Cyber Essentials for UK NHS suppliers Certified by Fig Group.
Fig Group certifies UK suppliers to the NHS - software vendors, MSPs supporting trusts, and service providers that handle NHS patient or organisational data. IASME-licensed, from £299.99 + VAT, with a six-working-hour Basic guarantee for complete, compliant submissions before midday on a UK Business Day, subject to terms. Tailored to the DSP Toolkit and NHS supplier framework reality.
Sector-specific
Tailored to nhs suppliers
The scheme requirements apply across sectors; implementation and contractual context differ. These are the scope, regulatory, and supplier-cascade points Fig Group assessors check first.
- 01DSP Toolkit evidence and applicable Cyber Essentials Plus exemptions.
- 02NHSmail access and SCN / HSCN network scoping.
- 03Health and care information processing in the scope boundary.
- 04Patient data protection and the regulatory obligations applicable to the organisation.
- 05NHS framework supplier requirements (increasingly require CE or CE Plus).
- 06DSPT + CE + ISO 27001 alignment pathways.
Pricing at a glance
Below the standard IASME fee at every tier
Three free rounds of Basic assessor feedback included. Published pricing - no gated forms or consultancy add-ons. If gaps remain after the included rounds or assessment period, agree any further support or new purchase before incurring a charge. Read the assessment terms.
Turnaround
6 working hours
Complete, compliant Basic submissions before midday on a UK Business Day; terms apply.
Cyber Essentials
£299.99 - £549.99
+ VAT, by organisation size.
Cyber Essentials Plus
£1,499.99 - £4,499.99
+ VAT, third-party verified.
Common questions
Frequently asked questions
Does Cyber Essentials satisfy the DSP Toolkit?
Cyber Essentials does not replace the DSP Toolkit. Toolkit treatment depends on your organisation type, assessment version and certificate scope. NHS guidance describes exemptions for some questions where qualifying Cyber Essentials Plus evidence is recorded; do not assume a Basic certificate automatically completes an assertion.
Do NHS trusts require their suppliers to hold CE?
Check the actual NHS contract, tender and supplier-assurance requirements. These can specify Cyber Essentials, Plus or other evidence. Do not infer a universal certificate requirement from NHS supplier status alone.
What scope should an NHS-supplier SaaS use?
Include relevant production cloud services alongside corporate devices, accounts and other services handling organisational data. ISO certification does not automatically exclude hosting from Cyber Essentials. Establish the provider/customer control split and agree any justified separately managed subset with the assessor.
Do we need CE or CE Plus for NHS contracts?
The tender or contract determines the required assurance and scope. Check its wording and the applicable DSP Toolkit requirements before choosing Basic or Plus.
How fast can NHS-supplier CE be completed?
The Basic guarantee is six working hours for a complete, compliant submission before midday on a UK Business Day, subject to the certification terms. Preparation, clarification and remediation are separate; tell us the actual tender deadline before ordering.
Sources: NCSC requirements v3.3, PPN 014, certification terms. NHS DSP Toolkit guidance.
Deep-dive articles
Long-form guidance for nhs suppliers
Technical guidance written by an IASME-licensed assessor - scope edge cases, supplier cascade, and regulatory overlap that the scheme guidance does not cover.
Next step
Ready to certify?
From £299.99 + VAT. IASME-licensed. Typically within 6 working hours. No consultancy add-ons.