ISO 27001 consultants for NHS and healthcare suppliers

Start with the finding that matters most, because it is the opposite of what a site funded by ISO 27001 consultancies would be expected to say: ISO 27001 does not replace the NHS Data Security and Protection Toolkit, and it cannot be submitted instead of it.

At a glance: what buyers in this sector ask for

What the toolkit is, and who has to complete it

The NHS Data Security and Protection Toolkit is, in its own words, an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards.

On who must use it, the toolkit is equally direct: all organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly.

That is a wider net than people expect. It is not only clinical suppliers. If your product touches patient data or connects to NHS systems — a scheduling tool, a document platform, an analytics service — you are inside it, and the assurance is an annual submission rather than a one-off.

The toolkit in 2026: versions, dates and independent assessment

The toolkit changes every year, so the version matters as much as the submission. On the toolkit site as of September 2026: the 2025-26 (version 8) standard is the one the current independent assessment guides reflect, and the 2025-26 guides for IT Suppliers are valid “until the DSP Toolkit deadline” of 30 June 2026. The next version, Data Security and Protection Toolkit 2026-27 version 9, was published on 8 September 2026.

Independent assessment is not an afterthought for suppliers. The toolkit publishes “Guidance for DSPT independent assessment or audit providers, including auditors for IT Suppliers, OES Independent providers, Genomics organisations, NHS Trusts (Acute, Foundation, Ambulance and Mental Health), Integrated Care Boards, Commissioning Support Units and DHSC Arm’s Length Bodies.” IT Suppliers are named first.

For an ISO 27001 holder, the audit discipline is familiar — the same evidence, sampled by someone independent — but the criteria are the toolkit’s, not the standard’s. Check the current version for your organisation type on the toolkit itself; dates and requirements change between versions.

Where ISO 27001 actually helps

Holding ISO 27001 does not exempt you from anything, and any consultancy suggesting otherwise is worth a second look. What it does is reduce the amount of separate evidence you have to assemble, because work already done for the management system can be reused against toolkit items rather than produced again.

The overlap is real and it is not trivial. A risk assessment and risk treatment plan, an access control policy with evidence of review, an incident management process with records of use, supplier controls, business continuity arrangements, staff awareness training records: all of these exist because clauses 6 to 10 and Annex A required them, and all of them are things the toolkit asks about.

The submission itself is still yours to make, annually, and the parts of the toolkit that have no ISO 27001 counterpart — the ones written specifically around NHS data and NHS systems — are still work.

The certification most NHS procurement actually names

The certificate the government’s procurement policy names is Cyber Essentials or Cyber Essentials Plus, not ISO 27001, and NHS bodies are inside the scope of that policy.

This ordering surprises people who assume the bigger standard subsumes the smaller one. It does not, for procurement purposes. Cyber Essentials is a defined scheme with a defined assessment, and a buyer specifying it wants that specific assessment. The policy note itself says: “The ISO27001 standard is widely used but companies that attain this standard will not automatically conform to Cyber Essentials. This is because it is not usual for all of the five technical controls in Cyber Essentials to be included in the scope for ISO27001 implementation. It is also unlikely that any of these controls will be tested for ISO27001. Therefore most businesses with ISO27001 will have to adopt Cyber Essentials in addition to ISO27001 or demonstrate equivalent controls are in place.”

One order for a supplier starting from nothing (our reading): Cyber Essentials, then Cyber Essentials Plus if the contract requires it, then the toolkit submission, and ISO 27001 where a customer specifically asks for it or where you are selling outside the NHS as well. Doing ISO 27001 first and discovering it does not satisfy the requirement is an expensive and entirely avoidable order of operations.

What an assurance pack for a trust can need

Requirements vary between trusts and between frameworks, and the only reliable method is to read the specific one you have been sent rather than a general guide, including this one. That said, the recurring shape of the ask is:

• A current toolkit submission, if you touch patient data or NHS systems.
• Cyber Essentials or Cyber Essentials Plus, where the contract or framework specifies it.
• Evidence about the specific product, not the company in general — which is why the scope on any certificate matters more here than almost anywhere else.
• Answers about where data is processed and stored, and about sub-processors.
• Clinical safety documentation, where the product is a health IT system. This is a separate discipline from information security and needs separate people.

Ask the trust or the framework, in writing, which of these they require, before buying any of them. It is one email, and it can save you buying the wrong certificate.

Three separate clocks, and they do not line up

The thing that catches suppliers in this sector is not any single requirement. It is that there are several, each with its own date, and none of them shares a date with the others.

The toolkit has its own submission deadline, set nationally. Cyber Essentials and Cyber Essentials Plus run from whenever you happened to certify, and the scheme keeps a public register of which certificates are current. ISO 27001 runs on its own cycle: a surveillance audit in each of years one and two, recertification in year three, all scheduled around your certification body’s availability rather than around anything NHS-related.

Three clocks, three owners, and in most small suppliers the same one or two people behind all of them. The failure is rarely a decision to let something lapse. It is that a Cyber Essentials certificate quietly expires six weeks before a framework renewal asks for it, and the reassessment cannot be compressed into the gap.

The fix is unexciting and effective: one calendar, owned by a named person, with all three renewal dates and a reminder well ahead of each — far enough ahead to book an assessment, not just to notice. If you are certified to ISO 27001, this belongs inside the management system rather than beside it. Clause 9.3 requires a management review, and the status of external assurance obligations is exactly the kind of thing that review exists to surface while there is still time to act on it.

What this does not change

Whatever sits on top, the arithmetic underneath is the same for every sector. Audit days come from ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21) and are a function of the people inside your scope, your sites and your complexity. Surveillance is one third of the initial audit every year and recertification is two thirds in year three. Your certification body cannot be your consultant, and cannot do the internal audit clause 9.2 requires.

Work out the cost for your headcount, or see the full audit-day table.

Common questions