Short answer: Category 2 IT suppliers must evidence 102 mandatory items for DSPT 2026-27. Holding Cyber Essentials Plus exempts you from 26 of them; ISO 27001 exempts 20. None of these exemptions covers the independent audit requirement itself (assertion 9.4.5); only prior independent audit does that, and only for the one item. Below is exactly which evidence items each certification covers, so you can see what's genuinely left to do.
If you're deciding which certification to pursue first, or you're already CE+ or ISO 27001 and want to know how much of DSPT that actually buys you, the honest answer is: a meaningful chunk, but not the independent audit itself, and not most of the organisation-specific evidence (your supplier list, your incident response testing, your training records). Certifications shortcut the technical control evidence; they don't replace the governance and NHS-specific evidence DSPT also asks for.
Cyber Essentials Plus maps closely to DSPT's technical control evidence, since both frameworks cover baseline technical hygiene. Holding CE+ exempts these 26 mandatory Category 2 items:
Access and passwords: 4.2.3 (log retention), 4.2.4 (removing unnecessary accounts), 4.5.1 (password policy), 4.5.2 (technical password controls).
Antivirus/anti-malware: 6.2.1, 6.2.3, 6.2.4, 6.2.5 (installation, updates, automatic scanning, blocking malicious sites).
Backups: 7.3.5 (regular restore testing).
Asset and patch management: 8.1.1 (software asset tracking), 8.3.3 (SIRO-agreed patching approach), 8.3.4 (critical/high-risk patch application).
Network components and penetration testing: 9.1.1 (default passwords changed), 9.2.1 (annual pentest scoping), 9.2.3 (SIRO review of pentest results).
End user devices: 9.5.5 (consistent base image), 9.5.6 (centrally managed security settings), 9.5.7 (AutoRun disabled), 9.5.8 (authenticated remote access), 9.5.9 (offline device protection plan).
Firewalls: 9.6.1 through 9.6.6 (boundary firewalls, admin interface lockdown, rule verification, documented justification, regular review, personal firewalls).
ISO 27001's exemptions lean more towards governance and process evidence, reflecting its ISMS-wide scope:
Governance and risk: 1.3.5 (risk register), 9.4.4 (remediation of assurance findings).
People and training: 2.2.1 (data security in employment contracts), 3.1.1 (mandatory training).
Access and identity: 4.2.1 (user account audits), 4.3.1 (system administrator agreements), 4.3.2 (identification and authentication).
Logging and passwords: 4.2.3 (log retention), 4.5.1 (password policy).
Incident response and continuity: 5.1.1 (root cause analysis), 6.1.1 (incident reporting), 6.1.2 (board sign-off on action plans), 7.1.2 (continuity processes), 7.2.1 (incident response plan testing), 7.2.2 (business continuity exercise findings).
Technical controls: 6.2.1 (antivirus), 7.3.5 (backup restore testing), 9.6.1 (boundary firewalls).
Supply chain: 10.1.1 (supplier list), 10.2.4 (outsourced service assurance).
Even stacking all three certifications, a large portion of the 102 mandatory items has no shortcut — because it's either NHS-and-DSPT-specific or organisation-context evidence no external certification is scoped to cover:
In other words: certifications reduce the volume of technical evidence you assemble, but they don't reduce the preparation needed for the independent audit itself, and they don't touch this year's five new or changed items at all.
If you're not currently certified to either, Cyber Essentials Plus gives the larger single exemption (26 items) and tends to be faster and cheaper to achieve than ISO 27001, making it the more common starting point for suppliers working to the 30 June 2027 deadline.
ISO 27001 is worth layering on where your governance and incident response maturity already supports it, or where customers specifically ask for it. The exemption overlap with CE+ is partial, not duplicate, so holding both reduces your evidence burden further rather than doubling up on the same items.
Either way, book early: CE+ assessments and ISO 27001 certification audits both have lead times, and leaving either until close to your DSPT submission date compounds the risk of a rushed, thin evidence base.
Periculo is an IASME-licensed Certification Body for Cyber Essentials and Cyber Essentials Plus, and supports organisations through ISO 27001 certification and DSPT independent audit.
If you want help deciding which certification to pursue first or you want your existing CE+/ISO 27001 evidence formally mapped against your DSPT submission get in touch.
Related reading: NHS DSPT 2026-27: The Complete Guide for Category 2 IT Suppliers, DSPT Independent Audit for Category 2 IT Suppliers, Does DSPT Require Penetration Testing?.