Cyber Essentials or ISO 27001? Which one you actually need.

The short answer

Cyber Essentials proves you've got the basics right on your devices and accounts. ISO 27001 proves you've got a working system for finding and managing information security risks across the whole business. Most businesses should start with Cyber Essentials, and only go for ISO 27001 when a customer, tender or the kind of data you hold calls for it.

They're not rivals. Plenty of organisations hold both, and the work for one feeds straight into the other.

Side by side

	Cyber Essentials	ISO 27001
What it is	A UK government-backed scheme, run by the NCSC with IASME	An international standard for an information security management system
What it checks	Five technical controls on your devices, network and cloud services	How you identify, treat and keep reviewing risks, plus the controls you choose from 93 in Annex A
How it's assessed	Online questionnaire, signed off by a director. Plus adds a hands-on audit	Stage 1 and Stage 2 audits by an accredited certification body
Lasts	12 months	3 years, with a surveillance audit each year
Typical time	Weeks, depending on the gaps	4 to 12 months for most small and mid-sized organisations
Cost	£320 to £600 + VAT for the certificate, plus any fixes	Usually thousands for the audits, plus implementation support
Recognised	Mainly in the UK	Worldwide

For the detail, see what Cyber Essentials costs and what ISO 27001 costs and how long it takes.

What Cyber Essentials actually proves

It checks five things: firewalls, secure configuration, security updates, user access control and malware protection. Since April 2026 it also fails you outright if a cloud service offers multi-factor authentication and you haven't turned it on.

It's narrow on purpose. Those five controls stop most of the everyday attacks that hit businesses like yours, and a customer can check your certificate in seconds. What it doesn't cover is anything outside the technology: suppliers, staff processes, incident plans, or how you decide what matters most.

What ISO 27001 actually proves

ISO 27001 is about the system, not a checklist. You agree a scope, assess the risks to the information in it, decide how to treat each one, and then show an auditor that you keep doing it: internal audits, management reviews, fixing what you find.

That makes it much broader. It covers people, suppliers, physical security, incident response and business continuity as well as IT. Done properly, it changes how the business runs. Done badly, it's a binder nobody reads.

Who asks for which

• Cyber Essentials is what UK central government contracts, many councils, the NHS supply chain, insurers and larger customers usually ask for first. If the wording just says "Cyber Essentials", the basic certificate is normally enough. Some ask for Cyber Essentials Plus by name.
• ISO 27001 tends to come up when you sell to larger or international customers, handle sensitive data at scale, or provide software, cloud or managed services that other businesses rely on. Enterprise supplier questionnaires often ask for it outright.

If you're not sure, read the tender or contract wording, or simply ask the customer. It's much cheaper to ask than to certify for the wrong thing.

Four quick questions to decide

1. Has a customer or tender named one? Then that's your answer, and the deadline is set for you.
2. Do you have any certification yet? If not, start with Cyber Essentials. It's quicker, cheaper and fixes the basics an ISO 27001 auditor will expect to see anyway.
3. Do you sell outside the UK, or to large enterprises? ISO 27001 is the one they'll recognise.
4. Do you hold a lot of sensitive data, or run systems your customers depend on? ISO 27001 is worth planning for, even if nobody has asked yet.

Doing both, in the right order

For most small and mid-sized businesses the sensible path is:

1. Get Cyber Essentials first. Fix the technical basics and get a certificate you can show this year.
2. Add Plus if a contract needs it. Same controls, independently tested.
3. Move to ISO 27001 when the business case is there. Your Cyber Essentials controls carry straight across into the ISO 27001 controls, so you're not starting from scratch.

Keep renewing Cyber Essentials alongside ISO 27001. Many UK customers still ask for it specifically, and it's a cheap yearly check that the basics haven't slipped.

FAQ

Does ISO 27001 replace Cyber Essentials?

No. They're separate certifications. A UK tender that asks for Cyber Essentials usually wants to see that certificate, even if you hold ISO 27001.

Is Cyber Essentials enough for GDPR?

It helps show you take security seriously, but no certificate makes you GDPR compliant on its own. It covers technical security, not things like privacy notices, data retention or how you handle a data breach.

Can a very small business get ISO 27001?

Yes. The standard scales, and a small, cloud-based business with a tight scope can certify in a few months. Whether it's worth it depends on who's asking for it.

Who carries out the certification?

Cyber Essentials is certified by a certification body licensed by IASME. ISO 27001 is certified by an accredited certification body, ideally one accredited by UKAS. My job is to get you ready for either, so audit day holds no surprises.