Cyber Essentials for care homes gets asked for by local authorities, NHS commissioners, and insurers before a contract gets signed — not after a CQC inspection flags a gap. This guide breaks down which certification route actually fits a care setting in 2026, and which one just looks compliant on paper.
Why this matters
Care homes run on devices that leave the building. Care staff carry tablets on rounds, log medication on phones, and access cloud-based care-planning systems from home broadband that nobody in the office controls.
That's exactly the attack surface Cyber Essentials was built to cover. Commissioners know it too — local authority frameworks and NHS-funded placements increasingly list a valid certificate as a contract condition, not a nice-to-have, going into 2026.
Platforms built to automate Cyber Essentials certification exist because most care providers don't have a dedicated IT security team to chase evidence manually. That gap is the whole reason this guide exists.
Who this is for
This is written for care home operators, domiciliary care agencies, and social care providers who need a Cyber Essentials certificate to win or retain a contract in 2026 — and for the office manager or ops lead who just got told to "sort it out" with no security background.
If you're managing a single care home with a handful of shared laptops and a cloud rota system, the guidance below applies directly. If you're running a multi-site group, the same principles scale — the scoping just gets bigger.
What to look for in Cyber Essentials for care homes
Coverage of mobile and remote devices
Care staff use phones and tablets outside the building constantly — medication logs, care plan updates, incident reports. Any Cyber Essentials scope that doesn't explicitly include these devices is incomplete and will get flagged by an assessor or, worse, missed by one who doesn't understand care delivery.
Cloud-hosted care management systems
Most care providers now run electronic care planning software rather than paper files. That system, and the accounts that log into it, sit inside your Cyber Essentials boundary whether you remembered to scope them or not.
The boundary with your IT support provider
Many care homes outsource IT to a third party. Cyber Essentials still requires you to know what firewall configuration, patching cadence, and admin access controls that provider maintains on your behalf — you can't hand off the responsibility just because you handed off the task.
Starter and leaver processes
Care is a high-turnover sector. Every new starter needs an account provisioned correctly and every leaver needs access revoked promptly — assessors check this because a dormant login for a care worker who left three months ago is exactly the kind of gap attackers use.
Alignment with NHS DSPT and CQC evidence
The NHS Data Security and Protection Toolkit and CQC inspections both ask about data security, but neither one automatically satisfies Cyber Essentials — and Cyber Essentials doesn't automatically satisfy them either. Treat the three as related but separate requirements.
Renewal cadence
Cyber Essentials certification is valid for 12 months. Treating it as a one-off badge rather than an annual habit is the single most common reason providers show up to a tender deadline with an expired certificate.
Automate your Cyber Essentials evidence
OneClickComply handles annual renewal and audit evidence collection end-to-end.
Top picks: the certification routes that actually work
Cyber Essentials (self-assessed) — the non-negotiable baseline. This is the standard route: a self-assessed questionnaire covering five technical control themes — firewalls, secure configuration, user access control, malware protection, and patch management. Most care contracts in 2026 name this as the minimum bar. Verdict: Buy.
Cyber Essentials Plus — the one commissioners actually verify. This adds an external technical audit on top of the same five control areas, giving assessors independent proof rather than a self-reported answer. NHS and local authority commissioners increasingly ask for this tier specifically because self-assessment alone is easy to get wrong. Reading through certification bodies compared before you pick one saves a re-audit. Verdict: Buy.
Renewal automation — the step every provider forgets. A certificate issued in 2025 expires in 2026, and the evidence you gathered last year doesn't carry over automatically. Providers who treat renewing Cyber Essentials certification each year as a scheduled task rather than a scramble keep their contracts intact without a gap in cover. Verdict: Buy.
A one-off consultant PDF — the expensive shortcut. Paying a consultant to produce a certificate once, with no system for tracking device changes, new starters, or next year's renewal, leaves you exactly where you started twelve months later. It looks like compliance on the day it's issued and nowhere near it by the next audit cycle. Verdict: Skip.
What to avoid
- Assuming NHS DSPT covers Cyber Essentials. Commissioners can and do ask for both — they're not interchangeable frameworks, even though they overlap on data security basics.
- Letting the certificate lapse mid-contract. Cyber Essentials runs on a 12-month cycle. A lapsed certificate discovered during a contract review is harder to explain than one that was never obtained.
- Scoping out care staff's personal or BYOD devices. If a care worker's own phone accesses the rota app or care records, it's in scope. Leaving it out doesn't make it safer, it just makes the certificate inaccurate.
Verdict comparison
| Route | Assurance level | Who checks it | Renewal | Verdict |
|---|---|---|---|---|
| Cyber Essentials (self-assessed) | Baseline | Self-reported, reviewed by certifying body | Annual | Buy |
| Cyber Essentials Plus | Higher — external audit | Independent technical assessor | Annual | Buy |
| Renewal automation / ongoing evidence | Maintains whichever tier you hold | Internal process, audit-ready | Continuous | Buy |
| One-off consultant PDF | Point-in-time only | Nobody, after issue | None built in | Skip |
Frequently asked questions
One last thing
Cyber Essentials only covers the systems and devices your organisation actually manages. A rota app run by a third-party developer with a poor patching record can still leave a care home exposed, even while the certificate itself stays valid — read the boundary of your certification as carefully as the controls inside it.