Cyber Essentials, the DSPT and Microsoft 365 for healthcare and care
The NHS Data Security and Protection Toolkit, when Cyber Essentials Plus helps, and what DTAC requires of health tech.
The rules, and where they come from
If your organisation has access to NHS patient information, you must complete the Data Security and Protection Toolkit (DSPT) every year, by 30 June. Cyber Essentials Plus is not mandatory for the DSPT, but it exempts some questions. Makers of digital health products must hold Cyber Essentials to pass NHS England's Digital Technology Assessment Criteria (DTAC). Care providers and commissioners use DTAC to assess a product before they buy it. This covers care providers, dental and other NHS-contracted practices, and suppliers of health technology.
| What | Status | Who | Source |
|---|---|---|---|
| Complete the DSPT and publish it every year by 30 June | Required | "All organisations that have access to NHS patient information" | DSPT overview |
| DSPT as a contract term | Required by contract | Providers under the NHS England Standard Conditions contract | DSPT overview |
| Show DSPT compliance "or equivalent", completed annually | Expected by the Care Quality Commission (CQC) | Adult social care providers, under its guidance on digital records | CQC, 4 March 2024 |
| Cyber Essentials Plus | Optional for the DSPT. It exempts some questions | DSPT users | DSPT FAQ |
| A valid Cyber Essentials certificate | Required to pass DTAC | Makers of digital health technology | NHS England DTAC form, February 2026 |
| Cyber Essentials or Plus on higher-risk contracts | Required where the buyer applies it | Suppliers to NHS bodies | PPN 014 |
The DSPT FAQ says: "Where organisations do hold Cyber Essentials PLUS they do not have to respond to some toolkit questions, as these will be exempt, but Cyber Essentials PLUS certification is not mandatory." Two more benefits are written into the toolkit. For organisations other than NHS trusts, ICBs and a few other named types, Standards Met plus a current Cyber Essentials Plus certificate recorded in your profile displays as "Standards Exceeded". And IT suppliers to the NHS, who need a DSPT audit, find that holding ISO 27001 or Cyber Essentials Plus "will reduce the scope of your audit". To record Plus in your DSPT profile, the certificate should cover all your health and care data processing.
Social care providers complete a DSPT tailored to their type of organisation, and can complete a one-off "Approaching Standards" assessment that shows good progress before reaching Standards Met. The DSPT is also where security incidents and data breaches are reported, and completing it is needed to use national systems such as NHSmail and the e-Referral Service.
How we deliver it
The DSPT asks for evidence, and part of it covers IT. Cyber Essentials checks supported and patched devices, MFA, admin accounts and malware protection. We keep those in place, back up Microsoft 365, and give you the records to show it.
- Managed, £35 per user a month: NinjaOne patching and monitoring, Huntress Managed EDR, Defender for Business, MFA, Microsoft 365 backup, unlimited remote fixes during support hours and a quarterly review.
- Secure, £55: adds 24/7 monitoring of Microsoft 365 sign-ins, staff phishing tests and awareness training, Intune on Business Premium, and a monthly security report mapped to Cyber Essentials controls.
- Cyber Essentials Plus for the DSPT exemptions and Standards Exceeded, or Cyber Essentials for DTAC. On Managed or Secure, Cyber Essentials is £995 a year for 10 to 19 people and Plus is £2,595; without a plan, Plus is £2,995. Every band is on the Cyber Essentials Plus page.
We do not complete or submit your DSPT for you. We support the IT evidence and the certificates, and the certification body decides on Cyber Essentials. Under Cyber Essentials, devices that access the organisation's data or services are in scope, so carers' work phones count, and the carers count towards the headcount our prices are based on.
Example at our prices
Example only, not a quote
An 18-person dental practice with NHS patients, on Microsoft 365 Business Premium and our Managed plan, certifying to Cyber Essentials Plus.
- Licences: 18 × £24.60 = £442.80 a month
- Managed support: 18 × £35 = £630 a month
- Together: £442.80 + £630 = £1,072.80 a month, or £12,873.60 a year
- Cyber Essentials Plus, support-client price for 10 to 19 people: £2,595 a year
- Year one: £12,873.60 + £2,595 = £15,468.60, excluding VAT
With Cyber Essentials instead (£995 for 10 to 19 people on a support plan), year one is £12,873.60 + £995 = £13,868.60.
Common questions
Is Cyber Essentials Plus mandatory for the DSPT?
No. The DSPT says Plus is not mandatory. Holding it exempts some questions. For organisations other than NHS trusts, ICBs and a few other named types, it also turns Standards Met into Standards Exceeded.
Who has to complete the DSPT?
All organisations that have access to NHS patient information. It is a contract term in the NHS England Standard Conditions contract, and DHSC policy is that all bodies processing NHS patient information give assurance through it. In its guidance on digital records, CQC also says it expects adult social care providers to show DSPT compliance or equivalent.
Does a health app supplier need Cyber Essentials?
If the product goes through DTAC, yes. The February 2026 DTAC form says that to pass, the manufacturer must have a valid Cyber Essentials certificate.