Yearly vs Monthly
Choose the right plan for your organisation's needs.
Yearly Assurance
Cyber Essentials, Cyber Essentials Plus, Penetration Test, DSPT Audit, Internal Audits, Vulnerability Scanning...
From £10,000/Per Year
Monthly Assurance
Cyber Essentials, Cyber Essentials Plus, Penetration Test, DSPT Audit, Internal Audits, Vulnerability Scanning...
From £900/Per Month
Built for two types of NHS suppliers.
Whether you're maintaining your current NHS supply chain status or building toward your first NHS contract, the compliance requirements are the same.
You're already in the supply chain and need to stay there.
You hold DSPT Standards Met and CE+ and you know they need renewing every year. Right now that probably means managing three or four separate vendor relationships, uncoordinated renewal dates, and invoices that land when you least expect them.
The Security Assurance Programme consolidates everything under one team on a single annual programme, billed monthly. Nothing changes in terms of what you're required to do. Everything changes in how much effort it takes to do it.
The compliance bar for NHS IT suppliers has risen significantly.
NHS England has taken a more active stance on supplier security posture following a pattern of supply chain attacks on NHS organisations over the past three years. The regulatory requirements have tightened in parallel. Read our NHS supply chain security briefing →
PPN 014
Cyber Essentials Plus is now mandatory
NHS IT suppliers are required to hold Cyber Essentials Plus certification. Enforced under PPN 014 as part of NHS procurement and a condition of supply chain participation.
NHS Standard Contract Clause 21.2
DSPT Standards Met is a contractual requirement
Organisations that fail to achieve or maintain DSPT Standards Met status risk losing existing NHS contracts. Annual renewal is a condition of doing business as an NHS supplier.
DSPT Clause 9.4.5
Category 2 IT suppliers require an independent audit
DSPT clause 9.4.5 mandates a mandatory independent audit for Category 2 IT suppliers as part of annual DSPT submission. The 2025/26 deadline is 30 June 2026.
Everything an NHS IT supplier needs, under one team.
The Security Assurance Programme packages the mandatory annual assurance activities for NHS supply chain compliance. Scope is confirmed during onboarding, if something isn't applicable, it's removed, and the price adjusts accordingly.
FAQ
WE HAVE A VARIETY OF SERVICES SPECIFIC TO ENSURING THE SECURITY OF YOUR MEDICAL DEVICES.
The Security Assurance Programme is a structured annual service that helps organisations meet NHS supply chain security requirements. It combines Cyber Essentials certification support, NHS DSPT guidance, and independent security testing into one managed programme with predictable monthly costs.