Last updated: 7 November 2026
Organisations that handle NHS data or supply NHS services are typically expected to evidence good cyber security. That usually means completing the NHS Data Security and Protection Toolkit (DSPT) and holding Cyber Essentials or Cyber Essentials Plus, and increasingly responding to the NHS Cyber Security Charter. A practical, staged review of your controls is the fastest route.
The common assurance routes
| Requirement | What it is | Who usually needs it |
|---|---|---|
| DSPT | Annual online self-assessment against data security standards | Organisations with access to NHS patient data or systems |
| Cyber Essentials | Verified self-assessment of five technical controls | Suppliers where contracts ask for baseline assurance |
| Cyber Essentials Plus | Independent technical audit of devices and configuration | Higher-risk or larger NHS contracts |
| NHS Cyber Security Charter | Supplier commitment to cyber security expectations | Suppliers working with NHS organisations |
Always confirm the exact requirements in your contract or tender, because they vary by NHS organisation and by the data you handle.
What a practical readiness review covers
Patch and support review
Checking key systems are supported, updated and managed.
MFA and identity protection
Reviewing access controls, privileged accounts and MFA coverage.
Monitoring and alerting
Looking at visibility, detection capability and response readiness.
Backup and recovery
Assessing backup protection and restoration testing.
Policy and governance
Helping leadership understand responsibilities and reporting.
Assurance readiness
Supporting supplier due diligence and healthcare requirements.
How ABCOM helps
ABCOM has supported healthcare and NHS-linked environments for many years, including contracted data security services connected with Portsmouth NHS and Brighton NHS. We work in plain English and take a staged approach: find the risks, fix the priority gaps, then build. Read What the NHS Cyber Security Charter means for suppliers.
Quick answers
Do I need Cyber Essentials Plus for NHS work?
It depends on the contract and the data you handle. Cyber Essentials is a common baseline and Plus is often requested for higher-risk work, so check your tender documents.
How long does DSPT take?
It depends on your size and how well your policies and controls are already documented. Having evidence ready, such as MFA settings, patching records and backup tests, makes it much quicker.
Bidding for NHS work? Book a free readiness conversation before your next questionnaire.
Related answers and guides
- What is the Cyber Security and Resilience Bill?
- Why do businesses fail Cyber Essentials?
- What is user awareness training?
- NHS Cyber Security Charter guide
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about Microsoft Defender and Purview. Free, friendly and no obligation.