By EJN Labs · 13 Oct 2026 · 7 min read
Cyber Essentials Plus and a penetration test answer different questions for an NHS buyer. CE+ is a hands-on technical audit of five baseline infrastructure controls; it does not test your software for exploitable weaknesses. Most NHS buyers ask for CREST-accredited penetration test evidence alongside CE+, often because the pen test sits under their NHS Data Security and Protection Toolkit (DSPT) submission.
Why doesn’t Cyber Essentials Plus answer the penetration test question?
Cyber Essentials Plus does not answer it because CE+ and a penetration test test different layers. CE+ verifies five baseline infrastructure controls through an assessor-led technical audit. A penetration test examines your actual software product for weaknesses CE+ was never designed to find.
The five controls are boundary firewalls and internet gateways, secure configuration, security update management, user access control and malware protection, each checked hands-on by an assessor across your infrastructure. None of the five involves attempting to break into your actual application, so a CE+ certificate on file tells an NHS security lead nothing about whether your login flow can be bypassed or your API returns another customer’s records.
Why are NHS software suppliers asked to have a penetration test completed as part of onboarding?
It comes from the DSPT, not from Cyber Essentials Plus. If your product touches NHS patient data, your organisation typically has its own DSPT submission to complete, and the toolkit’s IT protection standard is where an annual penetration test is expected as supporting evidence.
Individual trusts add their own layer on top through local supplier questionnaires, and the wording varies: some ask for a signed independent attestation, others simply want a recent CREST-accredited report on file. Whatever form the question takes, it is nearly always asking for proof that someone outside your development team tried to break into the product, which a CE+ certificate alone cannot provide. This post focuses on that specific gap between CE+ and the pen test; for the wider set of NHS supplier asks, including DCB1596 and data processing terms, our NHS security checklist for software suppliers covers the full picture.
What should a penetration test for NHS-facing software actually cover?
It should cover the parts of your product that handle patient or clinical data end to end. That means authentication and session handling, role-based access controls between clinical and administrative users, the APIs your app or integration engine calls, and how patient identifiers are stored and transmitted.
A web application handling patient data typically needs an external test of the application itself plus the API layer behind it, since most NHS integrations move data through structured clinical interfaces rather than the browser alone. Scope should also cover how your own support tooling can reach production data, since that is where a lot of unauthorised access actually starts. A web application penetration test paired with an API penetration test is the combination we typically scope for suppliers in this position.
How do you fit a penetration test around a Cyber Essentials Plus renewal?
You scope them separately but time them together. A CE+ assessment and a penetration test use different methods and different assessors, so they cannot be combined into one exercise, but running them in the same procurement cycle means one report pack for both questions instead of two separate pushes months apart.
- Scoping call. We confirm which product surfaces touch NHS data, the web application, any patient-facing app, and the APIs behind them, and agree what “in scope” means for your buyer.
- Testing window. A typical engagement runs one to two weeks against a staging or pre-production build, so your live NHS environment is never touched directly.
- Reporting. Findings are CVSS-rated and mapped to the affected component, in a format your procurement contact can forward alongside your CE+ certificate.
- Retest. Once fixes are in place, we confirm each finding is closed. In our experience this retest evidence is often the last item a buyer’s security review is waiting on.
What does penetration test evidence cost on top of Cyber Essentials Plus?
It typically adds £4,400 to £8,400 for a single web application on top of whatever your CE+ assessment costs, based on UK day rates that currently sit between £1,100 and £1,400. A straightforward web application test usually takes 4 to 6 days, depending on how many user roles and data flows it has.
Add the API layer most NHS integrations depend on and the range moves to £6,600 to £12,600 across 6 to 9 days. A remediation retest, once fixes are in place, typically runs £1,100 to £2,800 for 1 to 2 days. Treat these as UK market benchmarks, not your price; the quote form turns them into a figure scoped to your actual product. Our cost hub sets out how scope, day count and rate combine across every service we offer.
| Scope | Typical effort | Typical UK cost |
|---|---|---|
| Single web application penetration test | 4 to 6 days | £4,400 to £8,400 |
| Web application plus API penetration test | 6 to 9 days | £6,600 to £12,600 |
| Retest after remediation | 1 to 2 days | £1,100 to £2,800 |
How EJN Labs approaches the Cyber Essentials Plus and pen test question
EJN Labs sits on both sides of this question. We are a UK CREST-accredited penetration testing firm, certified to ISO 27001 and ISO 9001, and, as an IASME-licensed body, we can also certify your Cyber Essentials Plus assessment ourselves. All testing on the technical side is delivered by UK-based testers, something most NHS buyers ask for directly given how sensitive the underlying data is.
Because we can deliver both sides, some suppliers dealing with the NHS choose to run one coordinated engagement with us rather than commission the certification and the technical test from two separate vendors on two different timelines. We scope every test against your actual buyer’s questionnaire wording where you can share it, so the report answers the specific question you were asked rather than a generic template.
Frequently Asked Questions
Does Cyber Essentials Plus include a penetration test?
No. Cyber Essentials Plus is a hands-on technical audit of five baseline infrastructure controls, among them firewalls, patching and access control. It does not include testing your application for exploitable weaknesses, so most NHS buyers ask for separate CREST-accredited penetration test evidence alongside it.
Is Cyber Essentials Plus a separate, related requirement from the penetration test NHS buyers ask for?
Yes. Buyers commonly list them as a separate, related requirement because they test different things: CE+ verifies your infrastructure controls, while a penetration test examines your specific product. Holding CE+ does not remove a buyer’s separate request for independent testing evidence on the application itself.
What should a penetration test cover for a supplier selling into the NHS?
It should cover authentication, session handling and role-based access control between clinical and administrative users, plus the APIs your product exposes and how patient identifiers are stored and transmitted. Scope should also include any tooling with direct access to production data.
What does penetration test evidence cost for an NHS software supplier?
A single web application test typically runs 4 to 6 days at UK day rates of £1,100 to £1,400, so £4,400 to £8,400. Adding the API layer takes it to 6 to 9 days, or £6,600 to £12,600. Get in touch for a scoped, exact figure.
How soon before an NHS deadline should you start penetration testing?
Start four to six weeks before your questionnaire or contract deadline. That allows one to two weeks for testing itself, time to remediate anything significant the report finds, and a short retest to confirm fixes before you submit evidence to your buyer or your own DSPT return.
Get your NHS pen test evidence sorted alongside Cyber Essentials Plus
Cyber Essentials Plus and a penetration test both belong in your evidence pack for the next NHS deal, and we can deliver the testing half against the exact wording your buyer sent you. Request a CREST pentesting quote and tell us what the questionnaire is asking for; we will scope a fixed price around your actual product.
Leave a Reply