DSPT Penetration Testing Cost

DSPT penetration testing cost comes down to day rate times days: EJN Labs charges £1,100 to £1,400 a day, and a typical DSPT scope runs a small number of days depending on your organisation type. You get a fixed price for a defined scope before any work starts.

Get a DSPT Pen Test Quote

What a DSPT pen test costs

The price is the day count multiplied by the published day rate of £1,100 to £1,400. Three days of testing costs £3,300 to £4,200; five days costs £5,500 to £7,000. For context, our published external infrastructure test starts at £3,500 and typically lands between £6,500 and £12,000 over 3 to 5 days, and internet-facing systems are a common starting point for DSPT evidence. The full rate card is on our pricing page.

Days	At £1,100 a day	At £1,400 a day
3	£3,300	£4,200
4	£4,400	£5,600
5	£5,500	£7,000

What the DSPT expects from your organisation type

The 2025/26 toolkit is CAF-aligned, with mandatory outcomes set by organisation type, and an annual penetration test sits under the IT protection standard. NHS bodies, designated operators of essential services, genomics organisations and relevant IT suppliers also face an independent CAF-aligned audit, so their evidence is checked rather than self-asserted. Which outcomes apply to you depends on your organisation type: check your category on the official DSPT site before you scope anything, or ask us to check it as part of a DSPT penetration testing scope.

What drives the day count

Three things move the bill: how many systems handle patient data, whether you test externally, internally or both, and whether findings need a retest. Our retest of fixed findings is free, so it never adds days.

How to keep the cost down without weakening evidence

Scope tightly around the systems that touch patient data. If you already commission an annual penetration test, align it with your DSPT submission instead of buying a second test. And treat any quote under £500 a day with suspicion: at that price you are buying a scan, not a test. Selling to the NHS as well? DTAC penetration testing uses much of the same evidence. The wider maths for every service is in our penetration testing cost guide.

Frequently asked questions

Does the DSPT require a penetration test?

It depends on your organisation type. The 2025/26 CAF-aligned toolkit sets mandatory outcomes per organisation type, and an annual penetration test sits under the IT protection standard. NHS bodies, designated operators of essential services, genomics organisations and relevant IT suppliers have that evidence checked in an independent audit. Confirm your category on the official toolkit.