Skip to content
aes-black-logo
huma-black-logo
eql-black-logo
doccla-black-logo
lottie-black-logo
centervue-black-logo
national-trust-black-logo
icare-black-logo
aes-black-logo
huma-black-logo
eql-black-logo
doccla-black-logo
lottie-black-logo
centervue-black-logo
national-trust-black-logo
icare-black-logo

What Does DSCR Assurance Require?

Cyber Essentials Plus

Mandatory under the DSCR Hosting and Infrastructure Standard, with a passed technical verification audit.

ISO/IEC 27001

A valid certificate from a UKAS-accredited certification body, covering your information security management system.

DSPT, Standards Met

A self-assessment published at the level your contract requires, kept current year on year.

Annual Penetration Testing

Online services tested at least once a year, or after any significant change, with continuous monitoring in between.

Data Security Standards

Alignment with National Data Guardian standards and UK GDPR / DPA 2018 compliance.

Patching & Hardening

A documented patch management process and evidence of system hardening.

CREST Penetration Testing

Annual and after-change testing of your online services, carried out by CREST-accredited testers.

right-white-arrow

Cyber Essentials Plus

Certification against the mandatory DSCR Hosting and Infrastructure Standard.

right-white-arrow

ISO 27001

Internal audits, templates and implementation support for your information security management system.

right-white-arrow

NHS DSPT Independent Audit

An independent audit of your DSPT submission, run by our NHS supplier assurance team.

right-white-arrow
DSCR READINESS

Who This Is For

Whether you're renewing your place on the Assured Supplier List or applying for the first time, Periculo brings the certifications and testing together under one team.

Suppliers Already On The Assured Supplier List

You're maintaining DSPT Standards Met, CE+ and ISO 27001 year on year, and want the renewals, testing and ISO 27001 internal audit support run by one team instead of several vendors.

right-white-arrow

Suppliers Applying For The First Time

You're building a case management, care planning or scheduling platform and need the certifications and testing evidence to submit an expression of interest and pass assessment.

right-white-arrow

Get Your DSCR Readiness Roadmap

Tell us where you are today and we'll map out exactly what's needed for Cyber Essentials Plus, ISO 27001, DSPT and penetration testing.

  • One team, one timeline
  • CREST-accredited testing
  • IASME-licensed certification
BOOK A CALL

DSCR Assurance As An Ongoing Managed Service

DSCR compliance isn't a one-off project. Cyber Essentials Plus needs renewing every year, your ISO 27001 management system needs regular internal audits to stay ready for your certification body's annual surveillance visit, your DSPT submission has to be resubmitted annually, and penetration testing must run at least once a year or after any significant change. Treating each of these as a separate, ad-hoc purchase is how suppliers end up scrambling to renew a certification before a deadline, or risk losing their place on the NHS Assured Supplier List.

We're shaping a managed DSCR assurance service that brings all of this together under one ongoing, monthly engagement: a single team managing your Cyber Essentials Plus renewal, ISO 27001 internal audits and implementation support, DSPT resubmission and scheduled penetration testing on a rolling calendar, with one point of contact and a clear view of where you stand against every DSCR requirement at any time.

What's Included In The Managed Service

Cyber Essentials Plus Renewal

Your annual Cyber Essentials Plus assessment, scheduled and managed well ahead of your certificate's expiry date.

ISO 27001 Internal Audits & Support

Scheduled internal audits, templates and hands-on implementation support to keep your ISO 27001 management system ready for your certification body's annual surveillance visit.

Annual DSPT Resubmission

Your DSPT self-assessment reviewed and resubmitted every year, kept at the Standards Met level your contract requires.

Scheduled Penetration Testing

Annual penetration testing of your online services, plus testing after any significant change, with continuous monitoring in between.

Patch & Hardening Evidence

Ongoing collection of patch management and system hardening evidence to keep your DSCR audit trail current.

One Team, One Point Of Contact

A single team managing every DSCR requirement on a rolling calendar, instead of several vendors and renewal dates to track yourself.

Talk To Us About DSCR Assurance

Ready to get started?

Contact us today to discuss how we can help secure your digital health organisation.

Contact Us

FAQ’s

What is DSCR (Digital Social Care Records)?+
DSCR is the NHS standards framework that digital social care record software suppliers must meet to join the NHS Assured Supplier List, covering security, data and interoperability requirements.
Do I need Cyber Essentials Plus for DSCR?+
Yes. Cyber Essentials Plus is a mandatory requirement under the DSCR Hosting and Infrastructure Standard.
Does DSCR require penetration testing?+
Yes. Online services must be penetration tested at least annually, or after any significant change, with continuous monitoring in between.
What's the difference between DSCR and DSPT?+
DSPT is the NHS-wide data security self-assessment that all suppliers handling NHS data complete. DSCR is a specific standards framework for social care record software, which references DSPT alongside Cyber Essentials Plus, ISO 27001 and penetration testing.
How do I join the NHS Assured Supplier List for DSCR?+
Submit an expression of interest to the DSCR assurance team, then evidence compliance against the published DSCR Standards.
Do you offer DSCR compliance as an ongoing managed service?+
Yes. We provide a managed DSCR assurance service that brings together Cyber Essentials Plus renewal, ISO 27001 internal audit support, annual DSPT resubmission and scheduled penetration testing under one ongoing, monthly engagement, so you're never scrambling to renew a certification before a deadline.