Cyber Security for Health-Tech & NHS Suppliers

DTAC is where NHS procurement stalls

The Digital Technology Assessment Criteria (DTAC) is the baseline NHS buyers apply before they'll adopt a digital health product, and DTAC v2 became mandatory across NHS assessments in April 2026. Its technical-security section asks for evidence you can't produce overnight:

• C3.1 — Cyber Essentials. A current certificate, validated against the IASME database. Cyber Essentials Plus is expected for higher-risk or business-critical systems.
• C3.2 — penetration testing. Evidence of an external, manual penetration test of your product, plus how often you test. NHS buyers expect an annual cadence and a re-test of Critical and High findings.
• C3.3 — who tested it. Whether testing was internal or third-party — an independent, accredited tester carries far more weight in due diligence.
• Plus the rest: MFA, a secure development lifecycle, vulnerability management and secure hosting.

Both halves from one team

Most suppliers end up juggling a certification body for Cyber Essentials and a separate firm for the pentest. We're a certified IASME assessor and a CREST-accredited penetration tester, so the certificate and the test report come from one relationship — scoped together, aligned to what DTAC assessors actually look for (findings mapped to the OWASP Top 10 and scored with CVSS).

Don't forget the DSPT

If you also process NHS patient data or use NHS systems, you'll likely need the Data Security and Protection Toolkit alongside DTAC. We handle both so your NHS due-diligence pack is complete.

Common questions