Cyber Essentials vs ISO 27001: Which Does Your UK Business Need?
If you sell to UK businesses or the public sector, you’ve almost certainly seen both Cyber Essentials (CE / CE Plus) and ISO 27001 on security questionnaires. They’re related, but not interchangeable.
This guide helps you decide when Cyber Essentials is enough, when to step up to ISO 27001, and when to run both. It reflects the Cyber Essentials question set in force from 27 April 2026 (v3.3) and ISO/IEC 27001:2022, with 2026 costs for both.
Security Compliance Standards
In one line
- Cyber Essentials: UK government-backed baseline technical controls to stop the most common internet attacks (firewalls, secure config, access control, malware protection, patching). Quick to get; renewed annually.
- ISO 27001: International, risk-based standard for a full information security management system (ISMS) covering people, process, technology, suppliers and incidents, audited by an accredited body.
Head-to-head (at a glance)
| Aspect | Cyber Essentials / CE Plus | ISO 27001 |
|---|---|---|
| Owner | UK NCSC scheme delivered by IASME | ISO/IEC (international) |
| Purpose | Prove basic, up-to-date cyber hygiene | Prove you run a full ISMS and manage risk |
| Scope | Mainly IT estate and cloud access (devices, accounts, patching, malware, firewalls) | People, processes, technology, suppliers, sites, incidents, continuity |
| Depth | 5 prescriptive controls | Risk-driven controls mapped to Annex A |
| Assessment | Self-assessment (CE) or technical testing (CE Plus) | Stage 1 & Stage 2 audit; surveillance for 3-year cycle |
| Typical buyer ask | UK supply chains, public sector, some insurers | Larger customers, international sales, SaaS and longer-term contracts |
| Time / cost | Low; days | Higher; weeks to months (depends on scope and maturity) |
Cost and time: Cyber Essentials vs ISO 27001 (2026)
This is usually the question behind the question. The figures below are what UK organisations actually pay in 2026: Cyber Essentials fees are the published IASME scheme fees, and the ISO 27001 figures come from real quotes issued to my clients, set out line by line in my ISO 27001 certification cost guide.
| Cyber Essentials | Cyber Essentials Plus | ISO 27001 | |
|---|---|---|---|
| Assessment or audit fee | £320 to £600 + VAT, set by organisation size (micro 0 to 9 staff £320; small 10 to 49 £440; medium 50 to 249 £500; large 250+ £600) | Set by the certification body, typically from about £1,500 + VAT for a small firm, rising with device count. The basic CE fee is payable as well. | From about £2,500 all-in with a non-accredited body, or £6,800 to £10,000 with a UKAS-accredited body for a small organisation |
| Implementation help | Rarely needed; an IT provider may charge for remediation | Remediation of any devices that fail testing | £285 (DIY course and free toolkit) to around £7,500 (fully assisted) depending on route |
| Typical year-one total (small organisation) | £320 to £440 plus any fixes | £1,800 to £2,500 plus fixes | £6,000 to £15,000 |
| Ongoing | Renew every 12 months at the same fee | Renew every 12 months; Plus testing must be completed within three months of the basic certificate | Surveillance audits of £1,500 to £3,100 a year, full recertification in year three |
| Time to achieve | Days to a couple of weeks, depending on how much fixing is needed | Two to six weeks including testing | Three months for a focused SME with help; six to twelve months unassisted or with a wide scope |
| What it proves | Five baseline technical controls are in place today | The same five controls, verified by an assessor on a sample of devices | You run a managed, risk-based security system across people, process and technology, audited by an independent body |
Two things to note. Cyber Essentials prices are per legal entity certified, and the fee includes 12 months of basic cyber liability insurance for UK organisations under £20m turnover that certify the whole organisation. And the Cyber Essentials question set changed on 27 April 2026 (the “Danzell” set, IT Infrastructure v3.3): multi-factor authentication is now required for every user wherever a service supports it, and critical or high-risk patches must be applied within 14 days. Both are automatic fails if missed, so budget for fixing them before you apply.
When Cyber Essentials is enough
Choose CE (or CE Plus) if you:
- Need to meet a simple UK supplier or public-sector requirement quickly.
- Want a low-friction badge to show baseline protection and non-negligence.
- Run simple IT (e.g. Microsoft 365, laptops; little on-prem complexity).
- Want something you can renew annually and display on your website.
- Need a minimum bar for subcontractors.
It’s a practical first step for smaller organisations who want quick risk reduction without building an ISMS straight away.
ISO 27001 Coaching Programme
Get ISO 27001 certified in 90 days.
Fully remote. Fixed fee. Working with SMEs across the UK, EU and USA.
✔ Audit-ready plan with structured checkpoints
✔ Full toolkit + templates included
✔ Expert support throughout
Cancel any time
Pro-rata refund on unused sessions
✔ Defined scope, SoA and risk treatment
✔ Plain-English — no jargon
✔ Trusted auditor recommendations
First-pass guarantee
If you don’t pass, I fix it for free
“..no-nonsense help in achieving our UKAS-accredited ISO 27001 certification…”
– Periculum Security Group (UK)
When you need ISO 27001 instead
Pick ISO 27001 if you:
- Handle customer or personal data for others and need to show governance, not just tech.
- Sell across the UK/EU/US and need a globally recognised standard.
- Must control suppliers, incidents, asset inventories, access reviews, business continuity—the areas CE doesn’t cover.
- Want procurement to accept a certificate instead of lengthy questionnaires.
- Prefer a managed, repeatable system (internal audit, management review, corrective actions) rather than a yearly tick-box.
A useful analogy: CE says “we locked the doors”; ISO 27001 says “we run the building properly.”
Can (and should) you do both?
Yes—and for many UK SMEs the natural route is:
- Get Cyber Essentials first. Fix perimeter, MFA, patching, device scope. This gives you a clean technical baseline and quick credibility.
- Build ISO 27001 on top. Use CE as hard evidence for Annex A technology controls (e.g. access control, malware protection, patching, device management). ISO 27001 then adds risk management, supplier due diligence, incident response, internal audit and management review.
- Renew CE annually. It keeps the technical baseline sharp while the ISMS maintains the wider programme.
If you already run ISO 27001, you can usually obtain CE quickly—the hardening and documentation are largely in place.
Who asks for which? What UK buyers actually require
The badge you need is decided by who is buying from you, so check the specific requirement before you choose. The patterns below are the ones that come up most often.
| Buyer or situation | What they usually require | Why |
|---|---|---|
| Ministry of Defence contracts | Cyber Essentials, frequently Cyber Essentials Plus | DEFCON 658 requires suppliers handling MOD identifiable information to hold Cyber Essentials; the level is set in the contract |
| Central government contracts involving personal data or ICT | Cyber Essentials as a minimum | A long-standing government procurement policy for these contract types; some departments specify Plus |
| NHS and health bodies | Varies: Cyber Essentials Plus, the Data Security and Protection Toolkit, or ISO 27001 depending on the data involved | Trusts and ICBs set their own supplier assurance requirements |
| UK SMEs and mid-market buyers | Cyber Essentials, sometimes as a tick-box in a supplier questionnaire | Cheap for the supplier, easy for the buyer to verify, and often required by the buyer’s own insurer |
| Enterprise, financial services, international customers | ISO 27001, increasingly with SOC 2 for US buyers | They need evidence of governance, supplier management and incident handling, which Cyber Essentials does not cover |
| Cyber insurers | Cyber Essentials for small policies; ISO 27001 helps on larger or more complex cover | Insurers want evidence the basic controls are in place; Cyber Essentials was built for exactly that |
In practice, the SMEs I work with rarely get to choose. A tender lands, it names one scheme or the other, and the deadline decides the route. If you sell mostly to UK public sector or supply chains, get Cyber Essentials now and decide on ISO 27001 later. If an enterprise or overseas customer is asking, Cyber Essentials will not satisfy them and you should plan for ISO 27001 from the start.
UK-slanted decision guide
| Your situation | Recommended route |
|---|---|
| Bidding to UK public sector / MOD / NHS frameworks that ask for CE | Cyber Essentials (CE Plus if specified) |
| UK SaaS selling to mid/enterprise UK/EU buyers | ISO 27001 (keep CE if you have it) |
| A couple of phishing/ransomware scares—need fast uplift | Cyber Essentials now → ISO 27001 in 6–12 months |
| Want something marketing can show and buyers can verify | ISO 27001 (UKAS-accredited) |
| Setting minimums for subcontractors | Ask suppliers for Cyber Essentials; keep ISO 27001 for your organisation if feasible |
How they relate technically (plain English)
- CE’s five controls (firewalls, secure configuration, access control, malware protection, patching) give you strong preventive evidence for several Annex A technology controls.
- ISO 27001 layers on the management system: risk assessment and treatment, Statement of Applicability, internal audit, management review, incident handling, supplier management, and business continuity/disaster recovery.
How the five Cyber Essentials controls map to ISO 27001 Annex A
If you already hold Cyber Essentials, the work is not wasted. Each of its five controls lines up with specific ISO 27001:2022 Annex A controls, and your Cyber Essentials evidence (the self-assessment answers and, for Plus, the assessor’s report) can be reused directly in your Statement of Applicability.
| Cyber Essentials control | Closest ISO 27001 Annex A controls | What ISO 27001 adds |
|---|---|---|
| Firewalls | 8.20 Networks security, 8.22 Segregation of networks, 8.21 Security of network services | A documented network design, agreed service levels with providers, and evidence of review |
| Secure configuration | 8.9 Configuration management, 8.19 Installation of software on operational systems | Baseline configurations that are recorded, approved and checked against drift |
| Security update management | 8.8 Management of technical vulnerabilities | A process for finding, assessing and prioritising vulnerabilities, not only applying vendor patches |
| User access control | 5.15 Access control, 5.18 Access rights, 8.2 Privileged access rights, 8.5 Secure authentication | An access control policy, joiner, mover and leaver records, and periodic access reviews with evidence |
| Malware protection | 8.7 Protection against malware | Awareness training, defined response to detections, and links into incident management |
That is roughly ten of the 93 Annex A controls covered or well on the way. The other 80 or so, plus the clause 4 to 10 requirements for leadership, risk assessment, internal audit and management review, are what the ISMS adds. See the full ISO 27001 controls list for the rest.
ISO 27001 vs Cyber Essentials: the short answer
Put the other way round, in case that is how you searched for it: ISO 27001 is the bigger, internationally recognised standard and Cyber Essentials is the smaller, UK-specific one. ISO 27001 includes everything Cyber Essentials checks and a great deal more, but it costs ten to twenty times as much and takes months rather than days. Cyber Essentials does not replace ISO 27001 for a buyer who has asked for ISO 27001, and ISO 27001 does not automatically satisfy a contract that names Cyber Essentials, because the schemes are verified differently.
The honest decision rule: if nobody has asked you for ISO 27001 yet, get Cyber Essentials. If someone has, get ISO 27001 and pick up Cyber Essentials along the way, because once the ISMS is in place the Cyber Essentials self-assessment takes an afternoon.
Bottom line
- Need a quick, UK-recognised baseline? → Cyber Essentials.
- Need full, internationally recognised assurance? → ISO 27001.
- Need to look good to UK buyers and bigger customers? → Both: CE first, ISO 27001 as the operating system.
FAQs
What is the difference between Cyber Essentials and ISO 27001?
Cyber Essentials is a UK government-backed scheme focused on five technical controls — firewalls, secure configuration, user access control, malware protection, and patch management. It’s relatively quick to achieve and provides a baseline of technical security hygiene. ISO 27001 is a comprehensive international management standard covering the full lifecycle of information security — people, processes, technology and suppliers — requiring a risk-based ISMS and independent audit. Cyber Essentials is narrower and faster; ISO 27001 is broader and more rigorous.
Which is harder to get — Cyber Essentials or ISO 27001?
ISO 27001 is significantly more demanding. Cyber Essentials can typically be achieved in a matter of weeks and involves a self-assessment questionnaire (or a more thorough Cyber Essentials Plus with an external technical audit). ISO 27001 requires building a full ISMS, conducting a risk assessment, completing a Statement of Applicability, running an internal audit and management review, and passing a two-stage independent certification audit. Most UK SMEs take 60–90 days to reach ISO 27001 certification readiness.
Does ISO 27001 replace Cyber Essentials?
No — they complement each other rather than one replacing the other. ISO 27001 covers far more ground than Cyber Essentials, and an organisation with ISO 27001 will almost certainly satisfy the technical requirements of Cyber Essentials as a byproduct. However, ISO 27001 certification does not automatically grant Cyber Essentials certification — they are separate schemes with separate assessments. Some UK government contracts require Cyber Essentials specifically, so holding ISO 27001 alone may not be sufficient for every procurement requirement.
Which should I get first — Cyber Essentials or ISO 27001?
For most UK SMEs, start with Cyber Essentials if you have no formal security certification at all — it’s faster, cheaper, and gives you an immediate credible baseline. Then build toward ISO 27001. If a client or contract specifically requires ISO 27001, go straight for that — the Cyber Essentials technical controls will largely be covered in the process anyway. The two are complementary, and holding both is a strong signal in UK procurement.
Is Cyber Essentials enough for government contracts?
For many UK public sector contracts, Cyber Essentials (or Cyber Essentials Plus) is the minimum requirement. For contracts involving more sensitive data or higher-risk systems, ISO 27001 may be required or strongly preferred. The UK Government’s Digital Marketplace and many NHS frameworks reference both — check the specific procurement requirements of the contract you’re pursuing rather than assuming one will cover all situations.