Cyber Essentials, Pen Testing and NHS Contracts: What Care Providers Need

Why Do NHS Contracts Ask Care Providers for Both Cyber Essentials and a Penetration Test?

NHS contracts ask for both because they cover different risks. Cyber Essentials confirms a small set of basic technical controls are in place; a penetration test checks whether your actual systems can be exploited. Commissioners increasingly want evidence of both before data sharing begins.

A care provider bidding for or renewing an NHS contract typically meets this ask inside a security schedule, a due-diligence questionnaire, or a request tied to the toolkit itself. The two pieces of evidence sit alongside each other because they answer different questions: is your baseline hygiene in order, and have your internet-facing systems actually been tested against someone trying to get in. The request rarely comes only from an NHS commissioner directly; a local authority commissioning adult social care, or a software supplier your service uses to manage care records, can raise the same ask on the NHS body’s behalf. Our wider guide to penetration testing for healthcare organisations covers the sector context in more depth.

What Does the NHS Standard Contract and the DSPT Actually Ask You to Show?

The NHS Standard Contract does not fix one universal security clause. Individual commissioners commonly build DSPT completion, and often Cyber Essentials or Cyber Essentials Plus certification, into the schedules of the specific contract they issue you, and this varies between commissioners.

That variation matters practically. A small domiciliary care agency and a large NHS-facing IT supplier are assessed against different mandatory outcomes in the toolkit, so start from your own DSPT self-assessment rather than a generic checklist. An independent, audited version of the toolkit applies to NHS bodies, designated operators of essential services and genomics organisations; independent care providers outside those categories typically complete a self-assessment instead, which is a lighter process but not a lower bar if a commissioner reviews it closely. Where a commissioner has issued you a contract, check its own schedules against your DSPT profile before assuming what evidence you actually owe them.

Which Care Providers Actually Need Independent Penetration-Test Evidence?

Independent penetration-test evidence is asked for most explicitly, in our experience, from organisations the toolkit classes as key IT suppliers and larger NHS bodies. Many smaller care providers can evidence assurance through Cyber Essentials Plus instead, unless a specific commissioner asks for more.

Cyber Essentials Plus is worth being precise about here: it is an assessor-led technical check of a defined set of controls, not a penetration test, and the two get referred to loosely as “security certification” far too often. Where your organisation runs a patient-facing booking system, referral portal or care-record web app, that system is exactly the kind of asset a web application penetration test is scoped to cover, separately from the Cyber Essentials assessment.

Why Are You Being Asked to Have a Penetration Test Completed as Part of an NHS Contract?

You are usually asked at one of three points: contract award, annual DSPT renewal, or a system integration such as connecting into a shared care record. The request normally arrives with a rough deadline attached, because your commissioner or system owner needs the report before approving data sharing or go-live.

In our experience, buyers frequently name a specific accreditation when they raise the request, most often asking for CREST-accredited testers by name. The toolkit itself does not specify an accreditation body. That preference is a buyer choice, not a toolkit rule, and it is one reason care providers ask us to run the test rather than treat the requirement as something to tick off internally. Once scoped, testing typically runs one to two weeks, with a written report and remediation guidance you can hand straight to your commissioner or attach to your DSPT evidence.

What Does This Kind of Testing Cost a Care Provider in the UK?

UK CREST-accredited penetration testing typically costs £1,100 to £1,400 per day. A care provider testing an external network and one patient-facing web application typically needs 3 to 5 days of testing, so £3,300 to £7,000 in the UK market, scoped to what you actually run.

Cyber Essentials is priced separately and mostly scales with your employee count rather than your systems, so it is usually the smaller of the two costs. Coordinating scoping conversations for both pieces of evidence with one supplier can save you a round of duplicate paperwork. For how scope changes the price, see our guide to penetration testing costs in the UK, or go straight to get a CREST pentesting quote for your own systems.

How EJN Labs Approaches Penetration Testing for NHS-Contracted Care Providers

EJN Labs is a CREST-accredited penetration testing firm, certified to ISO 27001 and ISO 9001, and a Cyber Essentials and Cyber Essentials Plus Certification Body licensed by IASME. All testing is carried out by UK-based testers, and because we assess Cyber Essentials in house as well as running the penetration test, we can sequence both pieces of evidence for you rather than you coordinating two separate suppliers.

When we scope a care provider’s test, we start from what a commissioner or DSPT reviewer is actually likely to ask about: internet-facing infrastructure, any patient or service-user booking, referral or care-record system, and remote access into your network such as a VPN or a care management platform login. Findings come back mapped to the systems you named, with a written retest available once fixes are in, so the report reads as evidence for your specific contract rather than a generic technical summary. Where your service depends on third-party care software, we also flag which findings sit with your organisation and which belong with that supplier.

Frequently Asked Questions

Does Cyber Essentials Plus Count as a Penetration Test for NHS Contracts?

No. Cyber Essentials Plus is typically an assessor-led technical check of a defined set of controls, not a penetration test. Many organisation types can use it as part of their DSPT evidence, but a penetration test is a separate, broader exercise that tests your actual systems for exploitable weaknesses.

Do All Care Providers Need a Penetration Test for the DSPT?

Not automatically. In our experience, the toolkit asks most explicitly for independent testing from key IT suppliers and larger NHS bodies. Many smaller care providers can evidence assurance through Cyber Essentials Plus instead, unless a specific commissioner asks for more.

What Does the NHS Standard Contract Say About Cyber Essentials?

It does not fix one universal clause. Individual commissioners commonly build DSPT completion, and often Cyber Essentials or Cyber Essentials Plus certification, into the schedules of the specific NHS Standard Contract they issue you, so check your own contract rather than a generic list.

What Does a Penetration Test Typically Cost a Care Provider?

UK CREST-accredited testing typically costs £1,100 to £1,400 per day. Testing an external network plus one patient-facing web application usually takes 3 to 5 days, so £3,300 to £7,000 in the UK market. Get a quote for the exact figure once your scope is confirmed.

How Long Before an NHS Contract Deadline Should Testing Be Arranged?

Start scoping at least four to six weeks before you need the report. That covers scheduling, the test itself, remediation of any findings and a retest if needed, so the evidence is ready before your DSPT submission or contract go-live date.

Ready to Evidence Cyber Essentials and Penetration Testing for Your Next NHS Contract?

If a commissioner, a DSPT submission or a system integration is asking your organisation for penetration-test evidence, we can scope testing around the systems you actually need to evidence. Get a CREST pentesting quote and you will get a fixed scope and price back.

Related Research

For more detail on the toolkit itself, see our guides to the NHS Data Security and Protection Toolkit and to penetration testing for DSPT evidence.

Related: Penetration Testing Cost for UK Care Providers and Care Software and Best Penetration Testing Companies for UK Social Care.