ISO 27001 vs Cyber Essentials: a guide

ISO 27001 vs Cyber Essentials is a choice about the assurance your business needs. Cyber Essentials assesses a defined technical baseline. ISO/IEC 27001 sets requirements for an information security management system, or ISMS, which governs how you identify, treat and review information-security risks.

Start with the requirement you must satisfy, then examine the scope and ongoing work. Neither certificate is a universal substitute for the other, and neither is proof that every risk or legal obligation has been addressed.

What Cyber Essentials assesses

IASME, the NCSC's official delivery partner, describes Cyber Essentials as an annually renewable scheme based on five technical control areas: firewalls, secure configuration, user access control, malware protection and security update management.

Cyber Essentials uses a verified self-assessment. Cyber Essentials Plus adds a technical audit against the same requirements. That difference matters when a buyer asks for evidence beyond your answers to a questionnaire.

Scope still matters. The assessment must cover the relevant systems and organisational boundary. Hardening Microsoft 365 may contribute to some controls, but it does not automatically satisfy them across laptops, other cloud services, network equipment and every system in scope.

Use the Cyber Essentials guide to prepare an inventory and gap assessment. The scheme's current requirements remain the authority for an assessment.

What ISO/IEC 27001 covers

ISO's official description explains that ISO/IEC 27001:2022 defines requirements for establishing, implementing, maintaining and continually improving an ISMS. It applies to organisations of different sizes and sectors.

An ISMS is a working management system. It connects the information you need to protect, the risks to it, decisions about treatment, responsibilities and evidence that the controls operate. Its scope can include people, processes and technology. It is not simply a larger collection of technical settings.

For example, a business handling confidential client documents needs to consider access, staff responsibilities, supplier arrangements and what happens when a service fails. Management must decide which risks to treat and resource the work. Records and reviews should show whether those decisions remain appropriate as the business changes.

ISO says organisations can implement the standard without choosing certification. If certification is needed, establish the scope and use a competent certification body. Accreditation provides additional independent assurance of that body's competence. Do not assume that every provider using an ISO logo offers the same assurance or that a certificate necessarily covers the entire business.

Compare the questions each answers

The final row often decides the immediate priority. If a contract specifically requires Cyber Essentials Plus, do not assume an ISO certificate will be accepted. If it requires an appropriately scoped ISO/IEC 27001 certificate, do not assume Plus is equivalent. Ask the buyer to confirm any alternative in writing.

When Cyber Essentials is a useful first step

It is a practical option when you need to establish or demonstrate the scheme's technical baseline. The assessment can make gaps in patching, accounts and device management visible and assignable.

It may also be an explicit procurement requirement. Read the actual tender or contract, including the required scope and deadline. Broad claims that every government buyer, insurer or enterprise customer requires the same certificate are not a sound basis for spending.

Do not choose it solely because the organisation is below a particular staff count. A small business can have a complex information-risk profile or a contractual need for an ISMS. Conversely, a larger business may need Cyber Essentials alongside existing management-system work.

When an ISMS or ISO certification is the priority

An ISMS can help when the problem is recurring risk ownership across teams, suppliers and processes. It provides a structure for decisions that cannot be solved by configuring a device once.

Certification may be appropriate when a customer specifically needs it, when independent assurance has a clear business purpose, or when management wants that assessment of the system. Distinguish those reasons from a general claim that a regulator mandates ISO certification. Check the applicable legal or sector requirement directly.

Implementing the standard also needs management participation. Someone must maintain risk assessments, coordinate actions, review effectiveness and respond to changes. If the business has no capacity for that work, buying a policy pack will not create an operating ISMS.

The internal audit checklist can help organise preparation, but the standard and agreed certification scope determine what must be assessed. Obtain the applicable standard and competent advice where a detailed interpretation is needed.

Compare total effort and cost

Use current written quotes rather than generic market ranges. IASME publishes Cyber Essentials self-assessment fees; Plus is priced according to the size and complexity of the technical assessment. Remediation and continuing operation are separate costs.

For ISO work, define the ISMS scope, current maturity, internal responsibilities, support required and certification arrangements. Ask the certification body to explain the assessment programme, follow-up, continuing surveillance and recertification terms. Include internal staff time, training and remediation in the budget.

A narrow, well-prepared organisation and a complex organisation starting with incomplete records will have different workloads. There is no defensible universal promise that either route takes a set number of weeks or costs a fixed amount.

Compare proposals using the same assumptions:

• What organisational units, services and locations are included?
• Which gaps are already known, and who will repair them?
• What does external support deliver, and what remains internal?
• What evidence must exist before the assessment?
• What continuing work and fees follow certification?
• What happens if the scope changes or findings require more work?

A worked decision with two requirements

Consider a fictional software supplier bidding for one contract that explicitly requests Cyber Essentials Plus. Separately, its management wants better ownership of supplier and information risks. It has no current customer requirement for ISO certification.

The company confirms the Plus scope and deadline with the buyer, inventories its systems and funds the necessary technical remediation. It also starts a proportionate risk-management programme with named owners. It does not describe Plus as an ISMS certification or promise that it settles every assurance question.

Later, a prospective customer asks for ISO/IEC 27001 certification covering the hosted service. The company checks the exact scope, commercial value and ability to sustain the ISMS before committing. Existing technical controls can contribute evidence, but they do not remove the management-system work.

The decision is staged because the requirements and capacity justify it. Another business with an immediate ISO requirement might take a different sequence. There is no universal rule to complete Cyber Essentials first.

Check what a certificate actually tells you

Read the named organisation, scope, issuing body, validity and any relevant limitations. Check that the service or system you rely on is included. A supplier's certificate for a different part of its operation does not answer your own risk question.

Use certification alongside due diligence and operational evidence. Review incidents, changes, supplier dependencies and contractual responsibilities. For insurance, ask the broker or insurer how the actual policy treats certification; do not assume a discount or guaranteed cover. The cyber insurance guide provides questions to take into that discussion.

Make the next decision explicit

Write a short brief stating the assurance requested, the relevant business scope, deadline, known gaps and available internal owners. That is enough to obtain useful initial scoping advice without committing to the wrong certificate.

Our IT compliance service can help map requirements and organise readiness work. Arrange a consultation with the buyer's wording or your internal risk objective. Where the issue is broader control design, security consulting can help prioritise the work that the certificate alone will not resolve.