---
title: "ISO 27001 vs Cyber Essentials: Which Do You Need?"
description: "Cyber Essentials or ISO 27001? What each certifies, who asks for which, cost and effort compared, and the sensible order for UK organisations to do them in."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-vs-cyber-essentials
updated: 2026-11-10
---

# ISO 27001 vs Cyber Essentials: which do you need?

Cyber Essentials certifies five baseline technical controls and is fast and inexpensive; ISO 27001 certifies your whole management system and is what enterprise and international buyers usually ask for. Most growing UK organisations need the first now and the second when customers demand it, in that order.

## How do ISO 27001 and Cyber Essentials compare?

|                 | Cyber Essentials                                                   | ISO/IEC 27001:2022                                                      |
| --------------- | ------------------------------------------------------------------ | ----------------------------------------------------------------------- |
| What it is      | UK government-backed certification of five technical control areas | International standard for an Information Security Management System    |
| Who sets it     | NCSC, delivered through IASME                                      | ISO and IEC; UK accreditation via UKAS                                  |
| Assessment      | Verified self-assessment; Plus adds independent technical testing  | Two-stage audit by an independent certification body, then surveillance |
| Duration        | 12 months                                                          | Three-year cycle with annual surveillance                               |
| Typical effort  | Days to a few weeks                                                | Three to nine months to first certificate                               |
| Typical trigger | UK public-sector contracts, supplier checks, insurers              | Enterprise customers, regulated sectors, tenders, international buyers  |

## Who is asking you for certification?

- **A UK government, NHS or public-sector tender:** Cyber Essentials (or Plus) if named, because ISO 27001 cannot replace a named requirement.
- **A large UK, European or regulated customer:** ISO 27001 is the credential their procurement recognises; Cyber Essentials may also be expected as a baseline.
- **Nobody is asking yet:** start with Cyber Essentials, implement the five controls properly, and treat the evidence as the foundation of a later ISMS.
- **A customer requires ISO 27001 with a deadline:** go straight there; my guide to [responding to that requirement](/resources/customer-requires-iso-27001) sets out the credible reply and the programme.
- **A US customer asking for SOC 2:** a different framework with different rules; my [ISO 27001 vs SOC 2 comparison](/resources/iso-27001-vs-soc-2) works through the choice.

## How do ISO 27001 and Cyber Essentials fit together?

The overlap is real: secure configuration, patching, access control and malware protection are also Annex A controls. Build them once, operate them all year, and the same evidence serves both schemes.

Around those controls, ISO 27001 adds everything Cyber Essentials leaves unexamined: risk ownership, supplier security, incident management as a process, internal audit, management review and improvement. That is why buyers with more at stake ask for it, and why it costs more; my [cost guide](/resources/iso-27001-cost-uk) and [plain-English explainer](/resources/what-is-iso-27001) set out the scale honestly.

## Cyber Essentials or ISO 27001?

### What is the difference between Cyber Essentials and ISO 27001?

Cyber Essentials is the UK government-backed scheme certifying five baseline technical controls, assessed by questionnaire (with independent testing at Plus level) and renewed annually. ISO 27001 certifies how security is managed across the whole organisation (leadership, risk, people, suppliers, incidents and continual improvement), audited in depth over a three-year cycle.

### Which do we need for a UK public-sector tender?

Read the tender: UK government and many public-sector contracts mandate Cyber Essentials, often by name, and ISO 27001 cannot substitute where it is named. Larger enterprise, regulated and international buyers typically name ISO 27001, and many suppliers hold both because the two answer different questions in different rooms.

### Should we do Cyber Essentials before ISO 27001?

For most small UK organisations, yes: Cyber Essentials is fast and inexpensive, fixes the controls that stop the most common attacks, and its evidence (firewalls, patching, access control, malware protection, secure configuration) feeds directly into a later ISO 27001 implementation. It is a first rung on the way up.

## Contact

Not sure which your customers will accept? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.