In short: Cyber Essentials vs ISO 27001 comes down to depth. Cyber Essentials is a UK government-backed baseline of five technical controls, assessed and renewed every year. ISO/IEC 27001:2022 is an international standard for a risk-based information security management system, audited by an accredited body over a three-year cycle. Many organisations hold Cyber Essentials first, then add ISO 27001.
The core difference
Cyber Essentials asks a specific question: are your devices, accounts and cloud services configured to resist common, untargeted attacks? It sets out five technical controls (firewalls, secure configuration, security update management, user access control and malware protection) and checks you meet them. It is run by the NCSC, delivered by IASME, and assessed by Certification Bodies that IASME licenses.
ISO/IEC 27001 asks a broader question: do you run a management system that identifies your information security risks and treats them appropriately, and keeps improving? It covers leadership, risk assessment, policies, people, suppliers, physical security and technology. The current edition is ISO/IEC 27001:2022, and its Annex A reference set of controls is grouped into organisational, people, physical and technological themes. You choose which controls apply based on your risk assessment.
Put simply: Cyber Essentials proves a minimum technical standard; ISO 27001 proves a working security management process.
Side-by-side comparison
| Cyber Essentials | ISO/IEC 27001 | |
|---|---|---|
| Type | Technical baseline certification | Information security management system (ISMS) standard |
| Owner | UK government (NCSC), delivered by IASME | International standard published by ISO and IEC |
| Recognition | Mainly UK, strongly linked to UK public sector and supply chains | International |
| Scope | Whole organisation or a well-defined sub-set; end-user devices and cloud services must be included | Defined by you in the ISMS scope statement |
| Controls | Five fixed controls, the same for everyone | Risk-based selection from Annex A, justified in a Statement of Applicability |
| Assessment | Verified self-assessment marked by an assessor; Plus adds hands-on testing | Two-stage certification audit by an accredited certification body |
| Certificate cycle | Expires after 12 months; renew each year | Typically a three-year cycle with surveillance audits in between |
| Governance and policy | Not assessed | Central: leadership, objectives, internal audit and management review |
| Typical effort | Days to weeks | Months to implement, then continual effort |
| Cost drivers | Organisation size, remediation and Plus testing | Scope, complexity, consultancy, internal time and audit days |
Pricing for either depends on your organisation; ask us for a quote for Cyber Essentials preparation. See Cyber Essentials cost for what drives the price.
What buyers and contracts ask for
- UK government contracts in scope of PPN 014 ask for Cyber Essentials or Cyber Essentials Plus, or evidence of equivalent controls. Do not assume an ISO 27001 certificate will automatically be accepted as equivalent; check the contract wording with the buyer.
- Defence suppliers need Cyber Essentials as the base of every Defence Cyber Certification level.
- Legal aid firms and colleges have Cyber Essentials requirements set by the Legal Aid Agency and the DfE respectively.
- Large enterprises and international customers often expect ISO 27001, particularly for data processors, software and managed service providers.
- Many tenders ask for both, or give credit for each.
Because certificates can be checked publicly, buyers increasingly verify Cyber Essentials themselves; see how to check a Cyber Essentials certificate.
How they work together
The two are complementary rather than competing. ISO 27001 requires you to decide how to treat technical risks such as malware, weak authentication and unpatched software; the five Cyber Essentials controls are a well-defined way to treat exactly those risks. A current Cyber Essentials certificate can be useful evidence inside an ISMS, and the annual Cyber Essentials cycle gives a regular, independent check on the technical basics between ISO audits.
Common routes:
- Cyber Essentials first. Quick to achieve, satisfies many UK buyers and fixes the most common weaknesses.
- Cyber Essentials Plus for tested assurance, if buyers ask for it (compare the two levels).
- A governance step. IASME Cyber Assurance gives smaller organisations a proportionate governance standard built on Cyber Essentials.
- ISO 27001 when customers, international markets or your own risk profile justify a full ISMS.
Which should you choose?
| If you... | Start with |
|---|---|
| Need a recognised certificate quickly for a UK tender | Cyber Essentials |
| Bid for in-scope central government or NHS contracts | Cyber Essentials or Plus, as the contract requires |
| Supply the MOD | Cyber Essentials, then Plus for the higher DCC levels |
| Are a small organisation wanting more than a technical baseline | Cyber Essentials, then IASME Cyber Assurance |
| Sell to international or large enterprise customers that ask for an ISMS | ISO 27001, with Cyber Essentials as the technical baseline |
| Want board-level assurance under the Cyber Governance Code of Practice | Both, over time |
How Forever Systems helps
Forever Systems prepares organisations for Cyber Essentials and Cyber Essentials Plus and supports them through assessment alongside an IASME-licensed Certification Body. We are not an ISO 27001 certification body. If you are working towards ISO 27001, we can deliver the technical side: MFA, patch management, device management with Microsoft Intune, endpoint protection, email security and backups, all of which feed straight into your Annex A controls. Start with a gap analysis, or contact us to talk through which route suits you.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cyber Essentials easier than ISO 27001?
Yes, for most organisations. Cyber Essentials covers five fixed technical controls and can often be achieved in weeks. ISO 27001 requires a risk-based management system with policies, internal audits and management reviews, which usually takes months to put in place.
Does ISO 27001 include Cyber Essentials?
No. ISO 27001 does not require Cyber Essentials, and holding ISO 27001 does not give you a Cyber Essentials certificate. The two are separate, though the technical controls overlap and many organisations hold both.
Can I use ISO 27001 instead of Cyber Essentials for government contracts?
PPN 014 asks for Cyber Essentials or Cyber Essentials Plus, or equivalent controls, for in-scope contracts. Whether ISO 27001 evidence is accepted is a matter for the buying organisation, so check the contract requirements.
How long does each certificate last?
A Cyber Essentials certificate expires after 12 months. ISO 27001 certification typically runs on a three-year cycle with surveillance audits in between.
Should a small business get ISO 27001?
Usually not as a first step. Cyber Essentials is designed for organisations of all sizes and answers most UK buyers. ISO 27001, or IASME Cyber Assurance as a middle path, becomes worthwhile when customers or your own risks call for a full governance programme.