials a legal requirement.

Hospitals, social care providers and the companies that supply them face three separate sets of cyber security expectations, and they are often run together. The Data Security and Protection Toolkit (DSPT) is the mandatory annual assessment for NHS organisations and others handling NHS patient data. The NHS Cyber Security Charter sets out what NHS England expects of suppliers. And Cyber Essentials Plus is required of in-scope suppliers by NHS Supply Chain under Cabinet Office procurement policy. The Cyber Security and Resilience Bill, still before Parliament as of September 2026, changes regulators’ powers and supply-chain oversight but does not make Cyber Essentials a legal requirement for anyone. This guide sets out who has to do what.

Why health and care are targeted

Health and care organisations hold data that cannot be reissued like a card number, run services that cannot pause, and depend on long supply chains of software, diagnostics and outsourced services. That combination makes them attractive to ransomware groups and vulnerable when a supplier is hit. The June 2024 attack on Synnovis, a pathology provider to NHS trusts in south-east London, led to more than 10,000 appointments and procedures being cancelled, and in June 2025 King’s College Hospital NHS Foundation Trust confirmed that the attack was a contributory factor in a patient’s death. The NCSC’s 2025 Annual Review lists health among the sectors reporting the most ransomware incidents.

None of the attacks that reach the news needed novel techniques. They exploited exposed services, unpatched systems, weak credentials and suppliers with more access than they needed.

The Data Security and Protection Toolkit

The DSPT is the annual self-assessment through which organisations with access to NHS patient data show they are meeting the National Data Guardian’s standards. It is mandatory for NHS trusts, integrated care boards, commissioning support units, arm’s length bodies, independent providers designated as operators of essential services, and key IT suppliers, and it is expected of local authorities and adult social care providers that handle NHS data. Since the 2024/25 cycle it has been aligned to the NCSC’s Cyber Assessment Framework, which moved it from a checklist of controls towards an outcome-based assessment of whether risks are actually being managed.

A “Standards Met” DSPT outcome is what commissioners and NHS England look for first. Cyber Essentials does not replace it, but the two overlap heavily: the DSPT’s technical expectations on patching, access control, MFA and malware protection are the Cyber Essentials controls in different clothes, and organisations that hold Cyber Essentials Plus tend to find the technical sections of the DSPT straightforward.

The NHS Cyber Security Charter for suppliers

NHS England’s Cyber Security Charter asks suppliers to the NHS to commit to eight principles: keeping systems patched and in support; achieving Standards Met on the DSPT; deploying multi-factor authentication; 24/7 monitoring and logging; immutable, tested backups; board-level incident exercising; timely incident reporting; and secure software development where relevant. The Charter is voluntary and does not itself require Cyber Essentials, but every one of its technical principles is evidenced most simply by holding Cyber Essentials Plus, and suppliers are increasingly asked to sign it as a condition of doing business.

Where Cyber Essentials Plus is actually required

The requirement comes from procurement policy rather than health legislation. Cabinet Office Procurement Policy Note 014, effective for procurements started on or after 24 February 2025, requires Cyber Essentials or Cyber Essentials Plus for higher-risk central government contracts: those that handle citizens’ personal data, government employee data or OFFICIAL-level ICT. NHS Supply Chain applied it in August 2025, stating that all suppliers in scope of PPN 014 should demonstrate compliance with Cyber Essentials Plus. In scope means suppliers handling NHS Supply Chain personal data or supplying IT and digital products or services. ISO 27001 is explicitly not accepted as a substitute.

Individual trusts and integrated care boards set their own contract terms, and many now ask for Cyber Essentials Plus from any supplier whose systems touch patient data or connect to their network. If you supply the NHS and have not been asked yet, assume you will be at the next renewal.

What the Cyber Security and Resilience Bill changes

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced in November 2025 and, at the time of writing, is at report stage in the House of Lords. It brings medium and large managed service providers and data centres into NIS-style regulation, gives regulators the power to designate critical suppliers to essential services, and tightens incident reporting to an initial notification within 24 hours and a full report within 72. Health providers are already operators of essential services under the NIS Regulations 2018; the Bill maintains that rather than creating it.

It does not mandate Cyber Essentials or Cyber Essentials Plus. The government’s own factsheet refers to Cyber Essentials only as guidance it wants to drive uptake of. Anyone telling you the Bill makes certification a legal requirement is wrong. What it does do is make the supply-chain expectations above more likely to be enforced through contracts and regulatory scrutiny, because designated critical suppliers will be answerable to a regulator for the first time.

What this means in practice

If you are	You must	You will be asked for
An NHS trust, ICB or ALB	Complete the DSPT annually to Standards Met	Evidence of CAF-aligned outcomes; increasingly Cyber Essentials Plus for your own estate
An independent provider of NHS services	Complete the DSPT; meet NIS duties if designated	Cyber Essentials Plus in most contracts
An adult social care provider	Complete the DSPT if you handle NHS data	Cyber Essentials as a baseline; Plus where commissioners specify it
A supplier of IT, digital or data services to the NHS	Cyber Essentials Plus if in scope of PPN 014 via NHS Supply Chain; DSPT Standards Met if you hold patient data	Charter sign-up, Cyber Essentials Plus, DSPT
Any other NHS supplier	Contract-dependent	Cyber Essentials at minimum; Plus increasingly

What Cyber Essentials Plus involves for a care organisation

Cyber Essentials is a verified self-assessment against five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Plus audits the same controls: an assessor examines a random sample of devices, every internet gateway and externally facing server, runs internal and external vulnerability scans and tests malware protection, within 90 days of the basic pass. Both are valid for twelve months. The controls are explained in detail in our guide to the five Cyber Essentials controls.

The points where health and care organisations most often struggle are clinical and care systems that pin an out-of-support operating system, shared logins on ward or care-home devices, personally owned phones used for rostering and messaging that are in scope and unmanaged, and remote-access services for suppliers that are never reviewed. None of these is unusual and all of them can be brought into line, but they need to be found before the assessor finds them.

Frequently asked questions

Is Cyber Essentials Plus a legal requirement for hospitals?

No. It is a procurement and contractual requirement, not a statutory one. The mandatory instrument for NHS organisations is the DSPT. Cyber Essentials Plus is required of in-scope suppliers by NHS Supply Chain under PPN 014 and by many trusts in their own contracts.

Does the Cyber Security and Resilience Bill require Cyber Essentials?

No. The Bill expands NIS regulation to managed service providers, data centres and designated critical suppliers and tightens incident reporting. It refers to Cyber Essentials only as guidance.

Do care homes need Cyber Essentials?

Care providers handling NHS patient data are expected to complete the DSPT. Cyber Essentials is not mandated, but it is the simplest way to evidence the DSPT’s technical requirements and commissioners increasingly ask for it.

We supply software to an NHS trust. Which do we need?

If you are in scope of PPN 014 through NHS Supply Chain, Cyber Essentials Plus. If you hold or process patient data, the DSPT to Standards Met as well. Most trusts will also ask you to sign the Cyber Security Charter.

Who can certify us?

Any IASME-licensed certification body. Incursion Cyber Security certifies Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance; our licences are listed on the accreditations page. If you want to talk through what your contracts require, get in touch.

Cyber Essentials for hospitals, social care providers and NHS suppliers: what is actually required