Cyber Essentials vs ISO 27001: which do you need?
They're often mentioned together, but they do very different jobs. For most UK small businesses, Cyber Essentials comes first.
At a glance
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| What it is | A UK government-backed baseline of five technical controls | An international standard for running a whole information security management system |
| What it covers | Firewalls, secure settings, updates, user access and malware protection | People, processes and technology: risk assessment, policies, suppliers, incidents and more |
| How it's checked | Self-assessment reviewed by an assessor (Plus adds an audit) | Two-stage audit by an accredited certification body |
| Time to get it | Days to a few weeks | Typically several months |
| Typical cost, small firm | £320–£500 + VAT (Plus: around £1,500–£3,000) | Often £5,000–£20,000+ in year one, including consultancy |
| Renewal | Every 12 months | Annual surveillance audits, full recertification every 3 years |
| Recognition | Mainly UK; common in public sector and supply chains | International; common with enterprise and overseas customers |
Which one do customers ask for?
For UK public-sector work and many UK supply chains, it's usually Cyber Essentials or Cyber Essentials Plus. ISO 27001 alone may not satisfy a buyer who has asked for Cyber Essentials. ISO 27001 tends to come up with larger enterprise customers, international clients, software and data-heavy businesses, and regulated sectors.
The sensible order
- Start with Cyber Essentials. It's quick, affordable, often funded at 75% off, and fixes the basics that stop most attacks.
- Add Plus if customers want independent testing. See Cyber Essentials Plus explained.
- Consider ISO 27001 when a customer requires it in writing, or when you're growing into markets that expect it. Cyber Essentials gives you a head start on part of its technical requirements.
Tip: if nobody has asked you for ISO 27001 in writing, check before committing months and thousands of pounds to it. Many small businesses only ever need Cyber Essentials.
Not sure where you stand? Try our 60-second checker, or see whether you qualify for 75% off your first certificate.
Sources: ISMS.online: Cyber Essentials vs ISO 27001; Connection Technologies: Cyber Essentials vs ISO 27001 (2026); Expertsure: ISO 27001 certification cost UK. Costs vary widely by size and scope; get quotes.
Ready to get certified?
Tell us about your business and we'll introduce you to accredited certification bodies — free, no obligation.
Get matched