- Cyber Essentials checks five technical controls. ISO 27001 certifies a management system for information security, with controls chosen through your own risk assessment.
- If a UK government or defence contract asks for Cyber Essentials, get that first. If a customer asks for ISO 27001 certification, Cyber Essentials will not stand in for it.
- Since 27 April 2026, new Cyber Essentials assessments use requirements v3.3: missing MFA on a cloud service that offers it, or high and critical updates left beyond 14 days, now fails the assessment.
- ISO 27001 certification does not include Cyber Essentials, and a buyer will not automatically accept it as equivalent.
- Neither certificate proves UK GDPR compliance, and both cover only the scope written on them.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme run by the National Cyber Security Centre (NCSC) with IASME as its delivery partner. IASME licenses the certification bodies that assess organisations and issue certificates.
There are two levels. For Cyber Essentials, you answer an online self-assessment questionnaire, a board-level or equivalent signatory confirms the answers, and a certification body marks them. There is no technical testing. Cyber Essentials Plus uses the same requirements but an assessor checks them: an external vulnerability scan, plus internal testing of a sample of your devices and cloud accounts. You need a basic Cyber Essentials certificate first, and the Plus audit has to be completed within three months of it.
Both levels assess the same five technical control areas:
- Firewalls: boundary firewalls and internet gateways that block unauthorised inbound connections
- Secure configuration: default passwords changed, unused software and accounts removed, auto-run disabled
- Security update management: supported software only, with high and critical updates applied within 14 days of release
- User access control: accounts limited to what each person needs, separate administrator accounts, and MFA on cloud services
- Malware protection: anti-malware software or application allow-listing on in-scope devices
What changed in 2026
Assessment accounts created on or after 27 April 2026 use version 3.3 of the requirements, which IASME calls the Danzell question set. Three points catch organisations out. Multi-factor authentication must be switched on for every cloud service that offers it, including where MFA is a paid add-on, and an answer showing it missing is an automatic fail. Leaving high or critical updates unapplied beyond 14 days is also an automatic fail. And cloud services you use for business cannot be excluded from scope: if your staff use Microsoft 365, Google Workspace or a SaaS tool for company data, that service is in.
Fees and time
IASME publishes a fixed fee for basic Cyber Essentials based on organisation size, all excluding VAT: £320 for micro organisations (0 to 9 employees), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250 or more). Check IASME's site before you budget, because the fees change from time to time. Cyber Essentials Plus has no fixed price. Each certification body quotes it based on how many sites, devices and cloud services need testing.
Time depends on how many gaps you have. If your controls are already in place, the questionnaire can take a few days and marking a short while after. If you first need to roll out MFA, replace unsupported laptops or tighten admin rights, plan for several weeks. Treat any timeline as a planning estimate, not a promise.
Who asks for it
The main driver is UK public sector procurement. Procurement Policy Note 014, published in February 2025, tells central government buyers to require Cyber Essentials, or Cyber Essentials Plus where the risk justifies it, in contracts with certain risk characteristics, such as handling personal data or supplying ICT services. Buyers are told to take a risk-based view instead of applying it to every contract, and a supplier can show equivalent controls instead. The NCSC's guidance is that another certificate, ISO 27001 included, is not equivalent by default: the supplier has to show how its scope and controls cover the Cyber Essentials requirements.
Defence has its own route. Through the Defence Cyber Certification scheme, the Ministry of Defence has asked all defence suppliers to reach DCC Level 0 by 31 December 2026, which means a current Cyber Essentials certificate covering business-critical systems and a completed supplier assurance questionnaire. Cyber Essentials Plus applies at DCC Levels 2 and 3, and the level for each contract follows its risk assessment.
Outside government, many larger customers and insurers ask for Cyber Essentials in supplier questionnaires. A certificate is valid for 12 months, so you recertify every year.
What is ISO 27001?
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). It does not hand you a fixed checklist. You define the scope, assess your information security risks, choose controls to treat them, and then run the system: internal audits, management reviews, corrective action and continual improvement. Two organisations in the same sector can end up with different control sets and both be certified.
Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. You compare the controls you need against Annex A and record the result in a Statement of Applicability (SoA): which controls you include, why, and why you exclude any. No Annex A control is mandatory by default. Your risk assessment decides. Two dates matter: certificates against the 2013 edition had to move to the 2022 edition by 31 October 2025, and Amendment 1:2024 added a requirement to consider whether climate change is a relevant issue for your ISMS.
How certification works
A certification body carries out a two-stage audit. Stage 1 reviews your ISMS design and readiness: scope, risk assessment method, SoA and key documents. Stage 2 checks that the ISMS is implemented and working. Depending on the certification body and your set-up, either stage can be on site, remote or a mix. After certification come surveillance audits, usually once a year, and a recertification audit every three years.
Choose a certification body accredited for ISO 27001, by UKAS in the UK or by another accreditation body that belongs to the international mutual recognition arrangements. Since January 2026 those arrangements sit under Global Accreditation Cooperation Incorporated, formed from the merger of IAF and ILAC. Certificates from unaccredited bodies exist, and many buyers will not accept them.
Costs and timelines
There is no standard price for ISO 27001. The certification body quotes its audits in auditor days, which it calculates from your headcount, sites and scope under the accreditation rules. The larger cost is usually your own effort to build the ISMS and close the gaps it finds. The cost table further down lists the components to budget for.
As a planning estimate, an organisation with some security practices already in place often needs six to eighteen months from project start to certificate. A narrow scope and mature controls shorten that. A broad scope, little documentation or a lot of remediation lengthen it.
Who asks for it
ISO 27001 comes up in enterprise procurement questionnaires, financial services due diligence, healthcare supplier assessments and contracts with larger technology firms. Plenty of cloud and SaaS customers ask for it, though some accept a SOC 2 report or a completed security questionnaire instead, so ask before you assume. Organisations handling payment card data also need PCI DSS compliance, which sits alongside these certifications and is not replaced by them. Because ISO 27001 is international, it also carries weight with customers in Europe and beyond.
Side-by-side comparison
The table sets out the differences that matter most when you decide which to pursue and in what order.
What each one costs you
Certificate fees are the smallest line for most organisations. Budget for these components:
Which one should you get first?
Start from what your customers and contracts ask for. Headcount alone does not decide it: a ten-person firm supplying a bank may need ISO 27001, and a two-hundred-person firm selling only to consumers may need neither.
If you are moving into enterprise sales, Cyber Essentials gives procurement teams a credible baseline while you build towards ISO 27001. It will get you through many basic supplier assessments, but not a tender that names ISO 27001 certification.
If your organisation has no documented policies or risk owners yet, ISO 27001 will take longer, because the standard needs a working management system with defined responsibilities. That is a reason to plan for more time, not a size threshold.
Cyber Essentials work feeds into ISO 27001. The five control areas relate to several Annex A controls, mostly in the technological theme (A.8), such as malware protection, management of technical vulnerabilities and secure configuration. ISO 27001 then adds risk management, governance, supplier controls, business continuity and the documentation around them.
Do they overlap?
Partly. The Cyber Essentials control areas correspond to controls that most ISO 27001 implementations include. That does not mean an ISO 27001-certified organisation meets Cyber Essentials. ISO 27001 lets you choose and justify your controls, so your patching window, MFA coverage or device scope may not match the fixed Cyber Essentials rules. Your ISMS scope may also leave out systems that Cyber Essentials would put in scope.
In the other direction the gap is larger. Cyber Essentials covers technical controls only and does not require:
- Documented information security policies and management commitment
- A risk assessment and risk treatment process with recorded decisions
- Supplier and third-party security controls
- Physical security for offices and facilities
- Business continuity and incident management arrangements
- An internal audit programme and management reviews
- A risk register with named owners and treatment status
ISO 27001 covers all of these, within the scope you define and the controls your risk assessment selects.
IASME also runs IASME Cyber Assurance, a standard that sits between Cyber Essentials and ISO 27001. It adds governance, risk management, people security and data handling to the technical controls. Level 1 is a verified self-assessment and Level 2 adds an audit. You need Cyber Essentials before you can certify. It covers some data protection practices, but holding it does not show that you comply with UK GDPR.
Check the scope on any certificate
A certificate covers only what is written on it. A Cyber Essentials certificate may cover the whole organisation or a defined part of it, and an ISO 27001 certificate covers the scope in its scope statement. When you rely on a supplier's certificate, check that the scope includes the service and systems you are buying, that it is current, and for ISO 27001 that an accredited body issued it. IASME lets you search for Cyber Essentials certificates online.
Next steps
For Cyber Essentials, read the current requirements on the NCSC and IASME websites, then pick a certification body from IASME's directory. Many small businesses complete the questionnaire without a consultant, as long as they have a clear picture of their devices, accounts and cloud services.
For ISO 27001, begin with a gap assessment before you commit budget. It shows what you already have that counts towards the standard, what needs formalising and what needs building. With that, you can set a realistic timeline and avoid treating every Annex A control with the same urgency.
If you have not yet mapped where Cyber Essentials and ISO 27001 fit in your wider programme, a cybersecurity roadmap sequences certifications alongside technical controls for your sector and risk profile.
Cyvra works with UK businesses at both stages. We help organisations get Cyber Essentials in place when a contract requires it, and we lead ISO 27001 implementations from scope definition to audit support. If you are unsure which to prioritise, get in touch for a conversation about where you are starting from.