Get DTAC-ready and sell to the NHS with confidence

DTAC’s technical security section asks for evidence of penetration testing and how regularly it is performed. In practice, NHS buyers expect an independent test against recognised standards such as OWASP before they will progress procurement. We deliver a test and a report built for exactly this.

DTAC expects a current Cyber Essentials certificate as a baseline, and Cyber Essentials Plus for higher-risk or business-critical systems that handle patient data. We are a certification body for both, so we can assess and certify you directly.

An executive summary plus a technical report, with each finding mapped to OWASP and scored using CVSS, clear remediation guidance, and confirmation that Critical and High findings have been retested. It is written to slot straight into your DTAC submission and your NHS buyer’s information governance due diligence.

Think of it like driving in the UK. DTAC is the MOT for a specific vehicle: it assures that one product is fit for purpose before an NHS buyer adopts it. The Data Security and Protection Toolkit (DSPT) is your driving licence: it assures that you, the organisation, are fit to handle NHS patient data, and you renew it every year. So DTAC applies if you are putting a specific digital product in front of an NHS buyer, the DSPT applies if your organisation handles NHS patient data, and both apply if you are doing the two together. They overlap on security evidence, and each expects an independent penetration test. We support suppliers with both. See our DSPT penetration testing page.

For a typical single web application and its API, testing runs over several working days, with your report and retest following shortly after. We confirm exact timescales in your fixed quote within 24 hours.

DTAC is the NHS England assessment framework that buyers apply during procurement. It is required in practice to sell software into the NHS, and DTAC v2 became mandatory across NHS assessments on 6 April 2026. We help you meet its technical security expectations.

NHS buyers typically expect a penetration test at least once a year, and again after any significant change to your application. DTAC asks how regularly you test, so an annual cadence with a retest of Critical and High findings is the safe baseline. We confirm the right cadence for your product during scoping.

We test the full range of digital health products: web applications, mobile apps for iOS and Android, APIs, cloud environments such as AWS, Azure and GCP, and the supporting infrastructure. Whatever your technology stack, we assess the areas DTAC and NHS buyers focus on most: authentication and session handling, access control, multi-tenant isolation, and the security of your APIs and third-party integrations. See our healthcare penetration testing service.