In short: UK cyber security frameworks range from Cyber Essentials, the government-backed baseline of five technical controls, through governance standards such as IASME Cyber Assurance and ISO/IEC 27001, to the NCSC Cyber Assessment Framework for essential services, the Cyber Governance Code of Practice for boards and the NIS Regulations, which the Cyber Security and Resilience Bill would extend.
Why there are so many frameworks
Each framework answers a different question. Some ask whether your IT is configured to resist common, untargeted attacks. Others ask whether you manage information security as an ongoing business process, whether your board is governing cyber risk properly, or whether an essential public service can keep running during a serious incident.
They also come from different places:
- Certification schemes that you choose to hold, often because a customer asks for them: Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and ISO/IEC 27001.
- Assessment frameworks used by regulators and sector bodies, such as the NCSC Cyber Assessment Framework and the NHS Data Security and Protection Toolkit.
- Guidance for leaders, such as the Cyber Governance Code of Practice.
- Law, chiefly the Network and Information Systems (NIS) Regulations 2018, which the Cyber Security and Resilience Bill would amend and extend.
- Contract and procurement rules, such as PPN 014 for government contracts and Defence Cyber Certification for the defence supply chain.
Most organisations need only one or two of these. Knowing which, and in what order, saves a lot of wasted effort.
The UK landscape at a glance
| Framework | What it is | Who it is for | How it is checked |
|---|---|---|---|
| Cyber Essentials | Five technical controls: firewalls, secure configuration, security update management, user access control, malware protection | Any organisation, any size | Verified self-assessment marked by an assessor; renewed every 12 months |
| Cyber Essentials Plus | The same five controls, technically tested | Organisations whose buyers want stronger assurance | Hands-on testing of a sample of devices and accounts |
| IASME Cyber Assurance | A governance standard built on top of Cyber Essentials | Smaller organisations wanting a management-level standard | Level 1 verified self-assessment or Level 2 audit |
| ISO/IEC 27001 | An international standard for an information security management system | Organisations needing an internationally recognised, risk-based programme | Audits by an accredited certification body over a multi-year cycle |
| NCSC Cyber Assessment Framework | Outcome-based objectives, principles and indicators of good practice | Operators of essential services in sectors such as energy, health, transport, digital infrastructure and government | Self-assessment or independent audit, usually reviewed by a regulator |
| Cyber Governance Code of Practice | Five principles for how boards govern cyber risk | Boards and directors of medium and large organisations | Self-directed; no certificate |
| Defence Cyber Certification | Graded cyber requirements for defence suppliers, starting with Cyber Essentials | The MOD supply chain | Assessment by an assured certification body |
| NHS DSP Toolkit | Annual data security self-assessment | Organisations with access to NHS data and systems | Online self-assessment, with audit for some organisations |
| NIS Regulations and the Bill | Legal security and incident-reporting duties | Regulated essential and digital services, and more if the Bill passes | Oversight by sector regulators |
Cyber Essentials as the foundation
Cyber Essentials is deliberately narrow. It does not ask about policies, risk registers or board reporting. It asks whether the devices, accounts and cloud services you use are set up to stop the commodity attacks that hit organisations every day. That narrowness is its strength: it is quick to understand, inexpensive compared with a full management system, and checked every year.
It is also the common starting point for many of the other frameworks:
- IASME Cyber Assurance requires a valid Cyber Essentials certificate.
- Defence Cyber Certification starts every level with Cyber Essentials, and its upper levels need Cyber Essentials Plus.
- Government contracts in scope of PPN 014 ask for Cyber Essentials or Cyber Essentials Plus, or equivalent controls.
- The Cyber Governance Code of Practice positions Cyber Essentials alongside the Code as the minimum a well-run organisation should have in place.
- The NCSC's Cyber Advisor scheme is built around helping smaller organisations implement the Cyber Essentials controls.
If you are unsure where to begin, begin here. Our Cyber Essentials requirements guide explains the five controls, and the certification process page shows the route to a certificate.
Which framework do you need?
Work from the outside in: start with what your customers, regulators and insurers actually require, then add what your own risk calls for.
| Your situation | Usual starting point | Possible next step |
|---|---|---|
| Small business asked for proof of security in a tender | Cyber Essentials | Cyber Essentials Plus if the buyer asks for tested assurance |
| Supplier to central government or the NHS | Cyber Essentials or Plus under PPN 014 | The DSP Toolkit if you handle NHS data |
| Defence supplier | Cyber Essentials, then Plus | The required Defence Cyber Certification level |
| Growing firm wanting a governance standard without a full ISMS | Cyber Essentials | IASME Cyber Assurance |
| International customers or large enterprise buyers | Cyber Essentials as a quick baseline | ISO/IEC 27001 |
| Operator of an essential service | The Cyber Assessment Framework via your regulator | Cyber Essentials across the wider estate and suppliers |
| Board of a medium or large organisation | The Cyber Governance Code of Practice | Assurance reporting that includes certification status |
| Managed service provider | Cyber Essentials for your own estate | Prepare for the Cyber Security and Resilience Bill; see Cyber Essentials for MSPs |
Free government help
Several of these frameworks come with free support from government. The NCSC publishes the CAF, the Cyber Security Toolkit for Boards and Cyber Governance Training for directors. IASME, the NCSC's Cyber Essentials Delivery Partner, offers a free Readiness Tool and question set booklet. Smaller organisations can get practical help implementing the Cyber Essentials controls through the NCSC Cyber Advisor scheme. Our page on funded Cyber Essentials explains what is available now.
How Forever Systems helps
Forever Systems prepares organisations for Cyber Essentials and Cyber Essentials Plus and works alongside an IASME-licensed Certification Body, which carries out the assessment and issues the certificate. We are not a certification body for any of the schemes on this page.
What we do is help you work out which frameworks genuinely apply, build the Cyber Essentials foundation properly, and fix the technical gaps (MFA, patching, device management, firewalls and endpoint protection) that every other framework will also look at. A gap analysis is usually the best first step. Contact us to talk it through.
Explore UK frameworks
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the main cyber security framework in the UK?
For most organisations it is Cyber Essentials, the government-backed baseline run by the NCSC with IASME as its Cyber Essentials Delivery Partner. Operators of essential services are assessed against the NCSC Cyber Assessment Framework, and organisations wanting a full management system often choose ISO/IEC 27001.
Is Cyber Essentials a legal requirement?
No. There is no general law requiring it. It is required by many contracts, including in-scope central government and NHS contracts under PPN 014, defence work through Defence Cyber Certification, legal aid contracts and college funding agreements.
Does Cyber Essentials replace ISO 27001?
No. Cyber Essentials covers five technical controls. ISO/IEC 27001 is a risk-based management system covering people, processes and technology. Many organisations hold Cyber Essentials first and then add ISO 27001 or IASME Cyber Assurance.
Which framework should a small business start with?
Cyber Essentials. It is designed for organisations of all sizes, gives you a recognised certificate that buyers can check, and is the prerequisite for IASME Cyber Assurance and Defence Cyber Certification.
Is the NIS Regulations regime changing?
The Cyber Security and Resilience Bill would amend the NIS Regulations 2018 and bring medium and large managed service providers, data centres, large load controllers and designated critical suppliers into scope. At the time of writing (late October 2026) it had completed Report stage in the House of Lords and had not yet received Royal Assent.