ISO 27001 · Information security

ISO 27001 information security for digital health suppliers

We help health tech companies and NHS suppliers build an ISO 27001 information security management system that buyers trust and your team can run.

Tell us what you need Book a free call Read guides

DigiSafe team member presenting a Safe by Design session

What is ISO 27001?

ISO 27001 is the international standard for information security management systems (ISMS). It shows buyers you manage risks to the data you hold in a structured, audited way.

DTAC does not mandate ISO 27001, but it asks for strong technical security evidence. We align your ISMS with DTAC, the Data Security and Protection Toolkit and Cyber Essentials so the evidence works everywhere.

What we deliver

Gap analysis against ISO 27001 with a clear plan
Scope, information security policy and ISMS build
Information security risk assessment and treatment
Statement of Applicability and supporting controls
Alignment with DTAC, DSPT and Cyber Essentials
Internal audit and certification readiness

Frequently asked questions

Is ISO 27001 required for NHS contracts?

Not always, but many NHS buyers request it or equivalent evidence. It strongly supports your DTAC and DSPT answers.

How does ISO 27001 relate to DTAC?

DTAC asks for technical security evidence. An ISO 27001 ISMS gives you a structured way to provide it.

Can you work with our existing security team?

Yes. We work alongside your team and build on what you already have.

Related services

Talk to an Expert

Book a free call with a DigiSafe expert. We'll scope the work, timelines and the right partnership, plain English, no jargon.

Direct clinical access

Meet the team, Clinical Safety Officers, DPOs & Medical Device Experts.

Multi-disciplinary lived experience across nursing, GP, paramedic, pharmacy, medical devices and data protection. Book a discovery call and we'll match you with the right expert.