NHS DTAC Penetration Testing & Cyber Essentials
Get DTAC-ready and sell to the NHS with confidence. We are a Cyber Essentials certification body and a CREST-accredited testing team, so your certificate, your penetration test and a DTAC-compatible report come from one partner. Fixed quote in 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
months is the usual age limit NHS buyers set for your latest penetration test report under DTAC, alongside a documented action plan for the findings.
Your NHS Buyer Will Not Sign Until You Clear DTAC
The baseline for NHS buying. The Digital Technology Assessment Criteria is how NHS organisations assess a digital health product before they buy or deploy it. NHS England states that the previous version of the DTAC form should not be used from 6 April 2026. DTAC is a buyer requirement rather than law, but in practice you cannot sell software into the NHS without it. NHS England: DTAC.
What technical security asks for. Evidence that penetration testing has been carried out, typically an annual external test against the OWASP Top 10, a report from the last 12 months, a documented action plan for the findings, and whether the test was internal or by a third party. This is the section where most suppliers get held up, because the evidence cannot be produced overnight.
Cyber Essentials. NHS buyers applying DTAC expect Cyber Essentials certification for products handling patient data, and some ask for Cyber Essentials Plus. We are an IASME certification body, so the certificate and the test come from one team.
Who needs it. Anyone putting a patient-facing app, a clinical SaaS platform or an API that touches NHS data in front of an NHS buyer. If your organisation also handles NHS patient data, the DSPT applies too. See our healthcare penetration testing page for the wider picture.
SCOPE
What We Test for DTAC
Patient-Facing Web Apps
Patient portals, booking and triage front ends. Grey-box testing against the OWASP Top 10: authentication, session handling, access control and data exposure.
Clinical SaaS Platforms
Multi-tenant clinical software used by several NHS organisations. Tenant isolation, role separation between clinicians, admins and patients, and record-level access control.
APIs & Integrations
The APIs behind your product and its integrations with NHS and third-party systems. Object-level authorisation, token handling and integration trust boundaries.
iOS & Android Apps
Patient and clinician mobile apps. OWASP Mobile Top 10, local storage of clinical data, and the server-side controls the app relies on.
AWS / Azure / GCP
Cloud configuration for the environment hosting your product. IAM, encryption, logging and exposed services.
External Infrastructure
Internet-facing hosts and services supporting your product, tested alongside the application.
OUR PROCESS
One Engagement, From Scoping to a Report You Can Submit
Scope in 24 Hours
Tell us your stack (web app, API, mobile, cloud). We return a fixed quote and a clear scope within a day.
Certify & Test
We assess your Cyber Essentials or Cyber Essentials Plus, and our CREST-accredited UK testers run a grey-box assessment against OWASP, in line with NCSC penetration testing guidance.
Report for DTAC
An executive summary and a CVSS-scored technical report, each finding mapped to OWASP, written to drop straight into your DTAC submission and information governance due diligence.
Retest & Confirm
We retest Critical and High findings and confirm closure in writing, so your evidence pack stands up to scrutiny.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST DTAC pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Aligned to Every Framework
Findings map to specific control references in each framework, so your audit team submits the report directly without translation work.
NHS DTAC
Technical security evidence: an independent test, a report from the last 12 months and an action plan for findings.
Cyber Essentials / Plus
Certified directly by us as an IASME certification body.
OWASP Top 10
Every web finding mapped to its OWASP category, the reference DTAC assessors look for.
NHS DSPT
The same test supports Guide 9 (IT protection) of the CAF-aligned toolkit where your organisation completes the DSPT.
UK GDPR
Article 32(1)(d) evidence that you regularly test the effectiveness of your security measures.
ISO 27001
Annex A 8.8 technical vulnerability management, once you declare that control applicable.
PRICING
Indicative Engagement Pricing
Your price is scoped in tester-days and fixed before we start, benchmarked against UK market day rates of £1,100 to £1,400. Free retest, executive summary, walkthrough call and letter of attestation included.
Depends on service + scope
A single web app or API. Grey-box testing against OWASP, a CVSS-scored report and a retest of Critical and High findings.
Get a fixed quoteDepends on service + scope
Web app, API and external infrastructure: the full DTAC technical security evidence pack, with Cyber Essentials or Cyber Essentials Plus and a remediation retest.
Get a fixed quoteDepends on service + scope
A multi-app platform with a cloud review and internal network, for larger digital health vendors with complex NHS deployments.
Get a fixed quoteWHY EJN LABS
What You Get From DTAC Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
Is penetration testing mandatory for DTAC?
DTAC’s technical security section asks for evidence of penetration testing and how regularly it is performed. In practice, NHS buyers expect an independent test against recognised standards such as OWASP before they will progress procurement.
Do I need Cyber Essentials or Cyber Essentials Plus for the NHS?
DTAC expects Cyber Essentials certification for products handling patient data, and some NHS buyers ask for Cyber Essentials Plus. We are a certification body for both, so we can assess and certify you directly.
What is a DTAC-compatible penetration test report?
An executive summary plus a technical report, with each finding mapped to OWASP and scored using CVSS, clear remediation guidance, and confirmation that Critical and High findings have been retested. It is written to slot into your DTAC submission and your NHS buyer’s information governance due diligence.
What is the difference between DTAC and the DSPT?
DTAC is the MOT for a specific vehicle: it assures that one product is fit for purpose before an NHS buyer adopts it. The DSPT is your driving licence: it assures that your organisation is fit to handle NHS patient data, and you renew it every year. Both look for penetration testing evidence. See our DSPT penetration testing page.
How long does a DTAC penetration test take?
For a typical single web application and its API, testing runs over several working days, with your report and retest following shortly after. We confirm exact timescales in your fixed quote within 24 hours.
Is DTAC a legal requirement?
DTAC is the NHS England assessment framework that buyers apply during procurement. In practice NHS buyers will not adopt software without it, and NHS England states that the previous version of the DTAC form should not be used from 6 April 2026.
How often do I need to retest for DTAC?
NHS buyers typically expect a penetration test at least once a year, and again after any significant change to your application. We confirm the right cadence for your product during scoping.
What types of products can you test for DTAC?
Web applications, patient portals, clinical SaaS platforms, iOS and Android apps, APIs, cloud environments on AWS, Azure and GCP, and the supporting infrastructure. See our healthcare penetration testing page.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
From signed scope to active testing in 24 hours where required. Standard pipeline is 3-5 business days from initial scoping call to test start.
Are your testers UK-based and what certifications do they hold?
Every engagement is performed by vetted UK-based CREST-certified testers matched to your engagement based on security clearance, compliance scope, and sector specialism. Testers hold CREST certifications relevant to their discipline (CRT, CCT APP, CCT INF, CCSAM).
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get DTAC-ready before your next NHS deadline
Your NHS buyer’s due diligence will ask for security evidence. Lock in a fixed quote in 24 hours, with a CREST tester on the other end.
