What is the difference between Cyber Essentials and ISO 27001?

Cyber Essentials is the UK government-backed scheme certifying five baseline technical controls, assessed by questionnaire (with independent testing at Plus level) and renewed annually. ISO 27001 certifies how security is managed across the whole organisation (leadership, risk, people, suppliers, incidents and continual improvement), audited in depth over a three-year cycle.

Which do we need for a UK public-sector tender?

Read the tender: UK government and many public-sector contracts mandate Cyber Essentials, often by name, and ISO 27001 cannot substitute where it is named. Larger enterprise, regulated and international buyers typically name ISO 27001, and many suppliers hold both because the two answer different questions in different rooms.

Should we do Cyber Essentials before ISO 27001?

For most small UK organisations, yes: Cyber Essentials is fast and inexpensive, fixes the controls that stop the most common attacks, and its evidence (firewalls, patching, access control, malware protection, secure configuration) feeds directly into a later ISO 27001 implementation. It is a first rung on the way up.

ISO 27001 vs Cyber Essentials: Which Do You Need?

How do ISO 27001 and Cyber Essentials compare?

	Cyber Essentials	ISO/IEC 27001:2022
What it is	UK government-backed certification of five technical control areas	International standard for an Information Security Management System
Who sets it	NCSC, delivered through IASME	ISO and IEC; UK accreditation via UKAS
Assessment	Verified self-assessment; Plus adds independent technical testing	Two-stage audit by an independent certification body, then surveillance
Duration	12 months	Three-year cycle with annual surveillance
Typical effort	Days to a few weeks	Three to nine months to first certificate
Typical trigger	UK public-sector contracts, supplier checks, insurers	Enterprise customers, regulated sectors, tenders, international buyers

Who is asking you for certification?

A UK government, NHS or public-sector tender: Cyber Essentials (or Plus) if named, because ISO 27001 cannot replace a named requirement.
A large UK, European or regulated customer: ISO 27001 is the credential their procurement recognises; Cyber Essentials may also be expected as a baseline.
Nobody is asking yet: start with Cyber Essentials, implement the five controls properly, and treat the evidence as the foundation of a later ISMS.
A customer requires ISO 27001 with a deadline: go straight there; my guide to responding to that requirement sets out the credible reply and the programme.
A US customer asking for SOC 2: a different framework with different rules; my ISO 27001 vs SOC 2 comparison works through the choice.

How do ISO 27001 and Cyber Essentials fit together?

The overlap is real: secure configuration, patching, access control and malware protection are also Annex A controls. Build them once, operate them all year, and the same evidence serves both schemes.

Around those controls, ISO 27001 adds everything Cyber Essentials leaves unexamined: risk ownership, supplier security, incident management as a process, internal audit, management review and improvement. That is why buyers with more at stake ask for it, and why it costs more; my cost guide and plain-English explainer set out the scale honestly.