If you are choosing between Cyber Essentials and ISO 27001, the answer depends on where you operate, who your buyers are, and how mature your security programme needs to be. Cyber Essentials is a UK government-backed certification scheme focused on five basic technical controls that protect you against the most common cyber attacks. ISO 27001 is an international standard requiring a comprehensive framework and risk-based approach for an information security management system covering people, processes, technology, and governance. Most UK organisations do not need to pick one or the other; they need both, in the right order, because Cyber Essentials and ISO 27001 differ mainly in scope and assurance level.

Key takeaways

• Cyber Essentials is a UK government-backed cyber security certification against five basic technical controls. ISO 27001 is the international standard for a full information security management system (ISMS).
• For most UK SMEs, Cyber Essentials certification comes first: it takes weeks rather than months, costs hundreds rather than thousands, and is often the explicit contract requirement.
• ISO 27001 is what international, enterprise and regulated buyers ask for; it is also a global standard for buyers outside the UK, and you may well need both.
• Both certifications help demonstrate compliance, but holding ISO 27001 does not automatically satisfy a contract that names Cyber Essentials; you still need that certificate.
• The technical work for Cyber Essentials maps directly onto ISO 27001 Annex A controls, so doing both in sequence wastes very little effort.

The short version of Cyber Essentials vs ISO 27001: they answer different questions. Cyber Essentials asks whether five security control themes are in place to stop the most common cyber threats. ISO 27001 asks whether you run a management system that identifies your information security risks and treats them. One is a baseline; the other is a framework.

If you are a UK organisation and a customer, tender or framework has asked for Cyber Essentials, get Cyber Essentials. It takes a few days to a maximum of a couple of weeks and costs £500 to £700 + VAT for the basic level. If your buyers are international, enterprise, or regulated in a way that expects a management system, ISO 27001 is what they will ask for, and Cyber Essentials will still be the quickest first step.

This guide compares the two on scope, certification process, cost and time, recognition, ongoing effort and technical assurance. It shows where the controls overlap (with the Annex A mapping), which to choose in which situation, and how to do both without duplicating work.

It is written for business owners, IT managers and compliance leads in UK organisations who have been asked for one or the other by a customer, a tender or a framework, and want to know whether one certification can stand in for the other.

It matters because the wrong choice is expensive in both directions. Six months on ISO 27001 when a buyer only wanted a Cyber Essentials certificate wastes money; turning up to a UK public sector tender with ISO 27001 alone can cost you the contract.

Cyber Essentials vs ISO 27001 at a glance

Here is a brief overview of both frameworks, and like for like comparison in terms of scope, timelines, costs, validity and recognition.

What is Cyber Essentials?

Cyber Essentials is a UK government-backed scheme owned by the National Cyber Security Centre (NCSC) and delivered by IASME, which licenses the certification bodies that assess and award it. The scheme launched in 2014 with help from the Information Security Forum, and IASME’s name originally stood for Information Assurance for Small and Medium Enterprises. Our pillar guide covers what Cyber Essentials is in full.

It assesses five technical controls designed to protect against the most common internet-based attacks. The requirements are published in the NCSC’s Requirements for IT Infrastructure, currently version 3.3 (the Danzell question set, in force since 27 April 2026); our Cyber Essentials requirements guide explains each control and how these are effective against various cyber threats

Our guide to Cyber Essentials vs Cyber Essentials Plus covers that choice; this page treats the two levels together.

What is ISO 27001?

ISO/IEC 27001 is the global standard for an information security management system (ISMS). It goes well beyond the technical security controls of Cyber Essentials and covers information assets in every form, including paper records, premises, people and suppliers. It does this through its 93 Annex A controls, grouped into four themes: organisational, people, physical and technological.

ISO 27001 and Cyber Essentials Certification: How do they differ?

Both improve an organisation’s security posture, but their focus and scope differ. Cyber Essentials is centred on five key technical controls that block common cyber attacks. ISO 27001 covers the management of information security across the whole organisation, with risk assessment and treatment at its core.

Certification process: How cyber essentials differ from ISO 27001?

Obtaining Cyber Essentials certification is relatively simple and quick. You complete the online question set, which is marked by an assessor at an IASME-licensed certification body. The question set is prescriptive. Under the current Danzell version (v3.3), three things fail an application outright: unsupported software, cloud services without MFA, and high or critical security updates not applied within 14 days.

Cyber Essentials Plus adds an independent technical audit by an IASME-licensed certification body such as Cyphere, testing the same five controls on your real systems, within 90 days of the basic certificate.

ISO 27001 requires a more thorough process. To be certified, an organisation must build and run an ISMS that meets the requirements in clauses 4 to 10 of the standard. The external audit then runs in two stages: Stage 1 reviews the ISMS design and documentation, and Stage 2 checks that the controls work in practice, so organisations often use expert guidance to prepare for the two-stage audit and documentation requirements.

An ISMS and risk assessment vs technical controls full compliance

The self-assessment questionnaire on standard Cyber Essentials checks for security measures against the following control areas, set by the NCSC and applied to every device, cloud service and network in scope:

1. Firewalls
2. Secure configuration
3. Security update management
4. User access control
5. Malware protection

These measures help organisations defend against the most common threats. Older versions of the scheme called two of the controls “boundary firewalls and internet gateways” and “patch management”; the current names are the ones above.

For Cyber Essentials Plus, an independent technical audit is the central element. This hands-on technical audit is conducted against the same five key technical control areas based on the same scope declared during the standard Cyber Essentials application.

ISO 27001, in contrast, takes a holistic approach as a framework for managing information security through an ISMS and is specifically designed to be technology-neutral and adaptable to different organisations. You set its scope, which can be the whole organisation or a defined part of it, such as one site or service, and it covers information assets rather than only IT systems. Cyber Essentials lets you set a scope too, but the rules are stricter: cloud services cannot be excluded, and a scope without end-user devices is not accepted (see our scope guide).

ISO 27001 also addresses unauthorised physical access, supplier relationships and environmental risks, none of which Cyber Essentials touches. Its method requires the organisation to identify threats and treat them through a risk-based approach, effectively reducing cyber risk and adopting a risk management programme.

Cost and time

Cyber Essentials can be achieved in days if the controls are in place, and a few weeks if they need work. The basic assessment fee is set by IASME and banded by organisation size at £500 to £700 + VAT. Cyber Essentials Plus with Cyphere costs from £1,299 + VAT, including the basic assessment. See our guide to how long Cyber Essentials takes. Successful certifications can avail cyber insurance based on certain criteria (organisation revenue and location-based).

ISO 27001 is a project measured in months. Documenting the ISMS, running a risk assessment, operating controls long enough to evidence them and completing the audit stages typically takes six to twelve months, and longer for organisations starting from little.

Cost follows the same pattern. Most of an ISO 27001 budget is internal time and any consultancy support, with certification body fees on top for the Stage 1 and Stage 2 audits and each annual surveillance audit. Costs vary widely with size, sites and existing documentation. For a small UK organisation, we suggest budgeting £5000-10000 for UCAS accredited ISO 27001 certification.

Cyber Essentials is the winner here, by a wide margin on both factors: costs and time.

Recognition and contract requirements

Cyber Essentials is the requirement in UK government contracts involving personal data or ICT services with central government bodies, under Procurement Policy Note 014 (PPN 014 on gov.uk), and is widely expected across NHS, defence and UK supply chains. Buyers check the IASME certificate search to confirm a supplier holds it, and certification can create a competitive advantage when bidding for UK government contracts and buyer frameworks.

ISO 27001 is the requirement in international procurement and enterprise vendor questionnaires, and it maps well onto regulatory expectations in finance, healthcare and data protection. Buyers also use it to demonstrate security commitment and due diligence across international supply chains.

The important distinction here is: ISO 27001 does not automatically satisfy a contract that names Cyber Essentials. PPN 014 says that ISO 27001 holders “will not automatically conform to Cyber Essentials”, because the five controls are not usually in an ISO 27001 scope and are unlikely to be tested, so most will have to adopt Cyber Essentials as well or demonstrate equivalent controls, normally verified by a technically competent and independent third party. A contract that names Cyber Essentials is not met by ISO 27001 alone.

The NCSC makes the same point in its view on alternative standards: an ISO 27001 certificate cannot simply be called equivalent, because the scope and the testing differ.

Winner: It really depends on your buyer. ISO 27001 for international and regulated enterprises to demonstrate stronger due diligence across the organisation; Cyber Essentials where a UK buyer names it either self-assessed or additional assurance through Cyber Essentials Plus.

Ongoing effort

Cyber Essentials is renewed annually with a fresh assessment against the requirements current at the time. Between certificates, there is no formal governance requirement beyond keeping the controls in place, the condition to maintain compliance.

ISO 27001 requires the ISMS to operate continuously: internal audits, management reviews, corrective actions, risk reviews and supplier monitoring, following a three-year certification cycle with yearly surveillance audits. Continual improvement is written into the standard, and it needs executive sponsorship and involvement from beyond the IT team.

ISO 27001 is for organisational maturity; Cyber Essentials is to set the cyber hygiene baseline. One builds a security function; the other keeps a baseline in place with little ongoing administration.

Technical assurance

Basic Cyber Essentials verifies your answers rather than your systems. Cyber Essentials Plus provides higher assurance than the basic self-assessed level because testing is performed on real systems: an external vulnerability scan, authenticated scans of sampled devices, malware delivery tests by email and browser, MFA checks on every cloud service and an account separation check.

ISO 27001 requires evidence that controls are implemented and effective, but does not prescribe specific technical tests. How rigorous the technical assurance is depends on how the organisation designs its ISMS and what the auditor samples.

Winner: Cyber Essentials Plus for standardised, repeatable testing of core technical controls. Neither replaces penetration testing.

How the controls overlap: Cyber Essentials and ISO 27001 Annex A

The five Cyber Essentials controls map onto around a dozen of the 93 information security controls in ISO 27001:2022 Annex A, most of them in the technological theme. This is why Cyber Essentials work is rarely wasted when you move on to ISO 27001.

The mapping runs one way only. Cyber Essentials covers a subset of ISO 27001’s technical controls; ISO 27001 covers a great deal that Cyber Essentials does not, including governance, supplier management, incident response and physical security.

There is also a difference in how the controls apply. Cyber Essentials requires every one of its controls, while ISO 27001 lets you select Annex A controls through your risk assessment and record why any are excluded in the statement of applicability.

Which should you choose: Cyber Essentials, ISO 27001, or both?

The decision between Cyber Essentials and ISO 27001 is not always clear-cut. It depends on compliance requirements, your approach to risk management and your specific information security risks, rather than on the size of the organisation alone. Many enterprises start with Cyber Essentials as a baseline before moving to ISO 27001. Where a Cyber Essentials certificate is a prerequisite for government contracts, or for working with the Ministry of Defence and the public sector, you should put it first.

Choose Cyber Essentials or Cyber Essentials Plus if:

• a UK customer, tender, framework, NHS or defence buyer names it
• you are a UK SME that needs recognised assurance in weeks rather than months
• you want a technical baseline in place before investing in a full ISMS
• your buyers are predominantly UK-based and need to show data security and data protection compliance when handling personal data and sensitive personal data of customers and employees

Choose ISO 27001 if you need a global standard with broader governance:

• international or enterprise customers require it
• you operate in a regulated sector that expects a management system
• you handle sensitive data at a scale where governance matters as much as technical controls
• you are building a security function rather than meeting a single requirement

The right choice depends on whether you need key controls first or a comprehensive framework now.

When someone asks us for ISO 27001 because one customer mentioned it, the first step is to ask that customer what is the driver and what they will actually accept. Sometimes the answer is ISO 27001. Often it is Cyber Essentials Plus, or IASME Cyber Assurance (equivalent). Find out before committing six months to the biggest option that often is stressful for small businesses, or follow a multi-phased approach.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

Is there a lighter alternative to ISO 27001?

For many UK organisations, yes: IASME Cyber Assurance. It builds on Cyber Essentials, adds governance and data protection controls, and scales to the size of the organisation; Cyphere certifies Level 1 and Level 2. It is a recognised alternative to ISO 27001, not an equivalent, so check what your customer will accept before you commit to either.

We compare it with ISO 27001 and SOC 2 in our framework comparison, and IASME Cyber Assurance has the full scheme details.

Doing both, and in what order

Many organisations end up holding both, and many enterprises follow that sequence too, starting with Cyber Essentials before moving on to ISO certification. It reduces the initial workload for the IT parts of ISO 27001 and leaves you with processes and records that carry into the broader standard. For most UK organisations, the order that wastes least effort is:

1. Cyber Essentials, often with Plus. Satisfies immediate UK contract requirements and puts the technical baseline in place.
2. ISO 27001 over the following months, building on the asset inventory, updating software and systems under a patching regime, MFA rollout and configuration standards you already have.
3. Maintain both, using Cyber Essentials Plus results and penetration testing as evidence within the ISMS to demonstrate compliance to different buyer groups over time.

The Cyber Essentials work is the part of ISO 27001 that many businesses find hardest to evidence, because it lives on real devices rather than just in excelsheets, policy documents. If you have already passed a Cyber Essentials Plus audit, you walk into the Stage 2 audit with tested evidence for a dozen Annex A controls. That is not a small head start.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

How Cyphere helps

Cyphere is an IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance Level 1 and Level 2, and a CREST-accredited penetration testing provider. For ISO 27001, we carry out an ISMS gap analysis and readiness plan with expert guidance, while the certification audit itself is done by an independent UKAS-accredited certification body. We are not the ISO 27001 certifying auditor, which keeps certification independent of the preparation.

Where ISO 27001 is more than a buyer genuinely needs, we will say so, and IASME Cyber Assurance is often the better fit. Where clients need both standards, we sequence Cyber Essentials first so the technical work carries straight into the ISMS. See our ISO 27001 readiness and compliance support, or get a Cyber Essentials quote.

Cyber Essentials vs ISO 27001 FAQs

Is ISO 27001 harder to achieve than Cyber Essentials?

Yes, considerably. ISO 27001 requires a documented management system, a risk assessment, internal audit, management review and a two-stage external audit, and it follows a risk-based approach rather than a fixed checklist of controls, typically over six to twelve months. Cyber Essentials assesses five technical controls and can be achieved in weeks.

Is ISO 27001 better than Cyber Essentials?

It is broader, not better. ISO 27001 is a comprehensive framework covering governance, risk and physical security across the organisation, while Cyber Essentials is a baseline of technical controls. The better choice is the one your buyer asks for, and for many UK SMEs that is Cyber Essentials first.

Should I get Cyber Essentials Plus or go straight to ISO 27001?

For most UK organisations, Cyber Essentials Plus first. It is faster, often the explicit contract requirement, and the technical work carries straight into ISO 27001. Go straight to ISO 27001 only if an international or enterprise buyer requires it now and no UK buyer is asking for a Cyber Essentials certificate.

Do I need Cyber Essentials if I already have ISO 27001?

Often yes. Where a UK public sector, NHS or defence buyer names Cyber Essentials, they check for that certificate, and while ISO 27001 may help demonstrate compliance and due diligence, it is not automatically accepted in its place. Where a private buyer asks for “Cyber Essentials or equivalent”, ISO 27001 may be accepted, so ask first.

Do Cyber Essentials and ISO 27001 assessments cover the same things?

No. Cyber Essentials covers five technical controls across the scope you agree with your certification body, and cloud services cannot be excluded. An ISO 27001 audit covers your whole management system within the scope you define, and can include a much wider set of IT infrastructure such as information assets, and also physical controls, supplier controls, and people and process controls.

Who can issue each certificate?

Only IASME-licensed certification bodies can award Cyber Essentials, under the scheme IASME runs for the NCSC. Any organisation can offer an ISO 27001 assessment, but certification from a UKAS-accredited body is what confirms competence and impartiality. Cyphere certifies Cyber Essentials and Cyber Essentials Plus; for ISO 27001, we prepare you and an independent body certifies you.

Does either include physical testing or penetration testing?

Cyber Essentials Plus includes hands-on technical testing and gives higher assurance because the assessor tests live systems rather than relying only on self-assessment: they check a sample of devices and every cloud service, usually remotely. A standard ISO 27001 audit does not include that kind of testing; it samples evidence that your controls are documented and working. Neither includes physical intrusion testing or a penetration test.

Related Cyber Essentials guides

• What is Cyber Essentials?
• Cyber Essentials vs ISO 27001 vs SOC 2: the wider framework comparison
• Cyber Essentials vs Cyber Essentials Plus
• Cyber Essentials requirements
• How long does Cyber Essentials take?
• Cyber Essentials Plus checklist
• ISO 27001 Penetration Testing
• ISO 27001 Certification