--- title: "DSPT 9.2 Pen Testing for NHS IT Suppliers: What Changed for 2026-27" description: Pen testing is back on the DSPT mandatory audit list for NHS IT suppliers. Who it applies to, what the auditor will ask for, how the Cyber Essentials Plus exemption works, and why DTAC still needs a real test. image: https://blog.echosecure.co.uk/hubfs/dspt-9-2-featured-og.png --- [Skip to content](https://blog.echosecure.co.uk/dspt-9.2-pen-testing-for-nhs-it-suppliers-what-changed-for-2026-27#main-content) [![Echo Secure AI Logo](https://blog.echosecure.co.uk/hs-fs/hubfs/Echo%20Secure%20Logo-3.png?width=1250&height=625&name=Echo%20Secure%20Logo-3.png)Homepage](https://echosecure.co.uk) - [Penetration Testing](https://echosecure.co.uk/penetration-testing) - Packages - [Phishing Packages](https://echosecure.co.uk/phishing-packages) - [Cyber Protect Packages](https://echosecure.co.uk/cyber-protect-packages) - Resources - [Portal](https://echosecure.co.uk/echo-secure-portal) - [Adversarial Phishing Simulation](https://echosecure.co.uk/adversarial-phishing-simulations) - [APS Kill-Chain](https://echosecure.co.uk/phishing-kill-chain) - [What is Phishing?](https://echosecure.co.uk/what-is-phishing) - [Training Webinars](https://echosecure.co.uk/phishing-awareness-webinars) - [Phishing Glossary](https://echosecure.co.uk/phishing-glossary) - [Compliance Benefits](https://echosecure.co.uk/compliance-benefits) - [Blog](https://blog.echosecure.co.uk) - About - [About Us](https://echosecure.co.uk/about-us) - [Why Echo Secure](https://echosecure.co.uk/why-echo-secure) - [Contact](https://echosecure.co.uk/contact-us) - [0208 7207 322](tel:+442087207322) - [Penetration Testing](https://echosecure.co.uk/penetration-testing) - Packages - [Phishing Packages](https://echosecure.co.uk/phishing-packages) - [Cyber Protect Packages](https://echosecure.co.uk/cyber-protect-packages) - Resources - [Portal](https://echosecure.co.uk/echo-secure-portal) - [Adversarial Phishing Simulation](https://echosecure.co.uk/adversarial-phishing-simulations) - [APS Kill-Chain](https://echosecure.co.uk/phishing-kill-chain) - [What is Phishing?](https://echosecure.co.uk/what-is-phishing) - [Training Webinars](https://echosecure.co.uk/phishing-awareness-webinars) - [Phishing Glossary](https://echosecure.co.uk/phishing-glossary) - [Compliance Benefits](https://echosecure.co.uk/compliance-benefits) - [Blog](https://blog.echosecure.co.uk) - About - [About Us](https://echosecure.co.uk/about-us) - [Why Echo Secure](https://echosecure.co.uk/why-echo-secure) - [Contact](https://echosecure.co.uk/contact-us) - [0208 7207 322](tel:+442087207322) [Login](https://dev.echosecure.co.uk) ![DSPT 2026-27 evidence items showing pen testing (9.2.1, 9.2.3) exempt for Cyber Essentials Plus, but web applications (9.3.1) not exempt.](https://blog.echosecure.co.uk/hs-fs/hubfs/dspt-9-2-featured-og.png?width=1200&height=630&name=dspt-9-2-featured-og.png) NHS Cyber Essentials DTAC # DSPT 9.2 Pen Testing for NHS IT Suppliers: What Changed for 2026-27 ![Kurtis Baron](https://app.hubspot.com/settings/avatar/309285c67a14ddc7b3853d8abe302b94) Kurtis Baron October 8, 2026 On 1 October NHS England published the [2026-27 mandatory audit areas](https://www.dsptoolkit.nhs.uk/News/170)for the Data Security and Protection Toolkit. If you're an IT supplier to the NHS, twelve of your assertions now go in front of an independent auditor, and one of them is 9.2: "A penetration test has been scoped and undertaken." Most of what's been written since says the same thing. Pen testing is audited now, so book one. That's half right. Depending on your size and what certificates you already hold, you might not need a pen test for the DSPT at all,  and still need one for DTAC.. ## What changed on 1 October For IT suppliers, the 2026-27 audit covers twelve fixed assertions. There's no picking your own. - 1.1 Lawfulness, fairness and transparency - 2.2 Staff contracts set out data security responsibilities - 3.1 Training and awareness - 3.2 Engagement and an open, just culture for incidents - 4.1 A current record of staff and their roles - 6.2 Anti-virus and email protection - 7.1 A planned response to data security incidents - 8.1 Software and hardware surveyed for support status - 8.2 Unsupported software and hardware managed - **9.2 A penetration test has been scoped and undertaken** - 9.6 A well-managed firewall - 10.2 Basic due diligence on suppliers that handle personal information 9.2 isn't new. It was on the supplier audit list for 2024-25, dropped off for 2025-26, and now it's back. If you were a supplier two years ago, you've seen this before. The DSPT deadline is 30 June 2027. NHS England has said audit guidance for the IT supplier areas "will be shared shortly", so expect more detail before then. ## First question: are you even in scope? The DSPT sorts organisations into categories. "Supplier" (Category 2) is for companies that meet **all three** of these: - 50 or more staff - £10m or more turnover - supplying digital goods or services (software or physical) to the NHS or social care If you don't meet all three, you register as "Other" (Category 3). A lot of health-tech companies are Category 3. In the [2026-27 evidence items](https://www.dsptoolkit.nhs.uk/News/169), the pen testing items under 9.2 aren't mandatory for Category 3. They're good practice, not a requirement to reach Standards Met. For a supplier, the DSPT covers the health and care data you process, not your whole business. That detail matters again for Cyber Essentials Plus. So if you're a 20-person medtech start-up reading DSPT headlines and panicking about audits, check your category first. ## What 9.2 actually asks for For Category 2 suppliers there are two mandatory evidence items under 9.2. **9.2.1** is a yes/no with a comment: > The annual IT penetration testing is scoped in negotiation between the SIRO, business and testing team including a vulnerability scan and checking that all networking components have had their default passwords changed to a high strength password. The SIRO is your Senior Information Risk Owner: the senior person, usually at board level, who is accountable for information risk. Assigning SIRO responsibility is itself a mandatory DSPT item (1.3.3), so if you don't have one yet, sort that first. The guidance says to use the comment field to give the date and outline the scope, and that the test should be **since 1 July 2026**. A test you had done in spring won't count for this year's submission. **9.2.3** wants a document: the action plan from your latest pen test, with confirmation that your SIRO (or equivalent) has reviewed it. [NHS England's own guidance on 9.2](https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/data-security-and-protection-toolkit-assessment-guides/guide-9---it-protection/penetration-testing/) fills in what the test should cover: - all webservers the organisation uses - vulnerability scans - checking default passwords on network components have been changed It also says there's an expectation the test covers your critical network structure, such as server farms. If your existing test missed one of the mandatory elements, a top-up test that covers just those is acceptable, provided the SIRO signs off the scope. ## What an auditor is going to look for The supplier audit guidance isn't out yet, but the evidence items tell you most of what you need. If I were auditing 9.2, these are the questions I'd ask. ### Who agreed the scope? The evidence text says scoped "in negotiation between the SIRO, business and testing team". An email from your pen test supplier with a list of IPs is not that. You want a scoping record that shows the SIRO was involved and approved it. ### Does the scope match your health and care data? If your NHS product runs in AWS and the pen test covered your office network, that's a gap. The test should follow the data. ### Were the mandatory elements done? Vulnerability scan, default password checks, all webservers. If the report doesn't say these were covered, the auditor has no way of knowing they were. ### Is it dated since 1 July 2026? Easy to miss if your annual test landed in May. ### Did anyone act on the results? 9.2.3 needs an action plan the SIRO has reviewed. A PDF report sitting in a shared drive isn't an action plan. Owners, dates, and a record of what's been fixed are. A cheap external scan with a logo on the front fails most of these before the auditor even reads the findings. ## The Cyber Essentials Plus exemption I haven't seen this in any of the other write-ups yet. The DSPT gives exemptions for some evidence items if you hold certain certifications. In the 2026-27 evidence spreadsheet for Category 2, both 9.2.1 and 9.2.3 are marked exempt for Cyber Essentials Plus. They're also exempt for PSN IA. They are not exempt for ISO 27001. So if you hold a valid CE+ certificate, you don't answer 9.2 in the toolkit, and the auditor doesn't need to audit it. [NHS England's FAQ](https://www.dsptoolkit.nhs.uk/Help/frequently-asked-questions) says holding CE+ or ISO 27001 reduces the audit to only the evidence items those certifications don't cover. CE+ covers 26 of the 102 mandatory Category 2 items, so that's a decent chunk of your audit gone. There's a catch. The CE+ certificate has to have been awarded in the last 12 months, and its scope has to cover all of your health and care data processing. If your CE+ covers your corporate laptops and Microsoft 365 but your NHS platform sits in a separate cloud tenant that wasn't in scope, the exemption doesn't hold. So before you book a pen test purely for 9.2, look at your CE+ scope. You might be able to widen it and get the exemption instead. ## Why CE+ still isn't a pen test Getting out of 9.2 isn't the same as not needing a pen test. [Cyber Essentials Plus](https://iasme.co.uk/cyber-essentials/) checks the basics: patching, malware protection, account controls, MFA, secure configuration. IASME describes the audit as covering a representative set of user devices, all internet gateways and all servers with services accessible to the internet. It's a good baseline and every NHS supplier should have it. But it doesn't test your application. Nobody on a CE+ assessment is trying to read another customer's records through your API or bypass your login. The DSPT's own guidance makes the same point. It says many organisations have services, "for example web applications", that need controls beyond what Cyber Essentials covers. That matters because the DSPT isn't the only thing NHS buyers check. If you sell a digital health product, the [Digital Technology Assessment Criteria (DTAC)](https://digital.nhs.uk/services/digital-technology-assessment-criteria-dtac/conduct-a-dtac-assessment) applies too. The current form (version 2.0, in use since 6 April 2026) asks for a Cyber Essentials certificate under C3.1. Then C3.3 asks: > If the product is internet based (e.g., website) or is provided as a service accessible from the internet (e.g., Mobile App, server-side software), please provide the summary report of an external penetration test of the product that included Open Web Application Security Project (OWASP) Top 10 vulnerabilities from within the previous 12-month period To pass, the test has to be done by a third party, and the summary report has to show no vulnerabilities scoring 7.0 or above on CVSS. CE+ doesn't satisfy that, because it doesn't test the product. One exception worth knowing: C3.2 asks whether you've signed the Cyber Security Charter for Suppliers to the NHS. If you have, you skip the rest of the C3 questions, including C3.3. If you hold CE+, sell a web-based product into the NHS and haven't signed the charter, you could legitimately skip 9.2 on the DSPT and still need a proper application pen test for DTAC. Plan for both. ![Do you need a pen test for the DSPT, DTAC, or both? Two decision paths: DSPT 9.2 by supplier category and CE+ scope, DTAC C3.3 by internet-facing product and charter status.](https://blog.echosecure.co.uk/hs-fs/hubfs/dspt-9-2-flow.webp?width=2400&height=1350&name=dspt-9-2-flow.webp) ## Scoping one test that covers both If you do need a test, it's worth scoping it once so the same report works for DSPT 9.2 and DTAC C3.3. A reasonable starting scope for an NHS IT supplier: 1. Your product: web application and APIs, tested against the OWASP Top 10 and with authenticated testing across each user role. This is the DTAC part, and it's where the real risk usually is. 2. The infrastructure the product runs on: internet-facing hosts, cloud configuration, and anything that stores or processes health and care data. 3. All webservers you use, not just the product. Marketing site, support portal, anything on your domains. 4. A vulnerability scan of the in-scope estate, reported as part of the test. 5. Default credential checks on network components: firewalls, switches, VPN appliances, management interfaces. 6. A scoping record that shows the SIRO agreed the scope, and a report that states the test date and what was covered. 7. An action plan at the end, with owners and dates, reviewed and signed by the SIRO. Items 3 to 7 are what makes it a DSPT test. Item 1 is what makes it useful. ## The short version - Pen testing (9.2) is back on the DSPT audit list for IT suppliers in 2026-27. Deadline 30 June 2027, with the test dated since 1 July 2026. - It's only mandatory for [Category 2 suppliers](https://www.dsptoolkit.nhs.uk/Help/5): 50+ staff, £10m+ turnover, supplying digital goods or services to the NHS. Smaller firms are Category 3, where it's optional. - A valid CE+ certificate covering all your health and care data exempts you from 9.2. ISO 27001 doesn't. - CE+ isn't an application test. If you sell an internet-facing digital product, DTAC C3.3 still wants a third-party pen test with nothing at CVSS 7.0 or above, unless you've signed the NHS supplier cyber charter. - If you need a test, scope it once to cover both. The supplier audit guidance is due shortly, and I'll update this post when it lands. If you're an NHS supplier working out what you need, [get in touch](https://echosecure.co.uk/contact-us). We're a [pen testing firm](https://echosecure.co.uk/penetration-testing) and a Cyber Essentials certification body, so we can tell you whether CE+, a pen test, or both makes sense for your submission. ## Share this post [mailto:https%3A%2F%2Fblog.echosecure.co.uk%2Fdspt-9.2-pen-testing-for-nhs-it-suppliers-what-changed-for-2026-27](mailto:https%3A%2F%2Fblog.echosecure.co.uk%2Fdspt-9.2-pen-testing-for-nhs-it-suppliers-what-changed-for-2026-27) ## Keep reading ### [![](https://blog.echosecure.co.uk/hs-fs/hubfs/haberdoedas-dRkpLvJNCtI-unsplash.jpg?width=8736&height=11648&name=haberdoedas-dRkpLvJNCtI-unsplash.jpg) Web App Breach Asos A Web App Test Would Not Have Stopped Any of These Retail Breaches](https://blog.echosecure.co.uk/a-web-app-test-would-not-have-stopped-any-of-this-years-retail-breaches) ### [![](https://blog.echosecure.co.uk/hs-fs/hubfs/Resilient%20%20Breached.png?width=2240&height=1260&name=Resilient%20%20Breached.png) 93% of UK CNI Organisations Got Cyber Attacked Last Year: The Basics Are Still Broken](https://blog.echosecure.co.uk/uk-cni-organisations-the-basics-are-still-broken) [![Echo Secure AI Logo](https://blog.echosecure.co.uk/hs-fs/hubfs/Echo%20Secure%20Logo-3.png?width=1250&height=625&name=Echo%20Secure%20Logo-3.png "Echo Secure AI Logo")](https://echosecure.co.uk) - [Terms & Conditions](https://echosecure.co.uk/terms-of-service) - [Privacy Policy](https://echosecure.co.uk/privacy-policy) - [Personal Protection Packages](https://echosecure.co.uk/cyber-security-protection-packages-and-end-user-devices) - [Blog](https://blog.echosecure.co.uk) - [Contact Us](https://echosecure.co.uk/contact-us) **Echo Secure AI Limited** Company Number: 16320764 Address: 86-90 Paul St, London, EC2A 4NE --- ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Kurtis Baron", "url" : "https://blog.echosecure.co.uk/author/kurtis-baron" }, "dateModified" : "2026-10-12T15:28:24.844Z", "datePublished" : "2026-10-08T09:25:49.000Z", "headline" : "DSPT 9.2 Pen Testing for NHS IT Suppliers: What Changed for 2026-27", "image" : [ "https://blog.echosecure.co.uk/hubfs/dspt-9-2-featured-og.png" ], "mainEntityOfPage" : { "@id" : "https://blog.echosecure.co.uk/dspt-9.2-pen-testing-for-nhs-it-suppliers-what-changed-for-2026-27", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.echosecure.co.uk/hubfs/Echo%20Secure%20Logo-3.png" }, "name" : "Echo Secure AI" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://echosecure.co.uk/#organization", "@type" : "Organization", "description" : "UK penetration testing and cyber security firm.", "founder" : { "@id" : "https://kurtisebear.com/#person", "@type" : "Person", "name" : "Kurtis Baron", "url" : "https://kurtisebear.com/" }, "legalName" : "ECHO SECURE AI LIMITED", "logo" : "https://echosecure.co.uk/hubfs/Echo%20Secure%20Logo.png", "name" : "Echo Secure", "sameAs" : [ "https://www.linkedin.com/company/echo-secure-cyber-security/", "https://find-and-update.company-information.service.gov.uk/company/16320764", "https://blog.echosecure.co.uk/", "https://www.github.com/echosecure" ], "telephone" : "+443308081713", "url" : "https://echosecure.co.uk/" } ```