Cyber Essentials proves your firm has five basic technical controls in place: Secure configuration, Firewalls, user access control, patch management and malware protection. On the other hand, ISO 27001 proves your firm runs a full system to manage information risk. That system covers your people, premises, paper and technology. You renew Cyber Essentials every 12 months. An ISO 27001 certificate can last three years, with yearly checks.
It depends on your needs. Many UK small or medium firms start with Cyber Essentials. They then add ISO 27001 for large, regulated or overseas clients.
The UK Government's Cyber Security Breaches Survey 2025/26 puts the risk in plain view. In the last year, 43% of UK firms experienced a breach or assault, according to the report. Yet only 5% of businesses follow Cyber Essentials. In this guide, we will cover every single detail about Cyber Essentials and iso 27001.
How do the two compare at a glance?
Is Cyber Essentials the Lock on Your Door and ISO 27001 the Plan for the Whole House?
Yes, this picture works well. Cyber Essentials checks the locks on your IT front door. A security strategy for the entire house is required by the ISO 27001 standard. That plan covers who holds the keys, how you vet guests, and what you do after a break-in.
The highlighted room shows where Cyber Essentials sits. Every other room falls under ISO 27001 alone.
The two schemes start from different places.In 2014, the National Cyber Security Center (NCSC) established Cyber Essentials in response to a primary threat. That threat is an attacker on the internet with common, free tools. On the other hand, ISO 27001 starts with your own list of risks.
What Does a Cyber Essentials Assessor Check on Your Laptops and Cloud Accounts?
It is the responsibility of a Cyber Essentials (or Cyber Essentials Plus) assessor to ensure that your cloud accounts and laptops are in accordance with the five main technological controls established by the United Kingdom government. Laptops, servers, phones, routers, cloud applications like Microsoft 365 are all included in the scope of this project.
In the event that you take the Cyber Essentials Certification exam, the examiner will either evaluate your self-assessment or, in the case of Cyber Essentials Plus, they will test your technical knowledge directly on a sample of your real systems. The National Cyber Security Centre (NCSC) owns the scheme. IASME runs it through a network of licensed certification bodies.
Which five controls must you pass?
Each control comes with a short set of rules. This table shows what each one asks of you.
Security updates catch out many firms. A single outdated laptop has not been updated might cause the entire evaluation to fail. So you should check every device ahead of the assessment.
How does Cyber Essentials Plus test your devices in person?
An impartial assessor by a Certification Body approved by the International Society for Microelectronics and Electronics (IASME) tests your equipment during a Cyber Essentials Plus exam. These audits are now typically conducted remotely using screen-sharing rather than physically on-site (although on-site visits are still carried out for estates that are more complicated or bigger).
One example is a 20-person design studio in Bristol. The assessor picks three laptops randomly. They then test each one for missed updates and weak malware defences.
What changed with the Danzell update in April 2026?
The Cyber Essentials Danzell Update (Version 16 / question set v3.3) was implemented on 27 April 2026, replacing the earlier Willow standard with a stricter set of security standards and auto-fail criteria
- MFA on every cloud service that offers it, or an automatic fail
- Within fourteen days, critical high-risk changes must be implemented; otherwise an automatic failure will occur.
- No option to leave cloud services that hold your data out of scope
- A second random sample of after any Plus sample that was unsuccessful
They are now essentially the same technological level as Cyber Essentials. However, the gap on governance stays wide. Cyber Essentials still does not cover risk reviews, supplier checks or staff awareness.
What Does ISO 27001 Ask You to Build Around Your People, Paper and Premises?
ISO 27001 demands that you create an Information Security Management System (ISMS) around your people, paper, and buildings, ensuring the Confidentiality, Integrity, and Availability (CIA trinity) of your information assets throughout the whole organisation.
The older 2013 version reached its transition deadline on 31 October 2025. So every new or renewed certificate now runs against the 2022 version. Is your policy pack still written for 2013? You can recap the basics in our guide to what ISO 27001 is.
What sits inside an ISMS?
Clauses 4 to 10 of the standard set the core rules. The components listed below are constructed by each company, generally in this sequence.
- A clear scope for the ISMS
- Visible support from top management
- A risk assessment and a risk treatment plan
- A description of how the Annex control measures may be implemented to the circumstances.
- Staff awareness and live controls
- Internal audits and a management review
- Corrective action and steady improvement
How do the 93 Annex A controls split across four themes?
Annex A lists 93 controls in four themes. You do not automatically apply of them. In its place, you select the ones that are appropriate in light of the risks you are taking. The next step is to provide an explanation for each option in your Statement of Applicability.
What happens at the Stage 1 and Stage 2 audits?
Two checks must be a licensing body that is recognized by UKAS. In order to finish the first step of the ISO management system approval process, audits at Stages 1 and 2 must be carried out. The inspector looks over your papers and your scope in Stage 1. In Stage 2, the ISMS is put to the test in real life. The auditor speaks to staff and samples real records.
After a clean Stage 2, you receive a certificate which is valid for three years. Surveillance audits follow in years two and three. Next, there is a recertification audit, which starts the new cycle. Stage 2 takes most small businesses six to twelve months to reach.
How Do the Two Look Side by Side on One Page?
The biggest split is scope. As I told you before, Cyber Essentials checks five controls on your IT. ISO 27001 is about managing risk. The table puts every key factor in one place.
Where Do the Five Cyber Essentials Controls Sit Inside ISO 27001?
Control Set A.8 is where the five Cyber Essentials controls are located, and they are located immediately within Annex A of ISO 27001:2022, which is devoted to the topic of technical controls.
The People and Physical themes get no direct help from Cyber Essentials. The other 83 controls need ISMS work, such as risk reviews, supplier checks and staff awareness.
Can an ISO 27001 Certificate Stand In for Cyber Essentials?
No, a certificate that meets the requirements of ISO 27001 cannot instantly supplant Cyber Essentials. Although around sixty percent of the technical controls of the two frameworks are shared, the frameworks themselves are separate evaluation systems that were developed for different purposes. An NCSC blog post by NCSC Deputy Director Chris Ensor outlines the reasons. The answer turns on the detail of your certificate.
- Direct Substitution: An ISO 27001 certificate is not a suitable replacement for Cyber Essentials unless it is specifically permitted by a procurement buyer or contract. In particular, Cyber Essentials (or Cyber Essentials Plus) is commonly mandated by name in the public sector and government bids in the United Kingdom, and ISO 27001 is not usually regarded as a direct alternative for Cyber Essentials.
- The overlap: The technological controls that you implement for Cyber Essentials, including patching and access control, are excellent evidence for ISO 27001, and implementing one makes the other simpler to achieve. However, these controls require different assessments and certificates.
How Many Pounds Will Each One Take From Your Budget?
Cyber Essentials costs hundreds of pounds a year.The cost of ISO 27001 is thousands of dollars, and it also requires a significant amount of staff time. Both prices rise with the size of your firm.
What does basic Cyber Essentials cost?
IASME sets one fixed fee for basic Cyber Essentials. The fee depends on your headcount. You can also check the current fees on the IASME Cyber Essentials page.
What do Cyber Essentials Plus and ISO 27001 cost?
A valid basic Cyber Essentials certificate is required in order to enrol in Cyber Essentials Plus. The cost of this certificate ranges from £320 to £600 plus VAT, depending on the size of the firm.
In average, the cost of the additional independent technical examination for Cyber Essentials Plus runs from £1,195 to £3,495 plus VAT (or even up to £4,250 plus VAT depending on the provider and the size of your organization).
The ISO 27001 standard is not a baseline that is based on a predetermined charge; rather, it is an Information Security Management System (ISMS) that is far more comprehensive and all-encompassing. The total costs, excluding VAT, often vary from eight thousand to thirty thousand pounds.
How Many Weeks or Months Stand Between You and Each Certificate?
It takes one to four weeks for Cyber Essentials and four to six weeks for Cyber Essentials Plus. The length of time varies from six to eighteen months, with three to twelve months being used for planning and executing the first stage of the audit before the second stage. The duration of time depends upon the size of the company. A small firm usually needs six to twelve months for ISO 27001.
Which Buyers Ask for Which Badge?
Your buyers decide which badge matters. UK public bodies ask for Cyber Essentials. Large, regulated and overseas buyers ask for ISO 27001. The table sets out the usual pattern.
PPN 014 took effect on 24 February 2025. It covers central government departments, their agencies and NHS bodies. Buyers must not add Cyber Essentials to every contract by default. However, suppliers on in-scope contracts must renew the certificate each year for the life of the contract.
The private sector now follows the same path. Barclays, NatWest, Santander UK, and three other large banks worked together with the National Cyber Security Center (NCSC) to push for Cyber Essentials to be used in all supply lines. The payoff shows up fast. According to the NCSC, 48% of firms save time on supplier checks once a supplier holds Cyber Essentials.
Which Badge Should You Hang on the Wall First?
Most UK firms should get Cyber Essentials first. Because it is fast, cheap and widely asked for. Following that, ISO 27001 is the next stage for customers who are larger, more regulated, or worldwide sellers. The flowchart shows the path in two questions.
Every path keeps Cyber Essentials in place. One question is all that is required to establish when the implementation of ISO 27001 will take place.
What do the three paths look like in real life?
The three business examples that follow are typical of those in the UK.
A 12-person IT support firm in Manchester. The firm bids for an NHS trust contract. The tender asks for Cyber Essentials Plus. So the organization starts out with getting the basic Cyber Essentials and then three months later they book the Plus audit. ISO 27001 can wait for now.
A 40-person SaaS firm in London. The business wants to sell to a U.S. bank. The bank's security questionnaire asks for ISO 27001. So the firm starts its ISMS now. It also keeps Cyber Essentials for its UK public sector clients.
A 6-person accountancy practice in Leeds. The practice holds client tax records. No client asks for either badge yet. The Basic Cyber Essentials plan provides it with a low-cost baseline as well as complimentary cyber coverage of £25,000.
How Can One Folder of Evidence Serve Both Audits?
You are free to reuse the majority of the proof that was provided by Cyber Essentials for ISO 27001 purposes. Both evaluators look at the same records to verify that the controls are the same. You may save yourself weeks of duplicate effort by maintaining just one folder.
You should give the folder one clear owner. It is also wise to line up your dates. You may also want to renew Cyber Essentials a month or two before your ISO 27001 surveillance assessment. You may then determine how far your evidence already leads you by doing a thorough ISO 27001 gap analysis.
Which Traps Catch Firms on Each Path?
Most failures come from small gaps, not big ones. Here are the traps assessors and auditors see most often. Does your firm sit near any of them today?
What trips firms up on Cyber Essentials?
- One cloud app without MFA. In Danzell's system, a single gap is equivalent to an automatic failure.
- Old, unsupported devices. The updates control is not successful for a laptop that is running an older version of Windows or macOS.
- A lapsed certificate. The certificate expires after 12 months. The presence of a gap might cause you to lose a live tender.
- A loose scope. Cloud services cannot sit outside scope. Any partial exclusion now needs a written reason.
What trips firms up on ISO 27001?
- A non-UKAS certificate. Cheap online certificates often fail supplier checks. You then pay twice.
- Paper without practice. Stage 2 auditors test daily life, not just policies.
- A first scope that is too wide. A huge scope adds audit days and cost.
- The belief that ISO 27001 replaces Cyber Essentials. Typically, purchasers in the United Kingdom who request Cyber Essentials want that particular certificate.
Where Does Your Firm Stand Today?
You now know how the two badges differ. The next step is to see where your own controls stand. You can take the free GRC Index assessment in about nine minutes. It gives your company a score based on ISO 27001, SOC 2, and other standards.
What Do UK Firms Ask Most About Cyber Essentials and ISO 27001?
Is ISO 27001 harder to get than Cyber Essentials?
Yes, it is true that achieving ISO 27001 is more difficult, time-consuming, and expensive than achieving Cyber Essentials requirements.
Does ISO 27001 cover the five Cyber Essentials controls?
Yes, It is true that ISO 27001 incorporates the technological concepts that form the basis of the five Cyber Essentials controls; nevertheless, merely possessing ISO 27001 does not necessarily ensure that you are certified for Cyber Essentials.
Do you need Cyber Essentials Plus before ISO 27001?
No, Cyber Essentials Plus is not required by law or by technology to get ISO 27001 certification. These certification programs are separate and stand alone.
Can a small firm get ISO 27001?
Yes, even a small business with just one or two employees is capable of getting a certification to the ISO 27001 standard. There is no correlation between the number of employees you have and the certification you have. Instead, your operations and risks determine how broad your Information Security Management System (ISMS) needs to be.
Is 40 too late for cyber security?
No, you can still work in cybersecurity after age 40. Many employers actually think that being over 40 is a big plus because older people who change careers bring important soft skills, maturity in the workplace, and business sense that younger candidates often lack.
