PPN 014 requires CE or CE Plus for in-scope NHS and government contracts - and many buyers specify CE Plus where the risk justifies it. DTAC requires a valid Cyber Essentials certificate; CE Plus provides the stronger independent audit preferred for higher-risk tools and clinical data integrations. As an IASME Approved Certification Body, we provide the independent audit your contract demands. Pre-Assessment Check included as standard. Fixed pricing, IASME fee included.
The NHS and wider UK healthcare sector requires cyber security certification across its supply chain. The specific level required depends on your role - but CE Plus is increasingly mandated where contracts involve patient data, NHS system access, or where independent technical verification is required.
PPN 014 (the current government procurement policy note on cyber security) requires CE or CE Plus for in-scope contracts with central government departments, their executive agencies, non-departmental public bodies, and NHS bodies. Buyers set the level per procurement - where the contract risk justifies it, CE Plus is commonly specified. Organisations without the required level can be filtered out before their product or service is evaluated on its merits. See our Healthcare & HealthTech page for standard CE requirements →
HealthTech and MedTech vendors deploying digital health products into the NHS need to satisfy the Digital Technology Assessment Criteria (DTAC), applied by the procuring NHS body. DTAC grades your tool on clinical safety, data protection, and technical security. A valid Cyber Essentials certificate is the baseline evidence DTAC's C3 asks for; for higher-risk tools and clinical data integrations, CE Plus - with its independent technical audit - provides stronger evidence for DTAC submissions.
Standard CE satisfies a significant portion of the NHS Data Security and Protection Toolkit's technical requirements for organisations on the standard categories-based route. CE Plus is not required by the DSPT itself. However, if your organisation is also subject to PPN 014 and the buyer has specified CE Plus, many organisations complete CE Plus to satisfy both simultaneously in a single engagement.
The level of certification required depends on your specific contract and role. Common scenarios:
Not sure which applies? Ask our team →
CE Plus certificates are listed on the IASME public register. NHS procurement teams, ICBs, and trust procurement departments can verify your certification status directly - giving you a verifiable, searchable record to include in tender submissions and supplier onboarding packs.
PPN 014 requires CE or CE Plus for in-scope NHS and government contracts. Buyers determine the level per procurement - many NHS buyers specify CE Plus where contract risk justifies it. Holding only standard CE when the buyer has specified CE Plus means your bid can be filtered out before it is assessed on its merits.
Patient data is special category data under UK GDPR Article 9. The independent technical audit in CE Plus provides a higher level of assurance than self-assessed CE - demonstrating to NHS procurement teams, the ICO, and insurers that your controls have been independently verified, not just self-declared.
CE Plus provides independently verified evidence of your security controls for digital health tools handling clinical data. For higher-risk tools and complex NHS integrations, CE Plus is a materially stronger credential than self-assessed CE during DTAC vetting.
Healthcare organisations often have contract or DTAC deadlines driving certification. We include a Pre-Assessment Check before the formal audit begins - so any gaps are identified and fixed before the assessor starts, not after a failed result that could delay an NHS contract award or HealthTech deployment.
We regularly work with NHS suppliers, HealthTech vendors, and healthcare organisations and understand the DSPT, DTAC, and PPN 014 context. We can advise on which certification applies to your situation and which scope best satisfies your specific contract or procurement requirement.
You work directly with your Lead Assessor from first contact through to your CE Plus certificate. No helpdesk, no rotating contacts. When a procurement team or DTAC assessor asks for a status update before a contract deadline, you can get a direct answer fast.
Four clear steps from enquiry to certification. Pre-Assessment Check included as standard - we identify any gaps before the formal audit begins.
Before the audit starts, we review your controls against CE Plus requirements in full. Any gaps are identified and resolved before the formal assessment begins - reducing the risk of issues on assessment day.
We confirm your assessment scope and asset list. You return an Audit Authorisation Form. Our assessor checks the scope aligns with your Cyber Essentials certificate boundary before the technical audit begins.
Remote vulnerability scanning, internal device sampling, and email and browser configuration checks - all conducted via screen share. No on-site visits required. Suitable for NHS sites, hospitals, and distributed healthcare networks.
Your CE Plus certificate is issued by IASME, published on the public register, and emailed directly to you. Valid for 12 months - annual renewal required to maintain a current certificate for ongoing contract compliance. NHS procurement teams and ICBs can verify it instantly on the IASME registry.
All prices are fixed and include the IASME certification fee. No hidden charges. See our full CE Plus pricing guide →
Cyber Essentials is a mandatory prerequisite for CE Plus. If you need both, buy them together and receive a bundle saving off the combined price. See bundle pricing →
Get independently verified for your NHS contract, PPN 014 requirement, or DTAC assessment. Talk to our UK-based team today. Direct contact, fixed price, IASME approved.
Cyber Essentials is a mandatory prerequisite for CE Plus. Buy both together and receive a bundle saving off the combined price. IASME fee included.
See Bundle Pricing →// Annual RequirementMany NHS and healthcare contracts require an annual pen test alongside CE Plus. CVSS-scored reports, free 30-day retest included as standard. From £1,499 + VAT.
Pen Testing →// Ongoing SupportFractional CISO support for NHS suppliers and HealthTech organisations navigating DSPT, DTAC, PPN 014, and broader NHS cyber compliance requirements. Flexible and cost-effective.
vCISO Support →Client names are withheld in line with confidentiality requirements; character references are available upon request.