Cyber security audit for dental practices (UK)

Unavoidably Secure carries out independent cyber security audits for UK dental practices. We check what an attacker can see from the internet, how your website handles patient data and consent, your data protection paperwork, and the evidence from your IT provider, then map it to the NHS DSPT, Cyber Essentials and UK GDPR. It starts with a free external audit; a full audit is from £950.

Why dental practices need a UK-specific audit

Much of what you find online about dental cyber security is written for the United States and its HIPAA rules. UK practices answer to different requirements: the NHS Data Security and Protection Toolkit (DSPT) for any practice with NHS work or NHS systems, UK GDPR and the Data Protection Act for the patient data every practice holds, PECR for marketing messages and website cookies, and often Cyber Essentials when a commissioner or insurer asks for it.

Our audit is built around those UK standards. Every finding is tied to the standard it affects, so the report doubles as evidence for your DSPT submission.

What is checked

1. External attack surface

Everything about the practice reachable from the internet, assessed without any access to your systems: encryption and certificates, email impersonation protection (SPF, DKIM and DMARC), browser protections, software with known vulnerabilities, and forgotten test or staging sites.

2. Cookies, trackers and consent

We load your website in a real browser and record what happens before anyone agrees to anything: cookies set before consent, whether refusing is as easy as accepting, third-party trackers, and whether your cookie policy matches what the site actually does.

3. Governance documentation

The half no scanner reaches, and where most of the real risk sits: processing records, privacy notice, retention, supplier contracts, breach readiness, impact assessments, and all ten DSPT standards.

4. Internal systems

Firewall, device encryption, patching, access control and multi-factor authentication, and backup isolation. We assess these on evidence your IT provider produces, and no active testing happens without your signed written authorisation.

That adds up to 26 automated technical checks and 59 documentation review criteria, covering all ten National Data Guardian standards and all five Cyber Essentials controls.

What we commonly find

The most common gap is email. In our England dental practice email security benchmark, public DNS checks run on 16 October 2026 found that 90% of 3,325 dental practice websites (3,004 practices) could be impersonated by email, because their DMARC record was missing or set to monitor only. Only 6% had SPF, DKIM and an enforced DMARC policy. In Yorkshire and the Humber the figure for dental practices was 91% (220 of 243).

The NCSC explains that DMARC lets you tell receiving mail servers how to handle email that fails SPF or DKIM checks. Without an enforced policy, a fake email that claims to come from your practice is usually delivered. You can check your own domain in seconds with our free email security check.

Other frequent findings are cookies and trackers loading before consent, missing or out-of-date supplier contracts, and gaps in the evidence the DSPT asks for, such as staff training records and a digital asset register.

What it costs

If you also need to submit the DSPT, see DSPT support for dental practices. For how these fees compare with Cyber Essentials certification costs, see cyber security audit costs.

How the audit runs

1. A free 30-minute scoping call about what you hold and who asks you to prove it.
2. The free external audit and written report.
3. Written authorisation agreeing exactly what will be tested and when.
4. The full audit, usually two to three weeks.
5. A plain-English walkthrough of the report, with your IT provider present if that helps.
6. A re-test at 60 days.

We are independent: your IT provider carries out the fixes and we check and evidence them. We refer out physical security, in-depth manual penetration testing (to a CREST-registered partner) and legal advice. We are not a Cyber Essentials certification body, and no assessment certifies compliance with any standard.

Common questions

This page is general information, accurate at the time of writing (October 2026), and is not legal advice. No assessment certifies compliance with any standard. Unavoidably Secure is not a Cyber Essentials certification body. Fees are fixed and quoted after a scoping call.