Cyber Essentials and the NHS DSPT: Worth It?

If someone has suggested Cyber Essentials as a way of shortcutting your DSPT, the short answer is that it will not do that — but it is not a wasted idea either.

Two things are true at once. Cyber Essentials does not replace the DSPT, and the formal audit exemption does not reach Category 3 or 4 organisations. Two smaller benefits do reach them — Cyber Essentials Plus exempts a handful of evidence items, and it is what turns a Standards Met submission into Standards Exceeded — and both are covered below. But the work of getting certified overlaps substantially with the technical half of the DSPT, so if you are going to do it anyway, it makes several evidence items easier.

What each one is

The DSPT is the NHS assurance mechanism. It covers information governance and cyber security together, structured around the ten National Data Guardian standards, and it is what NHS England requires of organisations holding NHS patient data.

Cyber Essentials is, per the NCSC, "the minimum standard of cyber security recommended by the Government for organisations of all sizes." It is a certification against five technical controls, with no information governance component. It is administered by IASME — "the NCSC's official Cyber Essentials Delivery Partner", which "manages our network of 400+ cyber security organisations across the UK".

Two levels exist. The NCSC describes the base scheme as "a combination of self-assessment and independent audit", priced "according to the size of your organisation, starting at £320 +VAT". Cyber Essentials Plus is "the same protections, but with more rigorous, independent technical testing", priced "according to the size and complexity of your network".

The audit exemption, and why it probably is not yours

There is a genuine DSPT exemption tied to certification, and it is worth understanding precisely because it gets quoted loosely.

NHS England's 2024-25 audit guidance states: "Evidence items which are covered by an exemption for CE+ and/or ISO27001 will not require further auditing, once it is confirmed that the scope of the certification covers all the health and care data being processed."

Read what it actually removes: further auditing. It narrows what an independent auditor has to test. That is valuable to organisations whose audit covers evidence items. For 2026-27 that means IT Suppliers, who are audited against a list of 12 assertions; NHS England's 2026-27 audit notice audits NHS Trusts, ICBs, ALBs, CSUs, OES and Genomics organisations on CAF outcomes instead.

Care homes, domiciliary care agencies, community pharmacies, dental practices, opticians and GP practices are not in those groups and have no DSPT audit. There is nothing for the audit exemption to reduce. Our guide on who actually needs a DSPT audit covers the scope in full.

The item exemption that does reach Category 3 and 4

Separately from audit, NHS England's FAQ says: "Where organisations do hold Cyber Essentials PLUS they do not have to respond to some toolkit questions, as these will be exempt, but Cyber Essentials PLUS certification is not mandatory."

NHS England's version 9 workbook has an "Exempt for Cyber Essentials PLUS" column. For Category 3 it marks six items: 4.2.4 (removing leavers' access), 6.2.1 (antivirus), 9.1.1 (changing default passwords on network kit), 9.2.1 and 9.2.3 (penetration testing) and 9.6.1 (firewalls). The first three are mandatory. For Category 4 it marks four: 4.2.4, 6.2.1, 9.1.1 and 9.2.1.

The exemption works through your Organisation Profile. NHS England's overview says: "If your organisation has a Cyber Essentials PLUS certification covering all of your health and care data processing, you can record this in the Organisation Profile". Six items out of 80 is a modest saving, not a shortcut.

The benefit that does reach Category 3 and 4: Standards Exceeded

The audit exemption is not the only thing Cyber Essentials Plus does inside the DSPT, and this is the part most often left out.

NHS England's overview states: "For all other organisations, if an organisation achieves 'Standards Met' and also has a current Cyber Essentials PLUS certification recorded in its Organisation Profile, then it's status will be displayed as 'Standards Exceeded'." The same guidance explains how: "If your organisation has a Cyber Essentials PLUS certification covering all of your health and care data processing, you can record this in the Organisation Profile."

Digital Care Hub puts it the same way for adult social care: "Standards Exceeded indicates that you have gone beyond required standards and have Cyber Essentials Plus in place."

So for a Category 3 or 4 provider, CE Plus is the route — and, on NHS England's wording, the only route — to the highest published DSPT status. Note the conditions: it has to be Plus, not base Cyber Essentials; you have to already be at Standards Met; the scope has to cover all your health and care data processing; and you have to actually record it in your Organisation Profile, since nothing picks it up automatically.

Whether that is worth the money is a commercial question rather than a compliance one. Your published status is visible to commissioners, CQC inspectors and families — see our guide to checking a DSPT status — so the value depends on how much that visibility is worth to you.

Note also the condition attached: the certification scope has to cover all the health and care data being processed. A certificate scoped to one office or one system does not carry across an estate.

Where the five controls do overlap

Certification is not useless to a Category 3 provider — it is just not a shortcut. Here is the honest map:

That covers four of the ten standards — 4, 6, 8 and 9 — and only partially. It touches none of Standards 1, 2, 3, 5, 7 or 10 — personal confidential data, staff responsibilities, training, process reviews, continuity planning or supplier assurance. Standard 6 is the narrowest of the four: malware protection is direct evidence for assertion 6.2, but the rest of Standard 6 (which NHS England Digital's assessment guides summarise as "Cyber-attacks against services must be identified and resisted, and CareCERT security advice responded to") is incident detection and response work that certification does not touch. For a small provider the untouched standards are the bulk of the work, as our evidence requirements guide sets out.

The genuinely useful side effect is the preparation. Working through the Cyber Essentials question set forces you to establish what devices you have, what state they are in, who has administrator access and whether everything is patched — which is most of the Standard 8 unsupported-systems inventory and much of the access control register. If you were going to build those anyway, doing them once for both is efficient.

When it is worth the money

Worth it:

• A commissioner or NHS customer has made it a contract condition. This is the most common genuine reason, and it is a contractual question rather than a DSPT one.
• You supply digital goods or services to the NHS. If you are in the IT Supplier population you may be in audit scope, and then the exemption is real money.
• Your technical position is genuinely weak and you want an external forcing function. Certification imposes a deadline and an assessor. Some organisations need that more than they need another document.
• You already hold it. Then use it. Reference the certificate in your Standard 6 and Standard 9 evidence, keep the scope statement with it, and — if it is Cyber Essentials Plus and you are at Standards Met — record it in your Organisation Profile so your published status shows Standards Exceeded.
• You are at Standards Met and want Standards Exceeded. CE Plus is what NHS England requires for that status. Base Cyber Essentials will not do it.

Probably not worth it, if the only reason is the DSPT:

• You are Category 3 or 4 with no contractual requirement, you are not chasing Standards Exceeded, and the money would otherwise go on the things the DSPT actually asks about — training coverage, checking your IT suppliers' certifications, replacing an end-of-support machine.
• Your DSPT gaps are in the information governance half, which is the usual case. Certification will not move any of them.

Before spending anything, find out where your gaps actually are. Our readiness quiz covers seven of the ten standards and shows you which of those you are short on; if the answer is Standards 3, 7 and 10, Cyber Essentials is not the purchase to make. The evidence checklist generator lists every mandatory evidence item for your category.

If you do certify

1. Get the scope right. The DSPT exemption wording turns on covering all health and care data, and a narrow scope is the standard way certification stops being useful.
2. Keep the certificate and the scope statement together. The certificate alone does not tell a reader what it covered.
3. Reference it in your DSPT evidence rather than assuming it is visible. Nobody cross-references certifications for you.
4. Diary the renewal. An expired certificate in a DSPT evidence folder is worse than none, because it looks like a control you think you have.

For the full picture of what the DSPT asks of a small provider, see our complete DSPT guide, and for where CAF fits alongside all this, our DSPT CAF alignment guide.