Cyber Essentials vs ISO 27001: different animals, often confused

What each one actually is

Cyber Essentials certifies that five specific technical controls — firewalls, secure configuration, user access, malware protection, security updates — are in place across your devices and cloud services. It is UK government-backed, self-assessed against a fixed question set, reviewed by an assessor, priced by organisation size in the hundreds of pounds, and renewed annually. ISO 27001 certifies an information-security management system: a risk-driven framework of policies, processes, roles and continual improvement that you design for your organisation, audited on site by an accredited certification body, with surveillance audits between full cycles. One checks a fixed list of controls; the other checks that you run a system for managing security as a whole.

The practical differences

• Effort: Cyber Essentials is hours-to-weeks of preparation (honest timelines here). ISO 27001 is typically months of building and evidencing the system before an auditor arrives.
• Cost: Cyber Essentials is a fixed fee in the hundreds (the tiers). ISO 27001 audit and preparation costs run to the thousands and vary genuinely with size and scope — get quotes rather than trusting any blog’s figure, including ours.
• Depth vs breadth: Cyber Essentials is narrow and concrete — settings an assessor can judge from your answers. ISO 27001 is broad — it covers people, suppliers, incidents and physical security, but what’s “in” depends on your own risk assessment and scope.
• Who asks: UK public-sector buyers and SME supply chains ask for Cyber Essentials. Large enterprises, regulated industries and international customers ask for ISO 27001 (or SOC 2 in US-facing markets).

Does one satisfy the other?

No — they are separate certificates, and substitution rarely works in either direction. A buyer whose tender names Cyber Essentials wants that certificate on the public register; arguing ISO 27001 equivalence is possible only where the pack says “or equivalent” and the buyer agrees. Likewise Cyber Essentials makes no claim to be a management system. An ISO 27001 organisation will usually find the Cyber Essentials controls easy to evidence — the overlap is real — but it still completes the questionnaire like everyone else.

Which first? Almost always Cyber Essentials

For a UK business of five to fifty people the sequencing is rarely a dilemma. Cyber Essentials satisfies most UK supplier-security requests, costs far less, and the controls it enforces are the ones that stop the attacks that actually hit small firms. Do ISO 27001 when a named contract, market or investor requires it — and if that day comes, arriving with Cyber Essentials already held means the technical baseline of your ISO project is done and evidenced. Building the habit of an annual, honest self-assessment is itself the best preparation for bigger frameworks.

The trap to avoid

Buying an ISO-sized policy pack to pass Cyber Essentials. The assessment rewards short, true descriptions of what you actually do; a binder of unread enterprise policies makes answers harder to write, not easier, and an assessor can tell. The documents guide shows how little paper the scheme really expects.