Cyber Essentials vs ISO 27001

Cyber Essentials vs ISO 27001 is not a choice between a small and a large version of the same thing. Cyber Essentials is a UK government-backed certificate that checks five technical controls on your devices, networks and cloud services. It costs from £320 + VAT and usually takes days or weeks. ISO 27001 is an international standard for running a whole information security management system (ISMS), from risk assessment and policies to suppliers, incidents and continuity. It typically takes three to nine months and runs on a three-year certificate cycle.

In short: if a UK public-sector buyer asks for Cyber Essentials, get Cyber Essentials, because ISO 27001 does not replace it. If enterprise or overseas customers want proof that security is governed, not just configured, you need ISO 27001. Our guide to the benefits of ISO 27001 sets out what certification brings. Many growing UK businesses end up with both, and the work overlaps.

Cyber Essentials vs ISO 27001: the differences at a glance

The table includes Cyber Essentials Plus, because Cyber Essentials Plus vs ISO 27001 is often the real choice a buyer is weighing.

What does each standard actually cover?

Cyber Essentials asks a narrow question: are the controls that stop the most common internet attacks in place on every in-scope device? The five controls are firewalls, secure configuration, security update management, user access control and malware protection. The rules are prescriptive. A high-risk or critical security update left unapplied for more than 14 days, an unsupported operating system or a cloud service without multi-factor authentication (MFA) is a fail, whatever your policies say.

ISO 27001 asks a broader question: do you understand your information security risks, and do you run a management system that treats them and keeps improving? The ISO 27001 requirements in clauses 4 to 10 are mandatory and cover scope, leadership, risk assessment and treatment, support, operation, internal audit, management review and improvement. Annex A of ISO/IEC 27001:2022 lists 93 reference controls: 37 organisational, 8 people, 14 physical and 34 technological. You decide which apply and justify each decision in a Statement of Applicability.

This is the difference that matters. ISO 27001 is risk-based, so it lets you set your own patching window or password rules if your risk assessment supports them. Cyber Essentials does not. An ISO 27001-certified business can still fail Cyber Essentials, and a Cyber Essentials certificate says nothing about how you manage suppliers, incidents or continuity. The NCSC makes the same point: an ISO/IEC 27001 certificate cannot simply be treated as equivalent to Cyber Essentials.

Cyber Essentials or ISO 27001: which do you need?

Start with who is asking and exactly what they asked for. Work down the table and stop at the first row that fits.

Supplying the NHS? Organisations with access to NHS patient data and systems also complete the Data Security and Protection Toolkit every year, whichever certificates they hold. Cyber Essentials Plus lifts a Standards Met result to Standards Exceeded for suppliers and smaller organisations, and both certificates supply evidence for parts of it; our NHS DSPT guide explains how.

Weighing PCI DSS, SOC 2 or IASME Cyber Assurance as well? Our comparison of UK cyber security certifications puts all of them in one table.

Do I need Cyber Essentials if I have ISO 27001?

Usually yes, if a contract names Cyber Essentials. The Cabinet Office’s PPN 014 covers central government departments, their agencies and non-departmental public bodies, and NHS bodies. It says organisations with ISO 27001 “will not automatically conform to Cyber Essentials”, because an ISO 27001 scope does not usually include all five technical controls. Unless the buyer accepts evidence of equivalent controls, you will need the certificate, and it is almost always the simpler route.

If you already run an ISMS, Cyber Essentials is normally quick. Check these first:

• no unsupported operating systems or software in scope, including home-working devices
• high and critical updates applied within 14 days in practice, not just in policy
• MFA switched on for every cloud service that offers it
• separate admin accounts, used only for admin tasks

Is ISO 27001 harder than Cyber Essentials?

Yes, by a wide margin. Cyber Essentials is a set of technical settings you can often fix and evidence in days or weeks. ISO 27001 is a management system, and certification auditors want records showing it has been running.

Most organisations take a few days to a few weeks to prepare for Cyber Essentials. Once you submit, we assess within 24 hours on our Gold package, 48 hours on Silver and 3 to 5 working days on Bronze. A small to mid-sized organisation typically needs three to nine months to go from ISO 27001 gap analysis to certificate, depending on how mature its security already is.

Is ISO 27001 better than Cyber Essentials Plus?

Neither is better in general: ISO 27001 is broader, and Cyber Essentials Plus is more technical. ISO 27001 is the better choice when customers want proof that security is governed across the organisation, including risk, suppliers, incidents and continuity, or when you sell overseas. Cyber Essentials Plus is the better choice when a UK contract names it, because ISO 27001 does not replace it, and it is far quicker and cheaper to achieve. Both involve an independent auditor, but they test very different things.

• Cyber Essentials Plus is technical. The assessor scans your external IP addresses, runs authenticated vulnerability scans on sample devices, sends test malware by email and browser, checks mobile devices and confirms MFA is enforced. You then get a limited window to fix and retest any failures.
• ISO 27001 is managerial. The auditor interviews people, reviews documents and samples records to confirm your ISMS works as described. They check that you manage technical vulnerabilities (Annex A 8.8) but do not usually scan anything themselves.

So Cyber Essentials Plus proves your devices are configured properly today, while ISO 27001 proves you have a system that keeps them that way and covers everything else. Buyers who ask for both want exactly that combination.

Which is cheaper, Cyber Essentials or ISO 27001?

Cyber Essentials is far cheaper. IASME sets its fee by organisation size, while ISO 27001 adds certification body audits, optional consultancy and much more of your own staff time.

The IASME figures are the official fee bands. The Cyber Essentials Plus and ISO 27001 figures are published prices from UK providers we reviewed in September 2026, not Sovereign Secure prices. For exact numbers, see our Cyber Essentials price list and our guide to ISO 27001 certification cost.

Should you do both? How Cyber Essentials maps to ISO 27001

The ISO 27001 vs Cyber Essentials question often ends in “both”, and doing Cyber Essentials first is rarely wasted. The five Cyber Essentials controls line up with a small group of Annex A controls in ISO/IEC 27001:2022, mostly in the technological theme, and much of the evidence carries straight across.

ISO 27001 then adds leadership and policy (clause 5), a documented risk assessment and Statement of Applicability (clause 6), supplier and cloud security (5.19 to 5.23), incident management and continuity (5.24 to 5.30), people controls such as awareness training (6), physical security (7), backup and monitoring (8.13, 8.15, 8.16), and internal audit and management review (clauses 9 and 10).

A typical route to holding both:

Our ISO 27001 gap analysis is the usual starting point for step 2.

Why Sovereign Secure for Cyber Essentials and ISO 27001

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body and an ISO 27001-certified UK consultancy based in Accrington, Lancashire. ISO certification audits are carried out by our partner certification body, MQA International.

• We certify Cyber Essentials ourselves. We assess and issue Cyber Essentials certification and Cyber Essentials Plus directly, with no middleman, and we also certify IASME Cyber Assurance.
• We hold ISO 27001. Our ISO 27001 consultancy maps your Cyber Essentials evidence into Annex A, so you do the work once.
• Consultancy and certification stay separate. We help you implement; MQA International carries out the certification audits.
• Card payments covered too. We are a PCI SSC Qualified Security Assessor (QSA) company and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026 to 2028, so one team can align all three frameworks.

Next step: get a fixed quote

Tell us what your customer or tender is asking for and when you need it. We will tell you plainly whether Cyber Essentials, Cyber Essentials Plus, ISO 27001 or a combination fits, then give you a fixed quote. Complete the Cyber Essentials scoping questionnaire, contact our team or call +44 161 523 5276. Want to see where you stand first? Try our free Cyber Essentials readiness check or work through our ISO 27001 checklist.