ISO 27001, Cyber Essentials and NHS DSPT on one platform
You can run ISO 27001, Cyber Essentials and the NHS Data Security and Protection Toolkit (DSPT) from one platform, because they ask for evidence in many of the same control areas. Naq is a UK compliance platform for companies selling into the NHS and other regulated buyers. All three frameworks cover firewalls and malware protection, and ISO 27001 and the DSPT also share staff training, incident response and supplier checks. Naq holds one set of controls, maps each control to every requirement it meets across the three, and keeps the evidence in one library, attached to the controls it supports.
The platform does not replace the people who assess you. A Cyber Essentials certificate is issued by an IASME-licensed Certification Body. The DSPT is a self-assessment your organisation publishes to the toolkit each year. An ISO 27001 certificate comes from a certification body after its audit.
Where do ISO 27001, Cyber Essentials and the DSPT overlap?
The three were written by different bodies for different jobs. Cyber Essentials is the NCSC's certification scheme, built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The DSPT is NHS England's annual self-assessment against the National Data Guardian's 10 data security standards, which every organisation with access to NHS patient information must complete. ISO 27001 sets the requirements for an information security management system (ISMS), and its companion standard, ISO/IEC 27002, gives guidance on controls including access control, cryptography, human resource security and incident response.
NHS England has published part of the mapping itself. Its 2026-27 guidance for IT suppliers lists the DSPT evidence items covered by a Cyber Essentials Plus certificate and those covered by an ISO 27001 certificate. Once it is confirmed that the certificate's scope covers all the health and care data you process, those items need no further auditing.
| Shared control area | What Cyber Essentials asks | What the DSPT asks (2026-27, IT suppliers) | Exempt from further DSPT audit (NHS England, October 2026) |
|---|---|---|---|
| Boundary firewalls | A firewall protecting every device in scope | 9.6.1: firewalls on all boundaries of the internal network | Cyber Essentials Plus (9.6.1 to 9.6.6) and ISO 27001 (9.6.1) |
| Malware protection | Anti-malware or application allow listing on every device in scope | 6.2.1: anti-malware on every computer that can connect to the internet | Cyber Essentials Plus (6.2.1, 6.2.3 to 6.2.5) and ISO 27001 (6.2.1) |
| Software assets | Not a separate control, though the NCSC says asset management helps meet all five | 8.1.1: how you track and record software assets and their configuration | Cyber Essentials Plus |
| Testing | Plus adds independent testing that the five controls work in practice | 9.2.1 and 9.2.3: an annual penetration test, with results reviewed by the SIRO | Cyber Essentials Plus |
| Security updates | Critical and high-risk updates applied within 14 days of release | 8.3.4: critical and high-risk patches applied within 14 days, or the risk signed off by the SIRO | Not on the list |
| Access and multi-factor authentication | MFA wherever available, and always for cloud services | 4.5.3: MFA on all remotely accessible and privileged accounts | Not on the list |
| Staff contracts and training | Outside the five controls | 2.2.1: security terms in every employment contract; 3.1.1: a training needs analysis | ISO 27001 |
| Incident response and continuity | Outside the five controls | 7.1.2 and 7.1.3: continuity of services in a data security incident, and the resources to respond | ISO 27001 |
| Suppliers | Outside the five controls | 10.2.3 and 10.2.4: security clauses in supplier contracts, and a record of which security duties sit with outsourced and cloud suppliers | ISO 27001 |
Read the last column with three points in mind. The list is NHS England's audit exemption list for IT suppliers, corrected on 13 October 2026. A certificate earns the exemption only when its scope covers all the health and care data you process, so an ISO 27001 certificate held by the IT department alone does not. And the exemptions belong to Cyber Essentials Plus: basic Cyber Essentials is not on the list.
The rows not on the list are where a shared control does the most work. Cyber Essentials and the DSPT both set a 14-day limit for critical and high-risk updates, and both ask for MFA, so one control with one set of evidence can serve the assessor and the toolkit. Some of the DSPT sits outside both lists. The record of what personal data you hold and who you share it with (1.1.2), for example, is evidenced in the toolkit whatever certificates you hold.
Which companies are asked for two or more of the three?
Four kinds of buyer, each with a different mix.
- NHS data and systems suppliers. Companies that handle NHS patient data or connect to NHS systems without making clinical software, such as health data, workforce and patient communication platforms. Every organisation with access to NHS patient information must complete the DSPT, and its published status shows in the toolkit's organisation search. Cyber Essentials usually sits alongside it.
- Digital health companies whose software is used in NHS care. Cyber Essentials and the DSPT usually sit alongside DTAC and DCB 0129, which Naq also covers.
- B2B software companies selling to enterprise and regulated buyers. SaaS firms whose customers ask for ISO 27001 or send a security questionnaire before signing. Cyber Essentials usually sits alongside ISO 27001, and those with access to NHS patient information must complete the toolkit as well.
- The stretched compliance owner. One person carrying two or more certificates, with the same evidence collected for each.
How does Naq run the three from one set of controls?
Naq is your virtual compliance partner: governance, risk and compliance (GRC) software for companies selling into regulated buyers. Its approach is one control, mapped once and counted in every framework it meets.
One set of controls. Choose ISO 27001, Cyber Essentials and the NHS DSPT as your frameworks and map each control once. Each control shows every requirement it meets across the frameworks you hold, so the work you do for one counts towards the others.
Evidence held once. Evidence sits in one Evidence Library, attached to controls, and counts wherever that control is mapped. Training records count as evidence too. Evidence checks run on a schedule, and a control drops back to needs review when its evidence expires.
A scope for each framework. Each compliance instance has its own scope: the whole organisation, a site, a division, a product or a contract. That matters here, because the DSPT for IT suppliers covers the health and care data they process, and the NHS exemptions depend on what your certificates cover.
Requirement by requirement. Follow each framework requirement by requirement and see what is covered and what still needs work. A requirement marked not applicable carries a written justification, and the decision is logged. The readiness overview shows where you stand across all three.
Policies, training and risks in the same record. Policies start from templates already mapped to your frameworks, and the approved version goes to everyone who must read and acknowledge it. Courses expire and prompt a retake. Risks are scored on a 5×5 matrix with treatment plans linked to controls, and incidents and corrective actions sit in the same record. When Naq publishes a new version of a framework, you are notified and prompted to migrate.
Naq AI drafts and suggests. It never runs on its own: every scan, summary or draft starts from a button a person pressed, and nothing reaches your compliance record until a named team member approves it.
See multi-framework management for the detail, or the Naq platform for everything else in the record.
What does a person still have to do?
The Naq platform holds the controls, evidence and approvals. The assessments, and the decisions inside them, belong to people.
Cyber Essentials. A board member or equivalent signs off your answers. An assessor working for an IASME-licensed Certification Body marks them, and the Certification Body issues the certificate. Naq is licensed by IASME as a Certification Body, and using its platform does not award a certificate. Cyber Essentials Plus adds independent testing of your systems by a Certification Body that IASME has licensed for the Plus audit. Both certificates expire after 12 months.
NHS DSPT. Your organisation completes its own self-assessment and publishes it to the toolkit. The 2026-27 edition, version 9, is due by 30 June 2027. A company with 50 or more staff and a turnover of £10m or more that supplies digital goods or services to the NHS or care completes the toolkit as an IT supplier. To reach Standards Met, an IT supplier also needs an independent DSPT audit, and an ISO 27001 or Cyber Essentials Plus certificate reduces that audit's scope.
ISO 27001. A certification body audits your ISMS and issues the certificate. In the UK, UKAS accredits certification bodies, and its CertCheck service verifies UKAS-accredited management system certificates.
Inside Naq, every decision goes to the right person on your team to approve, and each approval is kept on the record.
What Naq's partner network provides
Some of the work needs a named person. Bring your own, or use a named expert from Naq's partner network. The network includes firms for information security and internal audit, NHS assurance for the DSPT and DTAC, data protection through an outsourced DPO, and clinical safety through a named Clinical Safety Officer who is a registered clinician. You can meet them before you commit. Whoever holds the role records their review or sign-off inside your Naq record, so it stays in the audit trail.
"Naq helped us complete our Cyber Essentials and DSPT toolkit applications. I already know next year's DSPT Toolkit will be easy with Naq."
Otesa, NHS supplier
To see ISO 27001, Cyber Essentials and the DSPT run from one set of controls, book a demo.
Frequently asked questions
Can one platform manage ISO 27001, Cyber Essentials and the NHS DSPT together?
Yes. All three cover firewalls and malware protection, and ISO 27001 and the DSPT also share staff training, incident response and supplier management. Naq is a UK compliance platform that holds one set of controls, maps each control to every requirement it meets across the three, and keeps the evidence in one library so it is added once.
Does using Naq earn a Cyber Essentials certificate?
No. Using the Naq platform does not award a certificate. Cyber Essentials certificates are issued by Certification Bodies licensed by IASME, the NCSC's Cyber Essentials Delivery Partner, after an assessor marks your answers. Naq is licensed by IASME as a Certification Body. The platform holds the controls and evidence you prepare for the assessment.
Does ISO 27001 or Cyber Essentials Plus cover the DSPT?
Partly. NHS England lists the DSPT evidence items for IT suppliers that each certificate covers, including firewalls and anti-malware for both, penetration testing for Cyber Essentials Plus, and staff contracts, training, incident response and supplier items for ISO 27001. The exemption applies only when the certificate covers all the health and care data you process. You still complete and publish the rest of the toolkit yourself.
Is the DSPT assessed in the same way as ISO 27001 and Cyber Essentials?
No. The DSPT is a self-assessment that your organisation completes and publishes to the toolkit every year, with the 2026-27 edition due by 30 June 2027. IT suppliers also need an independent DSPT audit to reach Standards Met. ISO 27001 and Cyber Essentials are certificates issued by certification bodies after their own assessment.
Do I need Cyber Essentials Plus to complete the DSPT?
No. NHS England's toolkit guidance states that Cyber Essentials Plus is not mandatory. Holding it exempts some evidence items and reduces the scope of an IT supplier's DSPT audit, as long as the certificate covers all the health and care data you process.
Who needs ISO 27001, Cyber Essentials and the DSPT at the same time?
Usually a UK company that sells to the NHS and to enterprise or other regulated buyers, because each side asks for something different. The DSPT applies where a company has access to NHS patient information, and other customers may ask for ISO 27001 or Cyber Essentials before signing. That can be an NHS data or systems supplier, a digital health company whose software is used in NHS care, or a B2B software company.
