Cyber Essentials Plus and ISO 27001 Help DSPT Submission

Which of the 102 Category 2 Evidence Items You Can Skip

Short answer: Category 2 IT suppliers must evidence 102 mandatory items for DSPT 2026-27. Holding Cyber Essentials Plus exempts you from 26 of them; ISO 27001 exempts 20. None of these exemptions covers the independent audit requirement itself (assertion 9.4.5); only prior independent audit does that, and only for the one item. Below is exactly which evidence items each certification covers, so you can see what's genuinely left to do.

Why this matters

If you're deciding which certification to pursue first, or you're already CE+ or ISO 27001 and want to know how much of DSPT that actually buys you, the honest answer is: a meaningful chunk, but not the independent audit itself, and not most of the organisation-specific evidence (your supplier list, your incident response testing, your training records). Certifications shortcut the technical control evidence; they don't replace the governance and NHS-specific evidence DSPT also asks for.

What Cyber Essentials Plus exempts (26 items)

Cyber Essentials Plus maps closely to DSPT's technical control evidence, since both frameworks cover baseline technical hygiene. Holding CE+ exempts these 26 mandatory Category 2 items:

Access and passwords: 4.2.3 (log retention), 4.2.4 (removing unnecessary accounts), 4.5.1 (password policy), 4.5.2 (technical password controls).

Antivirus/anti-malware: 6.2.1, 6.2.3, 6.2.4, 6.2.5 (installation, updates, automatic scanning, blocking malicious sites).

Backups: 7.3.5 (regular restore testing).

Asset and patch management: 8.1.1 (software asset tracking), 8.3.3 (SIRO-agreed patching approach), 8.3.4 (critical/high-risk patch application).

Network components and penetration testing: 9.1.1 (default passwords changed), 9.2.1 (annual pentest scoping), 9.2.3 (SIRO review of pentest results).

End user devices: 9.5.5 (consistent base image), 9.5.6 (centrally managed security settings), 9.5.7 (AutoRun disabled), 9.5.8 (authenticated remote access), 9.5.9 (offline device protection plan).

Firewalls: 9.6.1 through 9.6.6 (boundary firewalls, admin interface lockdown, rule verification, documented justification, regular review, personal firewalls).

What ISO 27001 exempts (20 items)

ISO 27001's exemptions lean more towards governance and process evidence, reflecting its ISMS-wide scope:

Governance and risk: 1.3.5 (risk register), 9.4.4 (remediation of assurance findings).

People and training: 2.2.1 (data security in employment contracts), 3.1.1 (mandatory training).

Access and identity: 4.2.1 (user account audits), 4.3.1 (system administrator agreements), 4.3.2 (identification and authentication).

Logging and passwords: 4.2.3 (log retention), 4.5.1 (password policy).

Incident response and continuity: 5.1.1 (root cause analysis), 6.1.1 (incident reporting), 6.1.2 (board sign-off on action plans), 7.1.2 (continuity processes), 7.2.1 (incident response plan testing), 7.2.2 (business continuity exercise findings).

Technical controls: 6.2.1 (antivirus), 7.3.5 (backup restore testing), 9.6.1 (boundary firewalls).

Supply chain: 10.1.1 (supplier list), 10.2.4 (outsourced service assurance).

What no certification touches

Even stacking all three certifications, a large portion of the 102 mandatory items has no shortcut — because it's either NHS-and-DSPT-specific or organisation-context evidence no external certification is scoped to cover:

• The new 2026-27 items themselves: 4.5.6 (MFA/identity federation in your product), 9.5.11 (Software Security Code of Practice), 9.5.10 (Supply Chain Charter), and the Products and Services declarations.
• The independent audit requirement (9.4.5) — satisfied only if you've already been through an independent audit, not through any certification.
• Data protection and privacy-specific evidence (your Privacy Notice, data flow mapping, DPIA processes).
• NHS-specific operational evidence — your connected medical devices register (where applicable), NCSC Early Warning registration, and your organisation's own incident history and lessons learned.

In other words: certifications reduce the volume of technical evidence you assemble, but they don't reduce the preparation needed for the independent audit itself, and they don't touch this year's five new or changed items at all.

A practical approach

If you're not currently certified to either, Cyber Essentials Plus gives the larger single exemption (26 items) and tends to be faster and cheaper to achieve than ISO 27001, making it the more common starting point for suppliers working to the 30 June 2027 deadline.

ISO 27001 is worth layering on where your governance and incident response maturity already supports it, or where customers specifically ask for it. The exemption overlap with CE+ is partial, not duplicate, so holding both reduces your evidence burden further rather than doubling up on the same items.

Either way, book early: CE+ assessments and ISO 27001 certification audits both have lead times, and leaving either until close to your DSPT submission date compounds the risk of a rushed, thin evidence base.

How Periculo can help

Periculo is an IASME-licensed Certification Body for Cyber Essentials and Cyber Essentials Plus, and supports organisations through ISO 27001 certification and DSPT independent audit.

If you want help deciding which certification to pursue first or you want your existing CE+/ISO 27001 evidence formally mapped against your DSPT submission get in touch.

Related reading: NHS DSPT 2026-27: The Complete Guide for Category 2 IT Suppliers, DSPT Independent Audit for Category 2 IT Suppliers, Does DSPT Require Penetration Testing?.

FAQs