Cyber Essentials is the UK government backed baseline of five technical controls, while ISO 27001 is an international management standard covering your whole approach to information risk. Most small and medium UK businesses should start with Cyber Essentials, while organisations handling sensitive data, international contracts or complex supply chains often need ISO 27001 as well. Many organisations end up holding both, using each for a different purpose.
What Cyber Essentials covers and how certification works
Cyber Essentials is backed by the National Cyber Security Centre (NCSC) and renews annually, giving your business a clear, fixed baseline to measure against each year. It focuses on five technical controls that address the most common routes attackers use to break into an organisation:
- Firewalls: boundary controls that block unauthorised network access.
- Secure configuration: removing default accounts and unnecessary software from devices.
- Security update management: applying patches promptly to close known vulnerabilities.
- User access control: limiting account privileges to what each person actually needs.
- Malware protection: detecting and blocking malicious software before it spreads.
There are two certification levels. Cyber Essentials itself is a verified self-assessment: you complete a questionnaire and an independent assessor checks your answers. Cyber Essentials Plus adds independent technical testing of your actual systems, giving customers and insurers stronger proof that the controls work in practice rather than existing only on paper.
Scope matters more than most businesses expect; having a clear confidential waste policy for SMEs in the UK is an important part of managing your information assets effectively. Your whole infrastructure needs to be covered, including cloud services and any devices or accounts managed by a third-party IT provider. Excluding parts of your estate without good reason weakens the assurance the certificate is meant to provide.
What ISO 27001 requires beyond a technical checklist
ISO 27001 asks you to build an Information Security Management System (ISMS), a structured, risk-based way of identifying threats, deciding how to treat them and reviewing that decision over time. The standard’s clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and continual improvement, so certification checks your management approach as much as your technical setup.
Certification is carried out by accredited conformity assessment bodies operating under ISO/IEC 27001 and accreditation frameworks such as ISO/IEC 27006. Assessors expect to see documented evidence: a risk register, management review records, defined policies and operational controls that match what you actually do day to day.
- A risk register that identifies, scores and tracks treatment of information security risks.
- Management review meetings that show leadership actively oversees the ISMS.
- Documented policies covering access, incident handling, supplier management and more.
Pro Tip: Treat ISO 27001 documentation as a working record of decisions, not paperwork produced once for the auditor; assessors can usually tell the difference.
ISO 27001 tends to suit organisations with complex supply chains, sensitive client data or international customers who expect a recognised, auditable management system rather than a point-in-time technical check. ISO 27001 remains applicable to organisations of any size, though the effort to implement it scales with how much data and how many processes you have.
How controls, assurance and audits differ in practice
Cyber Essentials Plus testing involves external and internal vulnerability scans and hands-on testing of a representative sample of devices, gateways and internet-facing servers. Any failed test needs remediation and retesting before the certificate is issued, so the assurance is tied to a specific snapshot of your technical estate.
ISO 27001 audits work differently in three practical ways:
- Initial certification audit: assessors examine your risk assessment process, documented controls and evidence that the ISMS has actually been running, not just designed.
- Surveillance audits: shorter annual checks that confirm the management system is maintained between full recertification cycles.
- Scope and remote working: home devices, personally managed cloud accounts and MSP-run infrastructure all need to be addressed explicitly, since a gap in scope definition is one of the most common reasons organisations fall short of what customers expect from the certificate.
Procurement is where these differences bite. Public sector contracts frequently specify Cyber Essentials as a minimum, while insurers and larger corporate clients increasingly ask for ISO 27001 where contracts involve sensitive data or long-term supplier relationships.
Costs, timelines and what to budget for
Basic Cyber Essentials certification starts from £320 plus VAT, with Cyber Essentials Plus priced individually according to the size and complexity of your network. That headline fee is only part of the picture for most businesses.
A UK government process evaluation estimated the mean total spend on achieving Cyber Essentials certification at around £4,941, covering consultancy support, remediation work and any hardware or software changes needed to meet the five controls. Costs vary considerably depending on how far your existing setup is from the baseline.
ISO 27001 carries additional cost layers:
- Certification body fees for the initial audit and ongoing surveillance audits.
- Consultancy or internal staff time to build and document the ISMS.
- Remediation costs for technical and procedural gaps uncovered during risk assessment.
Timelines reflect that difference in depth. Cyber Essentials can be completed in days to a few weeks, Cyber Essentials Plus typically takes several weeks once testing is scheduled, and ISO 27001 projects commonly run from several months to over a year depending on organisational size and existing maturity.
Choosing between them: a practical decision framework
Start with what is actually being asked of you. If a client, tender or insurer names a specific requirement, that answer usually settles the question before you need to weigh anything else.
- Procurement deadline: if a contract or tender requires a credential soon, Cyber Essentials is the faster route to satisfy it.
- Data sensitivity: organisations handling sensitive personal data, financial records or international client information often need the deeper assurance ISO 27001 provides.
- Customer and insurer demands: some cyber insurance policies and larger corporate clients specifically request ISO 27001 rather than Cyber Essentials.
- Internal capability: ISO 27001 needs sustained internal ownership (a risk register, policy reviews, management meetings), which smaller teams may need to resource carefully.
If you need a quick, recognised credential for procurement, get Cyber Essentials in place first. If you are building long-term market advantage or facing a systemic set of security requirements, plan ISO 27001 as the next stage rather than a replacement.
When pursuing both, agree scope with your assessor before any assessment work begins: a mismatch between what you think is in scope and what the certificate actually covers is one of the most common sources of disappointment for both the business and its customers.
Pro Tip: Ask any assessor or consultant exactly which parts of your infrastructure, including cloud accounts and third-party managed systems, will be included in scope before signing off on a quote.
Before engaging a consultant, ask what evidence they expect you to produce, how they handle retesting after a failed control, and whether their quote covers remediation or only the assessment itself. A vague answer to any of these is worth treating as a red flag.
Our view on getting certification-ready
We have built our managed IT and cyber security services around a Security by Default approach, treating protection as a standard part of every support package rather than an optional extra. That focus on small and medium-sized enterprises means we understand the practical gap between where most SME infrastructure sits and where either certification expects it to be.
Useful starting tasks include agreeing the scope of your IT estate, running a gap assessment against the five Cyber Essentials controls, building a remediation road map for anything that falls short, and scoping an ISMS early if ISO 27001 is the longer-term goal.
How we can support your certification readiness
Getting ready for Cyber Essentials or ISO 27001 usually means tackling the same technical groundwork either way: patched devices, controlled access, monitored endpoints and clear policies your team actually follows. That overlap is where a managed support partner saves you time rather than adding another project to track.
- Gap assessments against the five Cyber Essentials controls to identify what needs attention first.
- Endpoint and patch management to keep devices updated and configured to the standard assessors expect.
- Managed detection and response for ongoing monitoring once controls are in place.
- Project oversight to keep a certification timeline realistic alongside day-to-day IT demands.
If you want a clearer picture of where your current setup stands, our managed cyber security service is built to support exactly this kind of readiness work, alongside our wider managed IT support for the infrastructure work certification depends on. Get in touch for a readiness conversation before you commit to an assessment date.
FAQ
Is Cyber Essentials equivalent to ISO 27001?
No. Cyber Essentials checks five specific technical controls, while ISO 27001 certifies an organisation-wide management system covering risk assessment, policies and continual improvement. They are often complementary rather than interchangeable, with many organisations holding both.
Which cyber security certification is best in the UK?
There is no single best option: it depends on what your customers, insurers or contracts actually require. Cyber Essentials suits most SMEs and procurement needs, while ISO 27001 suits organisations needing deeper, auditable risk management.
Is ISO 27001 mandatory in the UK?
ISO 27001 certification is voluntary in the UK, though specific contracts, tenders or client relationships may require it as a condition of doing business. Many organisations pursue it for competitive or supply chain reasons rather than legal obligation.
Is NIST used in the UK?
Some UK organisations reference US-originated NIST frameworks for internal risk guidance, particularly where they work with American clients or suppliers, but UK certification schemes such as Cyber Essentials and ISO 27001 remain the recognised standards for most domestic procurement and insurance purposes.
