Why Cyber Essentials Plus Matters More Than Ever for NHS Suppliers

If your organisation supplies products or services to the NHS, Cyber Essentials Plus (CE Plus) is no longer just a “nice to have”. For many suppliers, it’s now an essential requirement.

Recent changes to NHS procurement rules, updates to the Data Security and Protection Toolkit (DSPT), and new Cyber Essentials standards mean organisations need to review their cyber security compliance sooner rather than later. Waiting until your next tender or contract renewal could put valuable business at risk.

Here’s what NHS suppliers need to know.

Why Has Cyber Essentials Plus Become So Important?

Over the past year, several significant changes have raised the importance of Cyber Essentials Plus across the NHS supply chain.

Firstly, NHS Supply Chain now requires organisations that handle NHS personal data or provide IT and digital services to hold Cyber Essentials Plus under Procurement Policy Note (PPN) 014. This requirement applies to many new suppliers and is increasingly being reviewed for existing contracts.

Secondly, the National Cyber Security Centre (NCSC) has reinforced Cyber Essentials as a key part of its strategy to improve cyber resilience across the NHS following major attacks on healthcare organisations, including the Synnovis cyber incident.

Finally, Cyber Essentials version 3.3 introduced mandatory multi-factor authentication (MFA) for all in-scope cloud services. Any organisation renewing or achieving certification without MFA in place will fail the assessment.

Combined, these changes make Cyber Essentials Plus one of the most important cybersecurity certifications for NHS suppliers.

What Is Cyber Essentials Plus?

Cyber Essentials is the UK Government’s baseline cyber security certification, designed to protect organisations against the most common cyber threats.

It focuses on five key security controls:

• Firewalls
• Secure configuration
• User access controls
• Malware protection
• Security updates and patch management

Cyber Essentials Plus covers exactly the same controls, but with one important difference.

Rather than relying on a self-assessment questionnaire, Cyber Essentials Plus includes an independent technical audit. Assessors verify that your controls are genuinely working through vulnerability scanning and hands-on testing of your systems.

For organisations working with sensitive NHS data, this independent verification provides much greater assurance.

Who Needs Cyber Essentials Plus?

If your organisation:

• Processes or stores NHS Supply Chain personal data, or
• Provides IT, software, digital platforms, hosting or managed services to the NHS,

Then Cyber Essentials Plus is likely to be a procurement requirement.

Holding only the standard Cyber Essentials certification may no longer be enough to satisfy NHS Supply Chain requirements.

What About ISO 27001?

Many organisations assume that ISO 27001 covers the same ground as Cyber Essentials Plus.

It doesn’t.

ISO 27001 focuses on information security management systems and governance, while Cyber Essentials Plus demonstrates that your technical controls have been independently tested.

For NHS procurement, they complement each other rather than replace one another. Holding ISO 27001 does not remove the requirement for Cyber Essentials Plus.

Cyber Essentials Plus and DSPT: What’s Changed?

One of the biggest changes for 2026 affects organisations completing the NHS Data Security and Protection Toolkit (DSPT).

Previously, Cyber Essentials Plus could be used as evidence for one of the DSPT requirements. That is no longer the case.

Under DSPT Version 8, organisations must now provide separate evidence for both Cyber Essentials Plus and the DSPT.

Although the controls overlap, they are now treated as independent compliance requirements.

The Benefits Go Beyond Compliance

While many organisations pursue Cyber Essentials Plus because it’s required, the certification delivers benefits well beyond procurement.

Independent testing often uncovers security weaknesses that would otherwise go unnoticed, allowing organisations to resolve vulnerabilities before attackers exploit them.

Certification can also:

• Strengthen your position during NHS procurement.
• Demonstrate your commitment to cybersecurity.
• Reduce exposure to common cyber attacks.
• Potentially qualify eligible organisations for free cyber liability insurance through IASME.

Most importantly, it helps protect sensitive patient and organisational data in an increasingly challenging cyber threat landscape.

Achieve Certification with Systemagic

At Systemagic, we help organisations achieve both Cyber Essentials and Cyber Essentials Plus certification through our Guided Pass Service.

Whether you’re starting from scratch, renewing an existing certification, or preparing for NHS procurement requirements, our cyber security specialists work alongside your team to guide you through the entire process. We’ll help you identify any gaps, ensure you’re ready for assessment, and support you every step of the way – giving you the confidence to achieve certification first time.

Our Guided Pass Service removes the uncertainty from the certification process, helping you save time, reduce stress, and strengthen your organisation’s cyber security posture.

If you’re unsure where to start, or you’d like to discuss your Cyber Essentials or Cyber Essentials Plus requirements, get in touch with the Systemagic team today.

We’ll help you understand what’s required, answer your questions, and support you on your journey to certification

Back to our blog