Cyber Essentials vs ISO 27001
How the UK Cyber Essentials baseline compares with an ISO 27001 information security management system: scope, evidence, audit, timescales and which one a buyer is really asking for.
Cyber Essentials certifies five technical controls against a fixed UK standard, marked from a self-assessment for a scheme fee of £320 to £600 and valid for 12 months. ISO 27001 certifies a whole information security management system, audited by a UKAS-accredited body over months, with a three-year cycle. Most organisations start with Cyber Essentials.
What is the difference in one table?
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| What it certifies | Five technical controls on in-scope devices, software and cloud services | An information security management system (ISMS) and the controls you select through risk assessment |
| Standard owner | NCSC, delivered by IASME | International Organization for Standardization, certified by UKAS-accredited bodies in the UK |
| Assessment method | Self-assessment questionnaire marked by a Certification Body; Plus adds a technical audit | Documentation review (stage 1) and on-site or remote audit (stage 2), then surveillance audits |
| Fixed thresholds | Yes: 14-day patching, MFA on all cloud services, 12-character passwords or equivalent, device locking | No: controls and targets are set by your own risk treatment |
| Time to certificate | 1 to 2 weeks (Cyber Essentials), 2 to 5 weeks (Plus) | Typically months, depending on the maturity of your existing processes |
| Validity | 12 months | 3-year cycle with annual surveillance |
| Scheme fee | £320 to £600 ex VAT by headcount | Set by the certification body; no fixed scheme fee |
| Who asks for it | UK public sector under PPN 014, MOD suppliers, insurers, SME supply chains | Enterprise customers, regulated sectors, international tenders |
Which should you choose?
| If this describes you | Choose | Verdict |
|---|---|---|
| A UK public sector or MOD buyer asks for Cyber Essentials | Cyber Essentials | It is the named requirement and certifies in weeks rather than months. |
| Enterprise or international customers ask for an ISMS | ISO 27001 | Only ISO 27001 certifies a management system, and Cyber Essentials does not substitute for it. |
| You will need both within a year or two | Cyber Essentials first, then ISO 27001 | Patching, access control, malware protection and firewall rules appear in both, so the Cyber Essentials work carries across. |
| A small organisation with no specific requirement yet | Cyber Essentials | A £320 to £600 scheme fee and a 12-month certificate is a proportionate first step. |
What does Cyber Essentials certify?
Cyber Essentials is narrow by design. The Requirements for IT Infrastructure v3.3 name five controls, the devices and services they apply to, and the thresholds you must meet. There is no risk assessment and no room to argue that a control does not apply to you: if a device is in scope, it needs a firewall, secure configuration, supported software patched within 14 days for critical or high-risk fixes, controlled user accounts with MFA on cloud services, and malware protection.
The assessment is the 2026 Danzell question set. Four questions fail automatically on a No answer, including A6.4AUTO-FAIL on the 14-day rule and A7.16AUTO-FAIL on MFA for cloud administrators, and A7.15AUTO-FAIL fails automatically if a listed service does offer MFA. The NCSC Annual Review 2025 reports that organisations with Cyber Essentials are 92% less likely to make a claim on their insurance, based on data from the Cyber Essentials insurer (NCSC Annual Review 2025), which is the point: it is a floor that stops opportunistic attacks, not a ceiling.
What does ISO 27001 certify?
ISO 27001 certifies that you operate an information security management system. The auditor checks that you have defined a scope, identified risks, chosen controls from Annex A (or elsewhere) to treat those risks, documented policies, trained people, monitored performance and improved over time. The certificate says your system works, not that any particular technical control is in place.
That flexibility is why ISO 27001 suits organisations with complex, changing risk, and why it does not guarantee the Cyber Essentials baseline. A certified ISMS could accept the risk of an unsupported server in a sub-net; Cyber Essentials would not pass it, because a Yes to A6.3 means the licensed-and-supported requirement is not met, unless the sub-set is segregated from the internet.
Organisations that hold ISO 27001 and then apply for Cyber Essentials commonly stumble on three points: MFA not enforced on every cloud service user, legacy software that the risk register accepted, and administrator accounts used for email and browsing. None of these are ISO non-conformities. All three are Cyber Essentials failures.
Which one do you need?
If a UK public body, prime contractor or insurer is asking, they almost always mean Cyber Essentials. PPN 014 under the Procurement Act 2023 applies to central government, agencies, non-departmental public bodies and NHS bodies for procurements from 24 February 2025, and it names Cyber Essentials, not ISO 27001.
If an enterprise customer's security questionnaire asks about your ISMS, your risk assessment, your supplier management and your incident response, they are describing ISO 27001. Cyber Essentials will answer a few of the questions, mainly on patching, access control and malware protection, but not the governance ones.
If you have neither, do Cyber Essentials first. It is fast, it fixes the things attackers actually exploit, and the artefacts you produce for it (asset inventory, software version list, admin account register, firewall rule log) become controlled documents in an ISMS later.
| At a glance | Detail |
|---|---|
| Cyber Essentials | 5 fixed technical controls, 12-month certificate, £320 to £600 scheme fee |
| ISO 27001 | Management system, risk-based controls, 3-year cycle with annual audits |
| Overlap | Patching, access control, malware protection and firewall rules appear in both |
| Order | Cyber Essentials first, then Plus, then ISO 27001 if customers require an ISMS |
Can you hold both?
Yes, and many organisations do. Cyber Essentials Plus provides independent technical evidence that an ISO 27001 auditor can reference, and the annual Cyber Essentials renewal gives a yearly check that the technical baseline has not drifted between surveillance audits. The two certificates answer different questions from different buyers.
An ISO 27001-certified organisation submits a Cyber Essentials self-assessment and answers "yes" to MFA on all cloud services because the policy says MFA is required. The assessor asks for evidence and finds that a legacy CRM and a payroll portal have MFA available but not enforced. Both A7.16AUTO-FAIL and A7.17AUTO-FAIL fail. Policy is not the same as enforcement.
How do the timescales and costs compare?
Cyber Essentials with assessor support takes one to two weeks and starts from £1,500 + VAT with the IASME fee included. Cyber Essentials Plus takes two to five weeks depending on device count and starts from £3,000 + VAT, with Cyber Essentials included. Both are fixed after a scoping call.
ISO 27001 has no scheme fee. You pay for the work of building the ISMS, either internally or with a consultant, and then for the certification body's stage 1, stage 2 and surveillance audits, priced on the size and complexity of your scope. Expect months rather than weeks, and budget for ongoing audit costs across the three-year cycle. We do not publish ISO 27001 figures here because they depend entirely on your scope.
Frequently asked questions
Not automatically. ISO 27001 lets you choose controls through a risk assessment, so an ISO-certified organisation can still have unsupported software or cloud services without MFA. Cyber Essentials fixes the five controls and the thresholds, such as patching critical updates within 14 days, regardless of your risk appetite.
Not on its own. PPN 014 names Cyber Essentials, and buyers must also accept equivalent controls, but an ISO 27001 certificate does not prove equivalence because it does not fix the five controls or their thresholds. You would have to evidence every Cyber Essentials control separately, which is usually more work than the self-assessment itself.
Cyber Essentials. The IASME scheme fee is £320 to £600 ex VAT, and assessor-supported certification starts from £1,500 + VAT. ISO 27001 involves building and operating a management system and paying an accredited certification body for stage 1, stage 2 and annual surveillance audits, so the cost is a different order of magnitude.
Yes, in almost every case. It takes one to two weeks, costs a fraction of ISO 27001 and covers the technical controls that stop opportunistic attacks. The device inventory, patching process and MFA rollout you build for it become evidence inside an ISO 27001 system later.
A Cyber Essentials certificate is valid for 12 months and is renewed by a fresh self-assessment. ISO 27001 certification runs on a three-year cycle with annual surveillance audits and a recertification audit at the end of the cycle.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
Other comparisons
- Cyber Essentials vs Cyber Essentials PlusWhat separates the self-assessed Cyber Essentials certificate from the audited Cyber Essentials Plus: who marks it, what is tested, how long it takes, what it costs and which one a contract is likely to ask for.
- Cyber Essentials vs IASME Cyber AssuranceHow Cyber Essentials, the NCSC technical baseline, compares with IASME Cyber Assurance, IASME's own governance-level scheme covering risk, people, data and incident management at Level 1 and Level 2.
- Cyber Essentials self-assessment vs using an assessorAn honest comparison of completing the Cyber Essentials self-assessment yourself for the £320 to £600 IASME scheme fee against paying an assessor for a fixed-price, supported certification: when each route makes sense and what you are paying for.