UK organisations are regularly asked for "Cyber Essentials or ISO 27001" in the same tender, and picking the wrong one first wastes months and budget. The two are not rival versions of the same thing: Cyber Essentials is a fixed technical baseline of five controls, while ISO/IEC 27001:2022 certifies a risk-driven management system. This guide compares scope, cost, effort, buyer requirements and how the Cyber Essentials controls land in Annex A, then gives a decision checklist and worked scenarios. It is written for security leads, compliance owners and bid teams deciding where to start and how to run both without doing the work twice.
Key takeaways
- Different questions answered: Cyber Essentials asks "are these five technical controls in place on every in-scope device?", ISO 27001 asks "does this organisation manage information security risk systematically?".
- Government contracts lean on Cyber Essentials: PPN 014 asks UK central government buyers to require Cyber Essentials or Plus for contracts with set characteristics, and states that ISO 27001 does not automatically confer Cyber Essentials compliance.
- Cost and time differ by an order of magnitude: Cyber Essentials starts at £320 plus VAT with an annual renewal, ISO 27001 needs a management system, internal audit and a three-year cycle of external audits.
- Cyber Essentials fits inside ISO 27001: each of the five controls maps to Annex A technological and organisational controls, so a good Cyber Essentials build is evidence for a subset of the Statement of Applicability.
- Most growing suppliers end up with both: start with Cyber Essentials (or Plus) to win public sector work quickly, then build ISO 27001 around it when enterprise or international buyers ask for a management system certificate.
The short answer
If you need a certificate within weeks to bid for UK public sector work, or you are a small organisation with no security programme yet, start with Cyber Essentials, and move to Cyber Essentials Plus if the buyer asks for independent testing. If your buyers are large enterprises, regulated firms or overseas customers asking about your information security management system, or you handle data whose loss would be material, plan for ISO 27001, and use Cyber Essentials as the technical floor you build first. If both apply, do Cyber Essentials first and design the ISO 27001 scope so the Cyber Essentials evidence feeds it.
What each scheme is, in architecture terms
Cyber Essentials: a fixed control baseline
Cyber Essentials is the NCSC scheme the UK Government recommends as the minimum cyber security standard for organisations of all sizes. IASME is the NCSC's delivery partner and licenses a network of more than 400 certification bodies. The basic level is a verified self-assessment: a board member or equivalent signs it off and an assessor marks it. Cyber Essentials Plus assesses the same five controls with hands-on technical testing. The controls are firewalls, secure configuration, security update management, user access control and malware protection, defined in the NCSC document Cyber Essentials: Requirements for IT Infrastructure, version 3.3 from April 2026.
The design is deliberately prescriptive. There is no risk assessment: every organisation meets the same thresholds. Examples from v3.3 include installing critical or high risk fixes (CVSS v3 base score 7 or above, vendor-rated critical or high, or with no severity given) within 14 days of release, MFA always on cloud services, separate accounts for administrative work with no email or web browsing, auto-run disabled, and anti-malware or application allow listing on each in-scope device.
ISO 27001: a certified management system
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). Clauses 4 to 10 cover context and scope, leadership, risk assessment and treatment planning, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in four themes (organisational, people, physical, technological). Which controls apply is decided by your own risk assessment and recorded, with justifications, in the Statement of Applicability. ISO does not certify anyone: certification bodies, accredited in the UK by UKAS against ISO/IEC 27006, audit in two stages and then run annual surveillance across a three-year cycle. See the ISO 27001 Certification Guide for the clause-by-clause detail.
Side-by-side comparison
| Dimension | Cyber Essentials / Plus | ISO/IEC 27001:2022 |
|---|---|---|
| Owner | NCSC, delivered by IASME and licensed certification bodies | ISO and IEC standard; accredited certification bodies audit |
| What is certified | Five technical controls on the in-scope IT estate | A management system for information security risk |
| Control selection | Fixed requirements, the same for everyone | Risk-based; Annex A controls selected and justified in the SoA |
| Scope | Whole organisation or a separately managed sub-set; cloud services and end-user devices cannot be excluded | Organisation-defined ISMS scope (clause 4.3), may be a business unit, service or site |
| Assessment | CE: marked self-assessment. Plus: technical testing of a sample of devices and all internet gateways and internet-accessible servers | Stage 1 documentation review, stage 2 implementation audit, interviews and record sampling |
| People and process | Account lifecycle and admin separation only | Leadership, competence, awareness, supplier management, incident management, continuity, internal audit, management review |
| Validity | 12 months, full re-assessment annually | Three years with annual surveillance audits, then recertification |
| Entry fee | £320 to £600 plus VAT by headcount (IASME, checked November 2026); Plus is quoted | Quoted by the certification body, driven by headcount, sites and scope complexity |
| Typical lead time | Self-assessment about an hour when prepared; results aimed within 3 working days | Commonly six to nine months for a focused small scope, longer for multi-site organisations |
| Recognition | UK-centric; named in central government procurement policy | International; widely requested in enterprise due diligence |
Threat model: what each actually protects against
- Cyber Essentials: built against commodity, internet-originated attacks: phishing that drops malware, password guessing and credential stuffing against exposed services, exploitation of unpatched internet-facing software, and abuse of default or over-privileged accounts. It says nothing about insider misuse, supplier compromise, physical theft, data governance, logging or recovery.
- ISO 27001: the threat model is whatever your clause 6.1.2 risk assessment says it is. That flexibility is its strength (a payments processor can weight fraud and supplier risk, a lab can weight IP theft) and its weakness: a weak risk assessment produces a certified ISMS with thin technical controls.
- The gap PPN 014 calls out: because ISO 27001 scope and control selection are organisation-defined, the policy note observes that an ISO 27001 scope usually excludes some of the five Cyber Essentials technical controls, so most ISO 27001 holders will need Cyber Essentials as well or must demonstrate equivalent controls.
Buyer and contract requirements
PPN 014, published 17 February 2025 and applying from 24 February 2025 under the Procurement Act 2023, replaces PPN 09/14 and PPN 09/23. It applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies; other public bodies may choose to follow it. Buyers are asked to require Cyber Essentials or Cyber Essentials Plus where a contract involves:
- Citizen personal data: handling citizens' personal information such as home addresses, bank details or payment information.
- Government staff data: personal information of government employees, ministers or special advisers, such as payroll or expenses.
- OFFICIAL systems: ICT systems designed to store or process data at OFFICIAL level.
- Core government business: the day-to-day business of government, service delivery or public finances.
Certification must be renewed annually where required. Suppliers without it may show equivalent controls, normally verified by a technically competent, independent third party. In practice an equivalence case costs more effort than the certificate itself, so a supplier bidding regularly should simply certify. Private sector buyers vary: some copy the government approach in supplier questionnaires, others ask for ISO 27001 or a SOC 2 report and treat Cyber Essentials as a minimum. Buyers checking a supplier certificate should read its scope statement, not just its logo.
How the Cyber Essentials controls map into Annex A
Use this table to reuse Cyber Essentials evidence in your Statement of Applicability. It runs one way only: meeting the Annex A control in your ISMS does not prove you meet the Cyber Essentials threshold, because Annex A does not set the 14-day, MFA-on-all-cloud or admin-separation values.
| Cyber Essentials control | Key v3.3 requirement | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 / SP 800-53 r5 |
|---|---|---|---|
| Firewalls | Boundary or host firewall on every in-scope device, default admin passwords changed, inbound rules approved and documented | 8.20 Networks security; 8.21 Security of network services; 8.22 Segregation of networks | PR.IR-01; SC-7 |
| Secure configuration | Remove unnecessary accounts and software, change defaults, disable auto-run, device unlock | 8.9 Configuration management; 8.1 User endpoint devices; 8.19 Installation of software on operational systems | PR.PS-01; CM-2, CM-6 |
| Security update management | Supported software only; critical and high fixes within 14 days; automatic updates where possible | 8.8 Management of technical vulnerabilities | PR.PS-02; SI-2 |
| User access control | Account approval process, unique credentials, removal of unneeded accounts, separate admin accounts, MFA always for cloud services, password rules | 5.15 Access control; 5.16 Identity management; 5.17 Authentication information; 5.18 Access rights; 8.2 Privileged access rights; 8.5 Secure authentication | PR.AA-01, PR.AA-05; AC-2, AC-6, IA-2 |
| Malware protection | Anti-malware blocking execution and malicious sites, or application allow listing | 8.7 Protection against malware | DE.CM-09; SI-3 |
| Scope rule: cloud services in scope | Cloud services cannot be excluded | 5.23 Information security for use of cloud services | GV.SC-05 |
That is roughly 15 of the 93 Annex A controls. The remainder (supplier relationships, incident management, logging, continuity, data protection, physical security, people controls) has no Cyber Essentials equivalent. See the ISO 27001 2022 controls guide for the controls added in the current edition.
Cost and effort in practice
Cyber Essentials
- Fees: IASME's self-assessment fees are £320 (0 to 9 employees), £440 (10 to 49), £500 (50 to 249) and £600 (250 or more), plus VAT, checked November 2026. Cyber Essentials Plus is quoted by the certification body on network size and complexity.
- Remediation is the real cost: replacing unsupported operating systems, putting MFA on every cloud service including the small SaaS tools a team signed up for, splitting admin accounts, and bringing BYOD devices under control.
- Calendar: once the estate is compliant, the question set takes about an hour; assessors aim to return results within three working days, a failed submission can be corrected within two working days at no charge, and an application must be submitted within six months. If the self-assessment passed less than three months before applying for Plus, the questions need not be repeated.
- Bundled insurance: UK or Crown Dependency organisations under £20m turnover that certify the whole organisation and opt in receive cyber liability cover with a £25,000 limit, arranged by IASME. It is a starting point, not a substitute for a proper policy.
ISO 27001
- Internal effort dominates: scoping, risk methodology, risk assessment, SoA, policies, control implementation, awareness, a full internal audit cycle and a management review must all exist before stage 2.
- External fees: audit days are set by the certification body from headcount and scope complexity under ISO/IEC 27006, so quotes for the same organisation can differ; compare on accreditation and auditor competence, not day rate. See the ISO 27001 Certification Body Selection guide.
- Running cost: annual surveillance, a three-yearly recertification and the people time to run risk reviews, internal audits and corrective actions. Budget for an ISMS owner role, not a one-off project.
Failure modes of each
| Scheme | Failure mode | How it shows up | Control |
|---|---|---|---|
| Cyber Essentials | Point-in-time compliance | Patching slips after the certificate date; the 14-day rule is met only in the month before renewal | Track patch age monthly as a KPI, not annually |
| Cyber Essentials | Narrow sub-set scope | Certificate covers one office network while the service the buyer cares about runs elsewhere | Read the scope statement on the certificate and match it to the contract |
| Cyber Essentials | Unlisted cloud services | Shadow SaaS without MFA, discovered during Plus testing or an incident | SaaS discovery and an approval gate before new services go live |
| ISO 27001 | Paper ISMS | Policies and SoA exist, technical controls are thin, audit sampling misses it | Use the Cyber Essentials thresholds as minimum measurable targets inside the ISMS |
| ISO 27001 | Scope gerrymandering | Scope excludes the product, cloud tenancy or support function a customer depends on | Publish the scope statement and check it against customer-facing services |
| Both | Machine identities ignored | Service accounts and API keys sit outside the account-approval process and MFA rules | Inventory non-human identities and give each an owner and rotation schedule |
Where identity fits
Most of what fails a Cyber Essentials assessment is identity hygiene: shared admin accounts, accounts left open after people leave, cloud services without MFA and accounts held by managed service providers with standing administrative access. ISO 27001 controls 5.16 to 5.18 and 8.2 ask for the same lifecycle discipline, with the addition that it must be risk-assessed and reviewed. Neither scheme names non-human identities explicitly, yet service accounts, OAuth applications and API keys often hold the most privilege in the estate. Bring them into the account approval and review process in both schemes. See the MFA Guide and the Identity Controls for Cyber Insurance Questionnaires Guide, which covers overlapping evidence requests.
When to choose which: decision criteria
| Situation | Start with | Why |
|---|---|---|
| Bidding for UK central government or NHS work with personal data or OFFICIAL systems | Cyber Essentials, Plus if the tender asks | Named in PPN 014; equivalence cases are slower than certifying |
| Under 50 staff, no security function, cloud-first | Cyber Essentials | Fixed checklist gives a defensible baseline in weeks |
| Selling SaaS to enterprises or overseas | Cyber Essentials now, ISO 27001 within 12 months | Enterprise questionnaires ask for an ISMS certificate; CE builds the technical floor |
| Already ISO 27001 certified, now bidding for government work | Add Cyber Essentials | PPN 014 says ISO 27001 does not automatically confer CE compliance |
| Regulated by NIS-type rules, DORA or sector regulators | ISO 27001, with CE as technical evidence | Regulators expect governance, risk and incident processes CE does not cover; see the NCSC Cyber Assessment Framework (CAF) Guide |
| Holding data whose loss would be material (health, finance, IP) | Both, ISO 27001 scoped around that data | Risk-based controls are needed beyond the CE baseline |
Small vs large organisations: for a small business, Cyber Essentials is often the whole programme for the first year, and Plus provides the independent assurance. For a large organisation, whole-estate Cyber Essentials is the hard part: thousands of endpoints, legacy systems and BYOD must all meet the thresholds, so large firms often certify a separately managed sub-set for specific contracts while their ISO 27001 scope covers the business. Both choices are legitimate if the scope statements are honest.
Worked scenarios
- Scenario A, 30-person payroll bureau bidding for a government department: the contract involves government staff personal data, a PPN 014 characteristic. The bureau certifies Cyber Essentials across the whole organisation (fee £440 plus VAT at its size), fixing two unsupported laptops and adding MFA to its file-sharing service. The buyer then asks for Plus, so it books testing within three months to avoid repeating the questions. ISO 27001 is deferred until a large private client asks.
- Scenario B, 200-person SaaS provider with US and EU customers: enterprise questionnaires ask for ISO 27001. The provider certifies Cyber Essentials Plus first in eight weeks, using it to fix endpoint and admin-account gaps, then scopes ISO 27001 to the product, its cloud tenancy and support. The Annex A mapping above lets it mark 8.7, 8.8, 8.9 and the access controls as implemented with Plus test evidence.
- Scenario C, ISO 27001-certified consultancy entering public sector work: its ISMS scope covers the consulting service but not staff BYOD phones that read email. Cyber Essentials requires BYOD that accesses organisational data to be in scope, so it introduces mobile device management and MFA before certifying, closing a gap its ISO 27001 risk assessment had accepted.
Running both: a phased approach
- Inventory first: list every device, cloud service, user and admin account, and internet-facing system. Both schemes depend on it, and Cyber Essentials will fail on anything missed.
- Gap-check against v3.3: use the Cyber Essentials Readiness Checklist; fix unsupported software, MFA on cloud services and admin separation before applying.
- Certify Cyber Essentials, then Plus: book Plus testing soon after the self-assessment; run an internal test on a sample of devices first so the external test is not the first time malware blocking is tried.
- Define the ISMS scope: include the services customers rely on and align it with the Cyber Essentials scope where you can, so one asset inventory serves both.
- Run the risk assessment and SoA: record the Cyber Essentials controls as implemented, with the certificate and Plus test report as evidence; use the ISO 27001 Statement of Applicability Template.
- Build the management layer: policies, supplier management, incident response, logging, continuity, awareness, internal audit and management review.
- Stage 1 and stage 2 audits: address stage 1 concerns before stage 2; major nonconformities must be corrected before a certificate is issued.
- Align renewal calendars: schedule Cyber Essentials renewal a few months before ISO surveillance so the fresh assessment is evidence for the audit. If a renewal fails, the previous certificate simply lapses at its expiry date, so start renewal early enough to fix and resubmit.
Measuring that it is working
- Patch latency: percentage of critical and high fixes installed within 14 days, measured monthly across the whole scope.
- MFA coverage: percentage of cloud services and admin accounts with MFA enforced (target 100% for Cyber Essentials).
- Unsupported software count: in-scope devices running end-of-support operating systems or applications (target zero).
- Admin separation: number of admin accounts used for email or browsing, from sign-in logs (target zero).
- ISMS health: open nonconformities and overdue corrective actions from internal audit and surveillance.
- Bid impact: tenders lost or delayed for lack of a certificate, which justifies the next step on the roadmap.
Practitioner checklist
- Read the tender: note whether it names Cyber Essentials, Plus, ISO 27001 or equivalence, and the scope it expects.
- Confirm the current Cyber Essentials requirements version on the NCSC site before you start remediation.
- Check scope rules: cloud services and end-user devices cannot be excluded, and BYOD accessing organisational data is in scope.
- Put MFA on every cloud service and admin account, and separate admin accounts from daily accounts.
- Remove or isolate unsupported software and evidence 14-day patching for critical and high fixes.
- Plan Plus testing within three months of the self-assessment.
- Scope ISO 27001 around customer-facing services and reuse Cyber Essentials evidence in the SoA.
- Add service accounts and API keys to account approval and review processes in both schemes.
- Choose an accredited ISO 27001 certification body and check the certificate scope statement before you publish it.
- Track patch latency and MFA coverage monthly so neither certificate is a once-a-year exercise.
Standards and references
- NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3
- NCSC: About Cyber Essentials
- Cabinet Office: PPN 014 Cyber Essentials Scheme
- ISO: ISO/IEC 27001 Information security management systems
- IASME: Cyber Essentials frequently asked questions
- IASME: Cyber Essentials cyber liability insurance
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cyber Essentials Guide, ISO 27001 Certification Guide, ISO 27001 Lead Auditor and Lead Implementer Guide, NCSC Cyber Assessment Framework (CAF) Guide, ISO 27001 Certification Readiness Checklist.