ISO 27001 consultants for NHS and healthcare suppliers

Start with the finding that matters most, because it is the opposite of what a site funded by ISO 27001 consultancies would be expected to say: ISO 27001 does not replace the NHS Data Security and Protection Toolkit, and it cannot be submitted instead of it.

What the toolkit is, and who has to complete it

The NHS Data Security and Protection Toolkit is, in its own words, an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards.

On who must use it, the toolkit is equally direct: all organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly.

That is a wider net than people expect. It is not only clinical suppliers. If your product touches patient data or connects to NHS systems — a scheduling tool, a document platform, an analytics service — you are inside it, and the assurance is an annual submission rather than a one-off.

Where ISO 27001 actually helps

Holding ISO 27001 does not exempt you from anything, and any consultancy suggesting otherwise is worth a second look. What it does is reduce the amount of separate evidence you have to assemble, because work already done for the management system can be reused against toolkit items rather than produced again.

The overlap is real and it is not trivial. A risk assessment and risk treatment plan, an access control policy with evidence of review, an incident management process with records of use, supplier controls, business continuity arrangements, staff awareness training records: all of these exist because clauses 6 to 10 and Annex A required them, and all of them are things the toolkit asks about.

The submission itself is still yours to make, annually, and the parts of the toolkit that have no ISO 27001 counterpart — the ones written specifically around NHS data and NHS systems — are still work.

The certification most NHS procurement actually names

If the requirement you have been sent names a certificate at all, it is more often Cyber Essentials or Cyber Essentials Plus than ISO 27001, because that is what the government’s procurement policy specifies. NHS bodies are inside the scope of that policy.

This ordering surprises people who assume the bigger standard subsumes the smaller one. It does not, for procurement purposes. Cyber Essentials is a defined scheme with a defined assessment, and a buyer specifying it wants that specific assessment. Some NHS buying organisations state in terms that ISO 27001 will not be accepted in its place.

The practical order for a supplier starting from nothing is usually: Cyber Essentials, then Cyber Essentials Plus if the contract requires it, then the toolkit submission, and ISO 27001 where a customer specifically asks for it or where you are selling outside the NHS as well. Doing ISO 27001 first and discovering it does not satisfy the requirement is an expensive and entirely avoidable order of operations.

What an assurance pack for a trust usually needs

Requirements vary between trusts and between frameworks, and the only reliable method is to read the specific one you have been sent rather than a general guide, including this one. That said, the recurring shape of the ask is:

• A current toolkit submission, if you touch patient data or NHS systems.
• Cyber Essentials or Cyber Essentials Plus, where the contract or framework specifies it.
• Evidence about the specific product, not the company in general — which is why the scope on any certificate matters more here than almost anywhere else.
• Answers about where data is processed and stored, and about sub-processors.
• Clinical safety documentation, where the product is a health IT system. This is a separate discipline from information security and needs separate people.

Ask the trust or the framework, in writing, which of these they require, before buying any of them. It is one email and it prevents the most common expensive mistake in this sector.

Three annual clocks, and they do not line up

The thing that catches suppliers in this sector is not any single requirement. It is that there are several, each renews annually, and none of them shares a date with the others.

The toolkit is an annual submission with its own deadline, set nationally. Cyber Essentials and Cyber Essentials Plus expire twelve months after certification, so their clock starts on whatever day you happened to certify. ISO 27001 runs on its own cycle: a surveillance audit in each of years one and two, recertification in year three, all scheduled around your certification body’s availability rather than around anything NHS-related.

Three clocks, three owners, and in most small suppliers the same one or two people behind all of them. The failure is rarely a decision to let something lapse. It is that a Cyber Essentials certificate quietly expires six weeks before a framework renewal asks for it, and the reassessment cannot be compressed into the gap.

The fix is unexciting and effective: one calendar, owned by a named person, with all three renewal dates and a reminder well ahead of each — far enough ahead to book an assessment, not just to notice. If you are certified to ISO 27001, this belongs inside the management system rather than beside it. Clause 9.3 requires a management review, and the status of external assurance obligations is exactly the kind of thing that review exists to surface while there is still time to act on it.

What this does not change

Whatever sits on top, the arithmetic underneath is the same for every sector. Audit days come from ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21) and are a function of the people inside your scope, your sites and your complexity. Surveillance is one third of the initial audit every year and recertification is two thirds in year three. Your certification body cannot be your consultant, and cannot do the internal audit clause 9.2 requires.

Work out the cost for your headcount, or see the full audit-day table.

Common questions