A small organisation asked by a customer, an insurer or a government buyer to "meet a recognised baseline" usually faces four or five candidates that look alike from a distance but differ sharply in what they demand, who checks it and what it costs to prove. ASD's Essential Eight, the UK's Cyber Essentials, CIS Controls v8.1 Implementation Group 1 (IG1), the NIST CSF 2.0 Small Business Quick-Start Guide and Singapore's Cyber Essentials mark all target the same commodity attacks: phishing, credential reuse, unpatched internet-facing systems and ransomware. This guide compares them control by control, then on certification, effort and fit, so a small or mid-sized organisation can pick one anchor and reuse its work for the others. It is for IT managers, owners of small businesses, managed service providers and GRC leads in organisations without a large security team. Each scheme has its own deep guide on NHI Mgmt Group; this page is the chooser.
Status checked 14 November 2026: Cyber Essentials Requirements for IT Infrastructure v3.3 effective from 27 April 2026; Singapore Cyber Essentials second edition (March 2025); NIST SP 1300 (February 2024); CIS Controls v8.1; the Essential Eight Maturity Model as last revised in November 2023.
Key takeaways
- Two certify, two guide, one grades. UK Cyber Essentials and the Singapore Cyber Essentials mark lead to certificates; CIS IG1 and the NIST Quick-Start Guide are self-assessed guidance; the Essential Eight is assessed against a maturity level, usually by an internal team or external assessor rather than a certification body.
- The technical core overlaps heavily. MFA, prompt patching, restricted admin rights, malware protection and secure configuration appear in every scheme, so the first months of work are the same whichever you pick.
- The real differences are in the edges. Backups are an Essential Eight strategy and a Singapore measure but not a Cyber Essentials technical requirement; Office macros and application hardening appear only in the Essential Eight; governance and incident response are explicit in NIST and Singapore.
- The Essential Eight is the hardest to claim. A maturity level counts only when every strategy meets it, and its patch timelines (48 hours for critical or exploited internet-facing vulnerabilities) are tighter than Cyber Essentials' 14 days.
- Choose by who is asking. UK public sector contracts point to Cyber Essentials, Australian government and insurers to the Essential Eight, US customers and insurers often to CIS or CSF, and Singapore buyers to the CSA mark.
The schemes at a glance
| Scheme | Publisher and version | Structure | Assurance | Validity |
|---|---|---|---|---|
| Essential Eight | Australian Signals Directorate (ASD); maturity model last revised November 2023 | Eight mitigation strategies, Maturity Levels Zero to Three, each requirement tied to an ISM control | Assessed against a target maturity level; complete control compliance required for a level | No certificate; reassess as the estate changes |
| Cyber Essentials (UK) | NCSC, delivered by IASME; Requirements for IT Infrastructure v3.3 from 27 April 2026 | Five technical controls: firewalls, secure configuration, security update management, user access control, malware protection | Verified self-assessment marked by an assessor; Cyber Essentials Plus adds hands-on technical testing | 12 months |
| CIS Controls IG1 | Center for Internet Security; Controls v8.1 | 56 safeguards described by CIS as "essential cyber hygiene" | Self-assessed; no CIS certification of organisations | Not applicable |
| NIST CSF 2.0 Small Business Quick-Start Guide | NIST SP 1300, February 2024 | Six CSF Functions, each with Actions to Consider tagged with CSF outcome IDs, Getting Started material and a Technical Deep Dive | Self-assessed guidance; supplements CSF 2.0 | Not applicable |
| Cyber Essentials mark (Singapore) | Cyber Security Agency of Singapore (CSA); second edition, March 2025 | Nine measures in five categories (Assets, Secure/Protect, Update, Backup, Respond), 75 clauses with cloud, OT and AI columns | Guided self-assessment, then independent assessment by a CSA-appointed certification body; all requirements must be met | Two years |
For each scheme on its own, see the Essential Eight Guide, the Cyber Essentials Guide, the CIS Controls Guide and the NIST CSF 2.0 Protect Function Guide. For the wider framework landscape, see Cybersecurity Frameworks Compared.
What each scheme is built to stop
Essential Eight: graded resistance to escalating adversaries
Threat model: Maturity Level One targets adversaries "content to simply leverage commodity tradecraft", with Levels Two and Three aimed at progressively more capable and targeted attackers. Architecture: written for Microsoft Windows-based, internet-connected networks, so controls name Windows features such as Office macro settings. Typical failure: claiming a level when one strategy lags, which drops the whole organisation to the lowest strategy's level. Choose it when: you sell to Australian government, your insurer asks for it, or you want a model that grows into Level Two and Three.
Cyber Essentials: five controls against internet-borne attacks
Threat model: common internet-based threats, as the NCSC frames the scheme. Architecture: a defined scope that must include end-user devices, BYOD that accesses organisational data and, since v3.3, every cloud service that hosts or processes organisational data. Typical failure: scoping out awkward systems; v3.3 states that cloud services cannot be excluded, and an unsupported device must be removed or isolated in a sub-set with internet traffic blocked. Choose it when: you supply UK government or a UK supply chain that requires it.
CIS Controls IG1: hygiene for organisations with limited expertise
Threat model: the most common attacks against small and medium enterprises holding low-sensitivity employee and financial data. Architecture: safeguards that CIS says should be implementable with limited expertise on commercial off-the-shelf hardware and software. Typical failure: treating IG1 as complete security when CIS positions it as the entry point to IG2 and IG3. Choose it when: customers or insurers ask for CIS, or you want a prioritised technical list you can grow without changing framework. See the CIS Controls IG1 Rollout Plan.
NIST CSF 2.0 Quick-Start: a starting structure, not a control list
Threat model: not stated as a single adversary; the guide helps organisations with little or no cybersecurity planning begin managing risk across all six Functions. Architecture: governance first (Govern), then Identify, Protect, Detect, Respond and Recover, each with starter tables such as an asset inventory template and an MFA account checklist. Typical failure: using it as a compliance claim; it is voluntary guidance and the starter checklist notes your own list will likely be longer. Choose it when: you need board-level structure and a path into the full CSF 2.0.
Singapore Cyber Essentials mark: SME baseline with cloud, OT and AI
Threat model: resource-constrained organisations that mostly consume SaaS and AI tools. Architecture: nine measures, with additional cloud, OT and AI security clauses such as tracking shadow AI and controlling data entered into public AI tools. Typical failure: forgetting that every requirement must be met, including people, data inventory and incident response measures that the UK scheme does not test. Choose it when: you operate or sell in Singapore; CSA points higher-risk organisations to its Cyber Trust mark instead.
Control-by-control overlap
One row per control area. Cells summarise the entry level of each scheme (Essential Eight Maturity Level One, CIS IG1, Cyber Essentials, Singapore Cyber Essentials) and the Quick-Start actions.
| Control area | Essential Eight (ML1) | Cyber Essentials v3.3 | CIS IG1 (v8.1) | NIST SP 1300 | Singapore Cyber Essentials |
|---|---|---|---|---|---|
| Asset inventory | Asset discovery to support patching | Scope definition; all in-scope devices and software known | 1.1 enterprise asset inventory; 2.1 software inventory | Identify: IT asset inventory template | Assets: hardware and software, data inventory |
| Patching internet-facing systems | 48 hours if critical or a working exploit exists, otherwise two weeks | 14 days for critical or high risk, CVSS v3 7 or above, or no severity given | 7.3 and 7.4 automated OS and application patch management | Turn on automatic updates; apply updates regularly | Update: software updates |
| Patching workstations and internal systems | One month for operating systems; two weeks for common applications | Same 14-day rule for all in-scope software | 7.3, 7.4 | As above | As above |
| Unsupported software | Removed or replaced | Must be licensed and supported, or removed from scope | 2.2 ensure authorised software is supported | Not specified | Hardware and software measure |
| Multi-factor authentication | Online services handling sensitive data and customer-facing services | Always for cloud services and admin or internet-accessible accounts | 6.3 externally exposed applications; 6.4 remote network access; 6.5 administrative access | MFA on every account that supports it | Access control measure |
| Passwords | Not a separate strategy | MFA, or 12 characters, or 8 characters plus a deny list; no forced expiry or complexity | 5.2 unique passwords | Consider a password manager; change default passwords | Access control measure |
| Administrative privileges | Validated requests; dedicated privileged accounts with no email or web | Separate admin accounts used only for admin tasks | 5.4 restrict administrator privileges to dedicated accounts | Restrict sensitive information to those who need it | Access control measure |
| Malware and execution control | Application control on workstations including user profiles and temporary folders | Anti-malware, or application allow listing of signed applications | 10.1 anti-malware software | Covered through Protect actions | Virus and malware protection |
| Office macros and app hardening | Two dedicated strategies | Disable auto-run under secure configuration | Not an IG1 safeguard | Not specified | Secure configuration |
| Firewalls and boundary | Not a strategy | Firewall on every device; default admin passwords changed; block unauthenticated inbound | 4.4 and 4.5 firewalls on servers and end-user devices | Protect actions | Secure configuration |
| Backups | A strategy: performed, retained, restoration tested | Emphasised in v3.3 but not a technical requirement | 11.1 data recovery process; 11.2 automated backups | Back up regularly and test backups | Backup measure, stored separately and securely |
| Awareness training | Not a strategy | Not tested | 14.1 security awareness programme | Train staff to recognise attacks | People measure |
| Incident response | Not a strategy | Not tested | 17.1 designate incident handling personnel | Respond and Recover Functions with contact tables and playbooks | Respond measure |
| Governance | Risk-based target levels and documented exceptions | Board-level sign-off of the self-assessment | Process safeguards such as 1.1 and 4.1 policies | Govern Function first | Implied through assessment |
Reading the table: Cyber Essentials and IG1 are closest to each other; the Essential Eight is narrower but deeper on execution control and timelines; NIST and Singapore are broader, covering people, governance and incident response.
Certification, evidence and effort
| Question | Essential Eight | Cyber Essentials | CIS IG1 | NIST SP 1300 | Singapore mark |
|---|---|---|---|---|---|
| Who checks | Internal team or external assessor | IASME assessor (CE); certification body testing (CE Plus) | You, or an auditor you appoint | You | CSA-appointed certification body |
| Typical evidence | Control outcomes per strategy, test results, configuration exports | Answers signed off by a board member or equivalent; CE Plus tests representative user devices, internet gateways and internet-facing servers | Safeguard implementation records | Current and target profile notes | Self-assessment template plus assessor review |
| Public signal | Maturity level stated in tenders | Certificate in a public search | None | None | Certificate mark |
| Cost signal from the publisher | Not published | From GBP 320 plus VAT by organisation size | Free framework | Free guide | Described by CSA as affordable |
| Relative effort to first claim | Highest: all eight strategies at one level | Low to moderate | Moderate: 56 safeguards | Lowest to start | Moderate: nine measures, 75 clauses |
UK organisations with turnover under GBP 20 million that certify their whole organisation receive cyber liability insurance arranged through IASME, which changes the cost comparison for many small UK firms.
Decision guidance
- UK supplier, public sector or supply chain requirement: Cyber Essentials, then Cyber Essentials Plus. Add the IG1 safeguards for backups, awareness and incident response that the scheme does not test. See the Cyber Essentials Readiness Checklist.
- Australian organisation or insurer request: Essential Eight Maturity Level One as the first target, with a plan to Level Two, which brings phishing-resistant MFA.
- US customer questionnaires and insurers: CIS IG1 as the control set, with SP 1300 to structure governance and report in CSF language.
- Singapore operations: the CSA Cyber Essentials mark; its cloud and AI clauses are useful even where certification is not required.
- Multinational small firm: anchor on CIS IG1 because its safeguards map most directly to the others, then certify Cyber Essentials or the Singapore mark where buyers ask.
- Very small firm with no IT staff: start with the Small Business Cybersecurity Basics Guide and SP 1300, then move to Cyber Essentials or IG1.
Small versus mid-sized: under about 50 staff on mostly SaaS, Cyber Essentials or the Singapore mark is usually achievable in weeks with an MSP. Mid-sized organisations with servers, line-of-business applications and their own domain should expect the Essential Eight's application control and patch timelines to take several months, and should run Cyber Essentials Plus testing or an Essential Eight assessment annually.
Worked scenario: one firm, three asks
A 45-person engineering consultancy runs Microsoft 365, a cloud accounting package and 50 Windows laptops. A UK council requires Cyber Essentials, an Australian client asks for Essential Eight Maturity Level One, and its insurer's questionnaire follows CIS IG1.
- Shared core first: MFA on every cloud service and admin account, separate admin accounts, automatic updates with 14-day enforcement, Microsoft Defender or equivalent on every laptop, firewalls on and default passwords changed. This satisfies most of Cyber Essentials and many IG1 safeguards.
- Close the Essential Eight gaps: 48-hour patching for critical internet-facing vulnerabilities, application control covering user profiles and temporary folders, Office macro restrictions, application hardening and tested backups.
- Close the IG1 gaps: asset and software inventories, security awareness training, a named incident handler and a documented data recovery process.
- Certify once, answer three times: submit Cyber Essentials, record Essential Eight outcomes per strategy, and answer the insurer from the same evidence folder.
Implementation plan for any anchor
- Confirm the ask: which scheme, which level and which scope each customer, insurer or regulator requires, in writing.
- Inventory first: devices, software, cloud services and accounts, including service accounts and API keys used by integrations, because every scheme's access controls apply to them.
- Pilot the hard controls: run application control in audit mode on a pilot group, and stage MFA by group, with a break-glass account protected and monitored.
- Enforce in rings: extend enforcement in waves, keeping the previous policy ready to restore if a business application breaks.
- Test the evidence: run a mock Cyber Essentials Plus or Essential Eight assessment internally before paying for the real one.
- Schedule renewal: Cyber Essentials every 12 months, the Singapore mark every two years, and Essential Eight reassessment whenever the estate changes materially.
Detection and measurement
- Patch compliance within the scheme's window: percentage of critical and high updates applied within 14 days (Cyber Essentials) or 48 hours for internet-facing systems (Essential Eight).
- MFA coverage: percentage of cloud and admin accounts with MFA enforced, with phishing-resistant MFA tracked separately for Essential Eight Level Two.
- Unsupported software count: number of in-scope devices or applications past vendor support. Target zero.
- Restore success rate: percentage of scheduled restore tests that succeed.
- Admin account hygiene: number of admin accounts used for email or browsing, from sign-in logs. Target zero.
Common failure patterns
- Forgotten accounts outside MFA: every scheme requires removing unneeded accounts and enforcing MFA on remote access. The Colonial Pipeline ransomware attack began with a legacy VPN account that was no longer used, had never been disabled and did not require MFA.
- Scoping out the cloud: treating Microsoft 365 or the accounting SaaS as "the provider's problem", which Cyber Essentials v3.3 explicitly rules out.
- Averaging the Essential Eight: reporting Level Two because most strategies reach it while backups or macros sit at Level One.
- Certificate as end state: passing Cyber Essentials and never testing backups or incident response, which the scheme does not assess.
- Ignoring non-human accounts: integration accounts and API keys left with admin rights and no MFA equivalent. See the Small Business Identity and Access Security Guide.
Framework mapping
| Shared control | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Asset inventory | ID.AM-01, ID.AM-02 | CM-8 | A.5.9 |
| Secure configuration and firewalls | PR.PS-01, PR.IR-01 | CM-6, CM-7, SC-7 | A.8.9, A.8.20 |
| Patching and unsupported software | PR.PS-02 | SI-2, SA-22 | A.8.8 |
| MFA and access control | PR.AA-03, PR.AA-05 | IA-2, AC-6 | A.5.15, A.8.2, A.8.5 |
| Malware and execution control | PR.PS-05 | SI-3, CM-7 | A.8.7 |
| Backups | PR.DS-11 | CP-9 | A.8.13 |
| Awareness and incident response | PR.AT-01, RS.MA-01 | AT-2, IR-4 | A.6.3, A.5.26 |
Practitioner checklist
- Get each customer's, insurer's or regulator's baseline requirement in writing, including level and scope.
- Build one inventory of devices, software, cloud services, user accounts and service accounts.
- Enforce MFA on every cloud service, remote access route and admin account.
- Set patch windows to the strictest scheme you need: 48 hours for critical internet-facing issues if the Essential Eight applies, otherwise 14 days.
- Remove or isolate unsupported software and devices.
- Separate admin accounts from daily email and browsing accounts.
- Deploy malware protection or application control on every device, piloted in audit mode first.
- Back up essential data, store a copy separately and test restores, even where the scheme does not require it.
- Name an incident handler and keep a contact table for your MSP, insurer and bank.
- Diary renewals and reassessments, and keep one evidence folder that serves every scheme.
Standards and references
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3
- NCSC: Cyber Essentials overview
- IASME: Cyber Essentials certification
- Center for Internet Security: CIS Controls Implementation Group 1
- NIST: SP 1300 CSF 2.0 Small Business Quick-Start Guide
- Cyber Security Agency of Singapore: Cyber Essentials (second edition)
- Queensland Government: Essential Eight guideline
- Microsoft Learn: Essential Eight patch operating systems mapping
Related NHI Mgmt Group resources: Cybersecurity Frameworks Compared, Essential Eight Guide, Cyber Essentials Guide, CIS Controls IG1 Rollout Plan, Small Business Cyber Security Checklist.