ISO 27001
ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security. It is audited by an accredited certification body on a three-year cycle with annual surveillance. Cyber Essentials is narrower: five fixed technical controls, renewed every 12 months. Neither replaces the other.
- Term
- ISO 27001
- Also known as
- ISO/IEC 27001, ISMS certification
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term ISO 27001 mean in Cyber Essentials?
ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
How does ISO 27001 apply to Cyber Essentials?
In plain terms
Cyber Essentials checks that specific locks are fitted. ISO 27001 checks that you have a system for deciding which locks you need, fitting them, checking them and improving over time. One is a checklist. The other is a way of running security as a business process.
How it relates to Cyber Essentials
They are separate schemes. Cyber Essentials, owned by the NCSC and delivered by IASME, has fixed thresholds, such as critical and high-risk updates within 14 days and MFA on every cloud service. ISO 27001 has no fixed thresholds: you choose controls through your own risk assessment, and the auditor checks that the management system works. That flexibility means an ISO 27001 organisation could accept a risk, such as an unsupported server, that Cyber Essentials would not pass unless the server sat in a sub-set cut off from the internet. Neither the NCSC requirements nor the Danzell question set refer to ISO 27001. The Cyber Essentials work on patching, access control, malware protection and firewall rules does carry across.
Common mistakes
Offering an ISO 27001 certificate when a buyer asked for Cyber Essentials. Public buyers under PPN 014 name Cyber Essentials specifically. The reverse also happens: a customer asking about risk assessment, policies and incident response is describing a management system, which Cyber Essentials does not certify.
See Cyber Essentials vs ISO 27001, IASME Cyber Assurance and Cyber Essentials.
Related terms
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- IASME Cyber AssuranceIASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
- Cyber EssentialsCyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.
- NCSC (National Cyber Security Centre)The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
- Organisational dataOrganisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
Frequently asked questions
ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.