UK healthcare guide · NHS England routes
Which security testing
does your healthcare project need?
A product assessment, an organisational test and an NHS API onboarding review can require different evidence. Identify the routes that apply, then prepare a scope that covers the right systems.
Start with your context
Identify what applies
to your organisation.
| Your situation | Why it matters | What to establish |
|---|---|---|
| DTAC: product assurance | You are assessing a digital health product for use in England, including relevant in-house development. | Confirm the current Digital Technology Assessment Criteria (DTAC) form, product/version and assessor. DTAC covers more than technical security; a pentest contributes to one part of the wider assessment. |
| DSPT: organisational assurance | Your organisation has an applicable Data Security and Protection Toolkit submission. | Confirm the submission category, reporting year, scope and any relevant assurance exemptions. A product-only test does not automatically assess the organisation’s wider IT. |
| NHS API onboarding | You are integrating with a particular NHS service. | Read that service’s onboarding criteria. For example, e-RS section 2.5 specifies CHECK/CREST provider accreditation, scope and report expectations. Other APIs may have different conditions. |
More than one route may apply. This guide focuses on NHS England requirements; other UK health systems and private healthcare projects may follow different arrangements.
Requirements to confirm
Check the specific
evidence conditions.
| Route | Testing requirement | Planning implication |
|---|---|---|
| DTAC v2.0 C3.2–C3.3 | Confirm the C3.2 supplier-charter route first. Where C3.3 applies to an internet-accessible product, it asks for an external product test covering OWASP Top 10 from the preceding 12 months; the report must show no CVSS 7.0+ vulnerabilities. | Agree product/version coverage and evidence with the assessor. Allow for remediation and retest evidence if needed. Read the DTAC guidance. |
| DSPT v9 · applicable Category 2 supplier route | Evidence 9.2.1 concerns annual organisational IT testing scoped with the senior information risk owner (SIRO), business and testing team. Evidence 9.2.3 concerns senior review and an action plan. | Confirm your submission category, reporting period and exemptions. Include the required organisational scope rather than assuming a single product test covers it. View the DSPT v9 requirements page. |
| e-RS API onboarding | Section 2.5 specifies CHECK/CREST provider accreditation and coverage across the application/API, including input handling, configuration, integrations and reporting. | Confirm provider eligibility before booking. Plan for fixes and the NHS review as well as delivery of the report. Read the e-RS requirements. |
Make the scope concrete
Prepare the information
your assessment needs.
| Area | What to prepare | What this helps define |
|---|---|---|
| Route and decision | Record the product, version, assurance route and the person responsible for confirming the evidence requirements. | A clear purpose for the test, including whether it is product-level, organisational or part of integration onboarding. |
| Systems and boundaries | List applications, APIs, infrastructure and integrations relevant to that route, including who can authorise testing. | Coverage that matches the required scope, with omissions and third-party dependencies made explicit. |
| Environment and information | Prepare representative roles, accounts and synthetic records. Describe constraints around patient information and clinical operations. | An agreed environment and operating plan that reflect the assessment objectives and permitted access. |
| Provider and evidence | Confirm required provider credentials, report format, coverage, age of evidence and handling arrangements. | A check before booking that the proposed assessment can supply the type of evidence the route requires. |
| Fixes and review | Identify remediation owners and allow time for fixes, retesting and the relevant assurance review before your decision date. | A delivery plan that includes the work after the first report, without assuming automatic acceptance. |
Useful outputs
Ask for evidence
you can act on.
Your MurtaSec report includes an executive summary, a summary of findings and detailed findings with descriptions, reproduction steps, remediation steps and references. Confirm any additional evidence your assurance route requires before booking. Keep organisational review and action-plan evidence where your route calls for it. NHS England’s assessment guidance also covers in-house products and technical-security oversight by roles such as the CISO and CTO.
Common questions
Resolve the decisions
before testing starts.
Does signing the NHS supplier charter remove the need for security testing?
DTAC v2.0 C3.2 provides a route through the form: a Yes answer skips the remaining C3 questions. It does not remove separate DSPT, contractual, API-onboarding or other security obligations. Confirm all routes that apply to your project.
Does every NHS-related test need a CHECK or CREST provider?
Do not assume the same credential applies to every route. e-RS onboarding expressly names CHECK/CREST accreditation; DTAC C3.3 does not name that credential. Confirm the requirements for the engagement before choosing a provider.
Will a pentest complete our DTAC assessment?
No. DTAC includes clinical safety, data protection, interoperability, usability and accessibility as well as technical security. NHS England does not currently endorse third-party DTAC certification schemes; the test supplies technical evidence within the agreed scope.
Sources & related guidance
Check the source
for your requirement.
Reviewed 25 September 2026. The current DTAC v2.0 form and DSPT v9 supplier workbook were checked for this guide. Confirm the form, submission category and service-specific criteria again when commissioning.
Let’s plan
your assessment.
Tell us about the system you need assessed, the questions you want answered and any specific requirements. We can help you shape a practical scope.