The short answer
Healthcare cybersecurity in the UK rests on four things for most organisations: the NHS Data Security and Protection Toolkit (DSPT) if they access NHS patient data, Cyber Essentials or Plus when a contract asks for it, penetration testing of patient-facing systems and connected devices, and PCI DSS wherever patients pay by card. Device makers also meet medical device security rules.
On this page
- What are the biggest cyber threats in healthcare?
- Cyber security in healthcare: what does your organisation need?
- What is the DSPT, and does it replace Cyber Essentials?
- Do NHS suppliers need Cyber Essentials Plus?
- What does healthcare penetration testing cover?
- How are medical devices penetration tested?
- Does PCI DSS apply to healthcare?
- Where do ISO 27001 and ISO 13485 fit?
- Why work with Sovereign Secure?
- What is the next step?
Cyber security in healthcare is set by who you work with and what data you hold. Organisations with access to NHS patient data complete the Data Security and Protection Toolkit (DSPT). Suppliers to NHS bodies are asked for Cyber Essentials, and sometimes Cyber Essentials Plus. Patient portals, apps, clinical networks and connected medical devices need penetration testing, and any provider that takes card payments falls under PCI DSS. Device makers also have medical device security rules to meet.
What are the biggest cyber threats in healthcare?
Ransomware and phishing lead, and in healthcare an attack on IT can stop clinical care. The incidents that have hit UK patients hardest came through old systems and suppliers: the 2017 WannaCry outbreak spread through unpatched Windows machines and disrupted NHS services, and the June 2024 ransomware attack on Synnovis, a pathology provider to London hospitals, led to postponed operations and appointments at several hospitals.
| Threat | Why it matters in healthcare | What reduces it |
|---|---|---|
| Ransomware on providers and their suppliers | Pathology, imaging and patient record systems go offline and care is delayed | Patching, MFA on remote access, segmented networks, offline backups and a tested recovery plan |
| Phishing and account takeover | Stolen email or Microsoft 365 credentials open patient data and give attackers a foothold | MFA, staff awareness and phishing simulation |
| Legacy medical devices and systems | Devices, and the PCs that drive them, often run operating systems that can no longer be patched | Network segregation, an up-to-date device inventory and testing of the devices themselves |
| Third-party remote access | Equipment vendors and IT suppliers connect remotely to support clinical systems | Unique accounts with MFA, access switched on only when needed, and supplier evidence such as the DSPT and Cyber Essentials |
| Data theft and extortion | Health records are special category data and attractive for extortion | Encryption, access control, monitoring and a plan for reporting breaches to the ICO |
Synnovis showed that one supplier’s incident can reach patients directly, which is why NHS bodies ask suppliers for the DSPT, Cyber Essentials and test evidence covered below. Our guide to preventing ransomware sets out the recovery side in more depth.
Cyber security in healthcare: what does your organisation need?
It depends on the kind of organisation you are.
| Organisation | What usually applies |
|---|---|
| IT and digital health suppliers to the NHS | DSPT, Cyber Essentials or Plus as the contract specifies, the Digital Technology Assessment Criteria (DTAC) for digital health products, penetration test evidence |
| GP, dental and pharmacy practices with NHS contracts | DSPT, PCI DSS for card payments, Cyber Essentials as a sensible baseline |
| Private hospitals and clinics | DSPT where you treat NHS patients or connect to NHS systems, PCI DSS for patient payments |
| Care providers with access to NHS systems | DSPT, Cyber Essentials where a commissioner asks for it |
| Medical device and health software makers | UK or EU medical device regulations, usually an ISO 13485 quality system, device and software security testing |
| Health tech SaaS and app providers | DTAC, ISO 27001 as buyers ask, web, API and mobile testing |
UK GDPR applies to all of them. Health data is special category data, and a personal data breach that poses a risk to people must be reported to the ICO within 72 hours of becoming aware of it.
What is the DSPT, and does it replace Cyber Essentials?
The DSPT sits at the centre of NHS cyber security compliance. It is the annual online self-assessment that every organisation with access to NHS patient data and systems must complete, with the final submission usually due by 30 June. NHS trusts, integrated care boards and other Category 1 bodies answer a version aligned to the NCSC’s Cyber Assessment Framework, while suppliers, practices and care providers answer the standards-based version. Our NHS DSPT guide covers the categories, deadlines and evidence in full.
It does not replace Cyber Essentials, and Cyber Essentials does not replace it. The DSPT is a self-assessment, while Cyber Essentials is a certificate issued by an IASME-licensed certification body after checking your answers (and, for Plus, testing a sample of your devices). They overlap on firewalls, patching, access control and malware protection, so one set of work feeds both. In the standards-based toolkit, an organisation that meets the standards and records a current Cyber Essentials Plus certificate is shown as Standards Exceeded.
Do NHS suppliers need Cyber Essentials Plus?
Not automatically, but a supplier that handles NHS personal data will usually need at least Cyber Essentials. The level comes from the contract or product assessment, so read the tender documents first.
- NHS and central government contracts: procurement policy note PPN 014 applies to NHS bodies as well as central government. It requires Cyber Essentials, or equivalent controls, for contracts that handle personal data or supply ICT systems for OFFICIAL information, and lets the buyer ask for Plus where the risk is higher. See is Cyber Essentials mandatory?
- Digital health products: the DTAC, NHS England’s baseline assessment for digital health technologies, has asked for a current Cyber Essentials certificate and penetration test evidence. NHS England has been revising the form, so check the current version for the exact evidence.
- Individual NHS buyers: some specify Plus, particularly for suppliers that connect to their network or host patient data.
Where the choice is yours, Plus is the stronger evidence, because an assessor tests a sample of your devices and checks your cloud services. The audit must be completed within three months of your basic certificate; see Cyber Essentials Plus.
What does healthcare penetration testing cover?
Healthcare penetration testing covers each part of the service that patients, staff or an attacker can reach, scoped and run so it cannot disrupt care.
| What you run | Test | What it looks for |
|---|---|---|
| Patient portals and web apps | Web application penetration testing | OWASP Top 10 flaws, one patient reaching another’s records |
| APIs, including FHIR and HL7 interfaces | API testing | Authorisation flaws, responses that return more data than needed |
| Mobile health apps | Mobile app testing | Insecure storage on the phone, weak back-end authentication |
| Clinic and hospital networks | Internal network testing | Flat networks, unsupported systems, routes from guest or device networks to clinical systems |
| Cloud hosting | Cloud testing | Exposed storage, over-privileged identities, missing logging |
Agree exclusions and timings with the people responsible for patient safety first. Health IT in England is governed by the clinical risk management standards DCB0129 (manufacturers) and DCB0160 (deploying organisations), so your clinical safety officer should know what will be tested and when. Life-critical devices are tested on a spare unit, never on equipment in clinical use.
How are medical devices penetration tested?
On a representative, non-production device, covering the whole system: firmware, physical ports such as USB and debug interfaces, wireless links such as Bluetooth and Wi-Fi, the companion app and the cloud service behind it. Our hardware and IoT penetration testing covers each layer, including firmware extraction and review.
Manufacturers have regulatory reasons too. For the EU market, Annex I of the Medical Device Regulation, Regulation (EU) 2017/745, requires software to be developed to the state of the art taking account of information security, and requires manufacturers to set minimum IT security measures, including protection against unauthorised access. IEC 81001-5-1 describes security activities across the health software lifecycle, and an independent test report gives auditors and notified bodies verification evidence they can rely on.
Does PCI DSS apply to healthcare?
Yes, whenever you take card payments for private consultations, dental treatment, prescriptions or anything else, in person, online or by phone. PCI DSS v4.0.1 applies to every organisation that stores, processes or transmits cardholder data, and its future-dated requirements became mandatory on 31 March 2025.
Most practices validate with a Self-Assessment Questionnaire (SAQ) chosen by how they take payments, and the acquirer confirms which one applies. The healthcare-specific risk is card numbers drifting into clinical systems: a receptionist typing a card number into patient notes, a card read out on a recorded line or emailed with a booking. Each of those brings the system into PCI DSS scope, so keep card data on the payment terminal or the provider’s hosted page and nowhere else. Our PCI DSS compliance guide explains each SAQ, and as a PCI SSC Qualified Security Assessor (QSA) company we can help you work out which applies before you speak to your acquirer.
Where do ISO 27001 and ISO 13485 fit?
ISO 27001 is the standard for an information security management system, and the 2022 edition has 93 Annex A controls. For a health tech supplier it produces much of the evidence that the DSPT, the DTAC and buyer questionnaires ask for. We are ISO 27001 certified and provide ISO 27001 consultancy, with certification audits by our partner certification body, MQA International.
ISO 13485 is the quality management system standard for medical device organisations. It is not a security standard, but its design controls and risk management processes are where device security requirements and test evidence belong: security testing is part of design verification. Our ISO 13485 consultancy page explains how that fits UK, EU and US device regulation.
Why work with Sovereign Secure?
- We certify Cyber Essentials ourselves as an IASME-licensed certification body, issuing CE and CE+, with basic certification from £320 + VAT.
- Payment security specialists: a PCI SSC-approved QSA, QPA and CPSA company and a member of the PCI SSC Global Executive Assessor Roundtable (2026 to 2028).
- Testing across the estate: web, API, mobile, network, cloud and hardware testing from one provider.
- Established in 2012 (Companies House 08334453) and ISO 27001 certified.
What is the next step?
Tell us what you need to evidence and to whom: a tender asking for Cyber Essentials Plus, a DTAC assessment, a DSPT evidence gap or a device test. Use the enquiry form on this page, choosing “Cyber Essentials Plus (CE+)” or “Penetration Testing”, and we will come back with a fixed quote. You can also call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
