Cyber Essentials compared
Side-by-side comparisons of Cyber Essentials with Cyber Essentials Plus, ISO 27001 and IASME Cyber Assurance, plus self-assessment against using an assessor. Scheme fees, timescales and what each one tests.
Cyber Essentials is a self-assessed certification of five technical controls, marked by a Certification Body for a scheme fee of £320 to £600. Cyber Essentials Plus adds an independent technical audit within 3 months of your Cyber Essentials certification. ISO 27001 and IASME Cyber Assurance certify wider management and governance, not just the technical baseline.
- Cyber Essentials
- Self-assessed, five technical controls, £320 to £600 plus VAT scheme fee, 12 months
- Cyber Essentials Plus
- Same controls, independently tested on a sample, within three months of Cyber Essentials
- IASME Cyber Assurance
- Governance on top of the technical baseline; Cyber Essentials is a prerequisite
- ISO 27001
- Certified management system with risk-based controls, three-year cycle with annual audits
- Named in PPN 014
- Cyber Essentials and Cyber Essentials Plus, or equivalent controls
How do the options compare at a glance?
| If the buyer or your goal is | Choose |
|---|---|
| A tender or contract that says Cyber Essentials | Cyber Essentials |
| A clause that names Cyber Essentials Plus, or proof the controls work | Cyber Essentials Plus |
| Governance evidence at small or medium scale | IASME Cyber Assurance, after Cyber Essentials |
| A certified information security management system | ISO 27001, ideally with Cyber Essentials alongside |
| A renewal on an unchanged, well-run estate | Self-assessment direct |
Which comparison do you need?
- 8 min read
Cyber Essentials vs Cyber Essentials Plus
What separates the self-assessed Cyber Essentials certificate from the audited Cyber Essentials Plus: who marks it, what is tested, how long it takes, what it costs and which one a contract is likely to ask for.
Read the comparison - 6 min read
Cyber Essentials vs IASME Cyber Assurance
How Cyber Essentials, the NCSC technical baseline, compares with IASME Cyber Assurance, IASME's own governance-level scheme covering risk, people, data and incident management at Level 1 and Level 2.
Read the comparison - 6 min read
Cyber Essentials vs ISO 27001
How the UK Cyber Essentials baseline compares with an ISO 27001 information security management system: scope, evidence, audit, timescales and which one a buyer is really asking for.
Read the comparison - 6 min read
Cyber Essentials self-assessment vs using an assessor
An honest comparison of completing the Cyber Essentials self-assessment yourself for the £320 to £600 IASME scheme fee against paying an assessor for a fixed-price, supported certification: when each route makes sense and what you are paying for.
Read the comparison
Frequently asked questions
Cyber Essentials, in almost every case. It certifies the five technical controls in weeks for a scheme fee of £320 to £600 plus VAT, and the inventory, patching and MFA evidence you build for it becomes evidence inside an ISO 27001 management system later. ISO 27001 is worth adding when customers ask for a certified management system.
No. Plus needs a valid Cyber Essentials certificate on the same scope, and IASME requires the Plus audit within three months of that certification. With Precursor the self-assessment is included in the Plus price; book the audit date before you submit the self-assessment.
No. IASME makes a valid Cyber Essentials certificate, with at least one month left before expiry, a prerequisite for buying Cyber Assurance. Cyber Assurance adds governance topics such as risk assessment, policies, data protection and incident management on top of the technical baseline.
No. Any organisation can register with an IASME Certification Body, pay the scheme fee and complete the self-assessment itself. Support is worth paying for when a contract deadline makes a failed first submission expensive, or when the estate includes BYOD, several cloud platforms or older servers.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh