Cyber Security for Health-Tech & NHS Suppliers
Get through DTAC and sell into the NHS. Digital health suppliers must evidence Cyber Essentials and an annual penetration test to pass the DTAC technical-security section — and we deliver both from one team.
DTAC is where NHS procurement stalls
The Digital Technology Assessment Criteria (DTAC) is the baseline NHS buyers apply before they'll adopt a digital health product, and DTAC v2 became mandatory across NHS assessments in April 2026. Its technical-security section asks for evidence you can't produce overnight:
- C3.1 — Cyber Essentials. A current certificate, validated against the IASME database. Cyber Essentials Plus is expected for higher-risk or business-critical systems.
- C3.2 — penetration testing. Evidence of an external, manual penetration test of your product, plus how often you test. NHS buyers expect an annual cadence and a re-test of Critical and High findings.
- C3.3 — who tested it. Whether testing was internal or third-party — an independent, accredited tester carries far more weight in due diligence.
- Plus the rest: MFA, a secure development lifecycle, vulnerability management and secure hosting.
Both halves from one team
Most suppliers end up juggling a certification body for Cyber Essentials and a separate provider for the pentest. We're a Cyber Essentials and IASME Cyber Assurance Certification Body and a CREST-accredited penetration tester, so the certificate and the test report come from one relationship — scoped together, aligned to what DTAC assessors actually look for (findings mapped to the OWASP Top 10 and scored with CVSS).
Don't forget the DSPT
If you also process NHS patient data or use NHS systems, you'll likely need the Data Security and Protection Toolkit alongside DTAC. We handle both so your NHS due-diligence pack is complete.
Talk to us about your organisation
Tell us what you are dealing with and we will tell you honestly what you need. We work with organisations in your sector regularly, so the conversation starts from what is normal for you rather than from a generic checklist.
Common questions
What does DTAC actually require for security?
A current Cyber Essentials certificate (CE Plus for higher-risk systems), evidence of an external manual penetration test with a documented action plan, an annual testing cadence, MFA, a secure development lifecycle and vulnerability management. DTAC v2 became mandatory across NHS assessments in April 2026.
How often do we need to pen test for the NHS?
At least annually, and again after any significant change to your application, with a re-test of Critical and High findings. We confirm the right cadence for your product during scoping.
Do we need Cyber Essentials or Cyber Essentials Plus?
DTAC expects a current Cyber Essentials certificate, and Cyber Essentials Plus for higher-risk or business-critical systems handling patient data. We check which your buyer requires before you invest.
Can you do the certification and the pen test together?
Yes — that's the point. We're an IASME assessor and a CREST tester, so we scope both together and give you one aligned evidence pack for DTAC, rather than stitching two suppliers' outputs together.
Related
Free, no obligation
Understand your exposure
An attacker’s first move is not an attack, it is a look. So we look first, and send you what we find, worst first.
- Services and ports you did not know were open
- Security misconfigurations on anything public facing
- Known vulnerabilities already indexed by engines like Shodan
- Company credentials sitting in known breach data
The only question is: do you know where and how to look?
We reply within one business day. Prefer to talk first? 01902 288763 or info@solusec.co.uk.
Nothing is touched on your systems. It is all public and already indexed, just scattered. We pull it together, which is what an attacker does first.
Pass DTAC, sell into the NHS
Tell us your product and where you are with DTAC. We'll scope Cyber Essentials and the annual pen test together and give you one clean evidence pack.