Your buyer has asked how your app is secured

For small UK software teams selling to the NHS, councils or larger businesses. What those buyers check, the part Cyber Essentials does not cover, and where we can help.

Cyber Essentials stops short of your own code

Cyber Essentials (requirements v3.3, April 2026) covers your devices, firewalls, patching and access, and says plainly that bespoke and custom components of web applications are out of scope. So when a buyer asks how your app protects their data, your certificate does not answer the question.

NHS buyers

The NHS Digital Technology Assessment Criteria (DTAC v2.0) ask for a Cyber Essentials certificate and, for internet-facing products, the summary report of an external test by a third party from the last 12 months, covering the OWASP Top 10 and showing no vulnerability scored 7.0 or above. They also ask about adherence to the Software Security Code of Practice. Where you have access to NHS patient data or systems, the Data Security and Protection Toolkit (v9) expects security weaknesses to be assessed, prioritised and fixed in a timely way, with records through to the fix.

Councils and central government

Central government bodies and the NHS check suppliers against set technical requirements on higher-risk contracts. Councils set their own requirements in each tender, so read the tender documents closely before you bid.

Business customers

If your app handles personal data for a customer, you are usually its processor. Under UK GDPR, the customer may only use processors that can show appropriate security measures, and Article 32 lists a process for regularly testing, assessing and evaluating those measures. That is where most security questionnaires come from.

What to have ready

  • A named person who answers security questions about the app
  • A written process for reviewing the app's security, with dates
  • A record of each finding, what you did about it and when
  • Your Cyber Essentials scope, and a clear answer on how the app itself is covered
  • A completed Software Security Code of Practice self-assessment

Where Secvura fits

Find and fix, before or after the questions

Before the questions arrive. Our Application Security Review looks at the app itself, by hand as well as with tools, and ranks every finding by severity and effort to fix, so the serious ones are fixed first. You get the full report for your team and a one-page summary you can share with your customers. £1,200, fixed.

When a test or review has already found issues. A Remediation Sprint can start from that report. We prepare the fixes, you release them, and we retest each one. £1,500 per 20-hour block.

What we don’t do. We do not carry out the third-party test that DTAC asks for, and our review is not a substitute for one. If your buyer needs that report, we’ll say so plainly.

Sources: Cyber Essentials requirements for IT infrastructure v3.3 (NCSC); Digital Technology Assessment Criteria v2.0 and Data Security and Protection Toolkit v9 (NHS England); PPN 014 (Cabinet Office); UK GDPR Articles 28 and 32 (legislation.gov.uk). Checked October 2026. General information, not legal advice.

Want the one-page guide?

We have two short guides: one for NHS and council buyers, one for business customers. Ask for either through the enquiry form and we’ll email it to you. Or tell us what your buyer has asked for, and we’ll tell you honestly whether we can help.

Ask for the guide or a review

See what you would receive first: the sample report, using a made-up company.