NHS DTAC Compliance Support

Get your digital health product ready for the technical security questions in the NHS Digital Technology Assessment Criteria.

The Digital Technology Assessment Criteria (DTAC) is the framework NHS and adult social care buyers use to assure digital health technologies before they adopt them. If you supply software to health and care organisations in England, you will be asked for a completed DTAC form and the evidence behind it.

Samurai Security helps digital health suppliers with the technical security side of DTAC: Cyber Essentials certification, independent penetration testing of your product, and practical advice on the controls assessors look for. We have worked with NHS organisations, and we talk your team through every finding so you can answer buyers' questions with confidence.

Discuss DTAC Support

Get a Quote

Two colleagues looking at a computer screen

What Is DTAC?

DTAC covers five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility. It brings together the standards and policies a digital health product must meet to be used in the NHS, so that products are checked consistently.

NHS England published a revised DTAC form (version 2.0) on 24 February 2026, with fewer questions and less duplication with the Data Security and Protection Toolkit (DSPT). From 6 April 2026 suppliers must provide version 2.0 when asked, and the previous version should not be used. DTAC applies alongside other requirements, such as the DSPT, ICO registration and medical device regulation, rather than replacing them.

Door handle with a keypad lock on a wooden door

Why Prepare for DTAC?

Health and care buyers use DTAC to decide whether a product is safe to adopt. Gaps in the technical security evidence, such as missing certification or no recent independent test, can delay procurement or stop it altogether.

Preparing early means you can answer the technical security questions with current evidence, fix weaknesses before an assessor or customer finds them, and reuse the same evidence for the DSPT and other customer due diligence.

How We Help

Cyber Essentials and Cyber Essentials Plus

Support to achieve and maintain Cyber Essentials certification, correctly scoped to the systems and services behind your product.

Product penetration testing

CREST-accredited testing of your web application, APIs, mobile apps and cloud hosting, with a report and summary you can share with buyers.

Technical security readiness review

A review of the controls the technical security section asks about, such as your plan for multi-factor authentication on all account types, logging and monitoring, and secure development in line with the DSIT and NCSC Software Security Code of Practice, with practical recommendations.

DSPT support

Help with the security elements of the Data Security and Protection Toolkit where your organisation has access to NHS patient data or systems.

Secure development

Secure code review and developer training, so security is built into future releases and your evidence stays current. The DTAC form asks you to confirm that your software is produced in line with the Software Security Code of Practice.

Retesting and ongoing assurance

Re-verification of fixes and periodic testing as your product evolves. Retesting is scoped to the number of findings to re-verify and quoted up front.

Our Approach

01

Discovery

We review your product, hosting and current security evidence against the technical security questions you need to answer.

02

Plan

We agree a prioritised plan covering certification, testing and any control improvements, with a clear scope and cost at £1,350 per consultant day.

03

Testing and certification

We carry out the agreed penetration testing and support your Cyber Essentials certification.

04

Report and debrief

You receive a full technical report and a summary suitable for sharing with buyers, and we talk your team through the findings and fixes.

Why Choose Samurai Security?

CREST-accredited penetration testing

Your product is tested by a CREST-accredited team, giving buyers confidence in the independence and quality of the test.

01

Experience in health

We have supported NHS organisations, including helping enable secure remote working.

02

Certification and testing together

Cyber Essentials, penetration testing and security advice from one team, so your DTAC evidence fits together.

03

Our Work

Aerial view of a residential housing estate

Strengthening Cybersecurity Resilience

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

Enabling Remote Work for the NHS

“When I have a problem nobody else can solve, I call Samurai because I know that they’ll deliver what I need, every time, without fail.”

Incident Response Retainers To Enable Growth

“This partnership has allowed us to scale and grow with the confidence that we are protected from cyber threats around the clock.”

Client Testimonials

“Samurai takes the time to understand our needs and helps us to be an enabler for Flagship Group’s mission. It’s always a pleasure to work with them and I’d recommend them to others.”

“We were astonished by what Samurai’s Black Dragon assessment revealed, even though we thought we had everything covered. The findings spoke for themselves, and the team’s expertise and clarity were outstanding.”

"Samurai’s Black Dragon: Attack Surface Risk Assessment was exactly what we needed and something we’ve never seen done before. They turned it around quickly, highlighted risks that could have easily been overlooked, and gave us a clear roadmap for improvement."

Frequently Asked Questions

Who needs to complete DTAC?

Suppliers of software-based digital health technologies used by the NHS and adult social care in England are asked to complete DTAC by the organisations buying their products. The health or care organisation carries out the assessment.

Does DTAC require a penetration test?

For most internet-facing products, yes. In the current DTAC form (version 2.0), a valid Cyber Essentials certificate is a pass requirement. If your product is internet based or provided as a service over the internet, you must also provide the summary report of an external penetration test by a third party, carried out within the previous 12 months, that covered the OWASP Top 10 and shows no vulnerabilities scoring 7.0 or above on CVSS. Suppliers who have signed the Cyber Security Charter for Suppliers to the NHS skip the remaining technical security questions. Always check the current DTAC form for the exact evidence required.

Which version of the DTAC form should we use?

NHS England published version 2.0 of the DTAC form on 24 February 2026. Until 6 April 2026 buyers could accept either version; from 6 April 2026 suppliers must provide version 2.0 when asked, and the previous version should not be used. Download the form from NHS England at the point of use to make sure it is current.

Does DTAC replace the DSPT?

No. DTAC applies alongside other requirements, including the Data Security and Protection Toolkit, which organisations with access to NHS patient data or systems must also complete.