CE+ for NHS trusts: from months of preparation to an afternoon

The Cyber Essentials Plus assessment process for an NHS trust has historically followed a predictable and time-consuming pattern. The IT governance team identifies the upcoming assessment date. They begin preparing 3–4 months in advance. Evidence collection starts — screenshots from multiple cloud consoles, patch status reports from endpoint management tools, firewall rule exports, access control lists. The compliance team chases engineers for documentation. Evidence is assembled manually into a format the assessor can use.

Then the assessment happens. Findings emerge. Remediation begins. The cycle repeats next year.

How ZAP changes this

ZAP changes this fundamentally. Not because it eliminates the need for Cyber Essentials Plus — CE+ remains a mandatory requirement for NHS contracts and any organisation processing NHS data. But because it monitors CE+ compliance continuously and generates evidence from live data on demand.

Five CE+ technical areas

The five CE+ technical areas — firewalls and gateways, secure configuration, user access control, malware protection and patch management — are monitored by ZAP continuously across Azure, AWS and GCP. The compliance score for each area is live at all times. Drift from the CE+ baseline is detected within minutes. Findings have remediation generated automatically.

Evidence in seconds

When the assessment period arrives, the evidence pack is generated in seconds. The PDF contains the current compliance status for all five technical areas, with finding detail for any controls that are below the required threshold and remediation records for any findings that have been resolved. The assessor receives complete, current, signed documentation that reflects the actual state of the estate at the time of generation.

The DSPT connection

The DSPT connection matters here. NHS DSPT annual submission requires evidence across 10 mandatory standards. Several of these standards overlap directly with CE+ technical controls — particularly Standard 10 (cyber security), which references CE+ compliance as the baseline for NHS cyber security assertions. Organisations that maintain continuous CE+ compliance through ZAP are simultaneously maintaining the foundation of their DSPT annual submission.

Compounding value

For NHS trusts managing multiple annual compliance submissions — DSPT, CE+ renewal, NCSC CAF assessment and potentially CQC inspection evidence — the compounding value of continuous governance is significant. Each submission draws from the same ZAP evidence base, generated from live data, always current. The compliance team's time is freed from evidence assembly and redirected to the governance decisions that actually require human judgment.