Got a deadline?

We help you close findings before an audit, renewal or contract review.

The detail

What the official sources say, checked on 10 November 2026.

  • Cyber Essentials Plus renewals

    For assessment accounts created after 26 April 2026, the assessment fails automatically if high-risk or critical security updates are not installed within 14 days of release.

    Source: IASME: changes to Cyber Essentials for April 2026

  • MOD suppliers: cyber risk profiles and Defence Cyber Certification

    Under the MOD’s Cyber Security Model, each contract gets a cyber risk profile from Level 0 to 3, usually stated in the invitation to tender. Def Stan 05-138 lists the controls for each level: Cyber Essentials at every level, Cyber Essentials Plus at Levels 2 and 3, and from Level 1 a vulnerability and patch management process with monthly scans. The MOD says suppliers should expect a growing requirement to hold Defence Cyber Certification (DCC), created with IASME. For now, suppliers still complete the MOD’s Supplier Assurance Questionnaire at the required level, with or without DCC. In May 2026 the MOD said it had asked all its industry partners to achieve DCC Level 0, which includes Cyber Essentials, by 31 December 2026.

    Sources: MOD Cyber Security Model (GOV.UK); Def Stan 05-138 Issue 4 (PDF); MOD Defence Digital blog, 8 May 2026

  • NHS suppliers: the DSPT, and Cyber Essentials Plus for NHS Supply Chain

    Any organisation with access to NHS patient data and systems must use the Data Security and Protection Toolkit (DSPT), an annual self-assessment. NHS Supply Chain asks suppliers of IT or digital products and services, and suppliers that handle its personal data, to show Cyber Essentials Plus. That needs an external audit and renewing every year, and one of its five controls is security update management. NHS Supply Chain also accepts plain Cyber Essentials if you share evidence in place of the external audit.

    Sources: Data Security and Protection Toolkit (NHS England); NHS Supply Chain: expectations of suppliers

  • Cyber insurance renewals

    Most cyber insurance policies are re-assessed every 12 months, and buying one may mean giving details of your security controls. The NCSC says it’s up to you to keep those details accurate. If you say measures are in place when they aren’t, the insurer may not be obliged to pay a claim.

    Source: NCSC cyber insurance guidance

What we do. We get the vulnerabilities in your scan results fixed, most urgent first, and give you evidence of what was fixed and when, confirmed by a re-scan. That helps with the patching and vulnerability management part of these checks, for the findings your scans have already reported. Once we’ve finished, running regular scans and patching on time stays with you or your IT provider. We don’t cover the rest of these checks, such as policies, access control or staff training.

We can’t certify you or promise a pass. Only a certification body can certify you, and your customer or insurer makes its own decision.

Tell us your date.

Arrange a free 15-minute review

Contact

Tell us what you need and we’ll arrange a free 15-minute review.

hello@pennward.co.uk

Or email us directly. Don’t attach scan exports yet; we’ll agree a secure way to share them.