NHS suppliers face a specific proof problem: contracts and framework agreements (G-Cloud, DPS, direct NHS trust contracts) increasingly demand evidence of penetration testing before you get anywhere near a signature, and generic "we ran a scan" reports don't satisfy procurement teams anymore.
Why this matters
NHS procurement teams don't just ask "have you been tested" — they ask for scope, tester accreditation, remediation timelines, and re-test evidence tied to your Data Security and Protection Toolkit (DSPT) submission. A test report sitting in a folder does nothing for you in 2026 if it isn't linked to your current DSPT status and your Cyber Essentials Plus certificate.
Suppliers who get this wrong lose contracts at the due diligence stage, not the pricing stage. Cyber Essentials Plus for NHS suppliers covers the certification side; this guide covers what to buy, what to skip, and what a penetration test actually needs to prove for an NHS buyer.
Who this is for
This is for software vendors, IT service providers, and medical device or clinical systems suppliers selling into NHS trusts, ICBs, or NHS England frameworks — companies with 10 to 250 staff who are past their first DSPT submission and now need a defensible penetration testing programme, not a one-off scan bought to tick a procurement box.
What to look for in penetration testing for NHS suppliers
Scope matches your actual attack surface
A test scoped to "the website" when your product handles patient-adjacent data through an API and a mobile app is not a real test — it's a compliance placeholder. Ask for scope that covers every system that touches NHS data or connects to an NHS network, not just the public-facing login page.
Tester accreditation NHS buyers recognise
CREST and CHECK accreditation carry weight with NHS trusts because they map to known methodology standards. An unaccredited freelance tester might do fine technical work, but procurement teams flag the missing accreditation during due diligence and it slows the deal.
Findings mapped to remediation, not just severity
A report listing 40 findings by CVSS score tells a procurement reviewer nothing about your actual risk posture. What matters is a remediation plan with dates — closed, in progress, accepted risk — because that's what DSPT assertions and CE+ renewal both ask you to produce.
Retest included in the same engagement
A test without a retest is half a test. NHS buyers increasingly ask for evidence that critical and high findings were fixed and verified, not just identified. Build the retest into the original statement of work rather than treating it as a follow-on cost.
Frequency that matches your release cadence
Annual testing is the floor for most NHS supply chain requirements in 2026, but if you ship major releases quarterly, an annual test misses three-quarters of your changes. Match test cadence to how often your attack surface actually changes.
Evidence format procurement teams can actually use
A 90-page PDF buried in jargon doesn't move a security questionnaire forward. Ask for an executive summary, a findings table, and a remediation status page that maps cleanly to the questions in security questionnaire automation for procurement teams — the format NHS buyers are used to seeing.
Top picks for NHS supplier penetration testing scope
External infrastructure penetration test — the baseline pick. Covers internet-facing servers, firewalls, VPNs, and remote access points. This is the minimum scope Cyber Essentials Plus and most DSPT assertions expect, and it's the first thing an NHS procurement reviewer checks for. If your last external test is more than 12 months old in 2026, treat that as a red flag on your own file. Buy.
Web application penetration test — the one procurement teams ask for first. Covers authentication, session handling, input validation, and API endpoints on anything patient-facing or NHS-network-facing. For SaaS suppliers this usually carries more real risk than the infrastructure test, because the application layer is where most breaches actually happen. Buy.
Internal network and segmentation test — the wildcard. Useful if you hold NHS data on internal systems or if a trust specifically asks about lateral movement risk following a breach elsewhere in the sector. Not every supplier needs this in year one, but it becomes relevant fast once you're handling data for more than two or three trusts. Consider.
Cloud configuration review — the one people skip and regret. A dedicated review of AWS, Azure, or GCP configuration against CIS benchmarks catches misconfigured storage buckets and over-permissioned roles that a standard pentest scope often misses entirely. If your product runs in the cloud and holds any NHS-adjacent data, this closes a gap a generic pentest leaves open. Consider.
Social engineering and phishing simulation — the one that looks impressive but rarely moves the needle. It tests staff awareness, not your product's attack surface, and most NHS procurement questionnaires don't ask for it directly. Useful for internal training, low priority for closing a supplier contract. Skip unless a specific trust requests it.
What to avoid
- A "compliance scan" sold as a penetration test. Automated vulnerability scanning is not manual exploitation testing, and NHS procurement reviewers who've seen enough reports can tell the difference from the executive summary alone.
- A tester with no named accreditation on the report. If the report doesn't state CREST, CHECK, or an equivalent recognised scheme, expect a procurement reviewer to ask for a redo before the deal closes.
- A one-off test with no retest and no renewal plan. NHS buyers check the date on your last test as often as they check the findings — a stale report is treated the same as no report.
"A test without a retest and a remediation date attached is just a list of problems, not evidence you've closed them."
Verdict comparison table
| Test type | Matches DSPT/CE+ baseline | Priority for 2026 | Verdict |
|---|---|---|---|
| External infrastructure | Yes | Must-have | Buy |
| Web application | Yes | Must-have | Buy |
| Internal network/segmentation | Partial | Situational | Consider |
| Cloud configuration review | Partial | Situational | Consider |
| Social engineering simulation | No | Low | Skip |
Running your compliance evidence — DSPT status, Cyber Essentials Plus certificate, pentest remediation tracker — through one platform instead of three spreadsheets is what OneClickComply automates for growing NHS suppliers, so the procurement team gets one clean answer instead of a folder of PDFs.
Frequently asked questions
One last thing
The supplier detail that actually moves NHS procurement decisions isn't the pentest report itself — it's whether your remediation tracker still shows open critical findings from last year. A clean current report next to a stale one from 18 months ago with unresolved items is a worse look than having no historical report at all.