Two certifications come up repeatedly when UK businesses start taking cybersecurity seriously: Cyber Essentials and ISO 27001. They're often discussed as if they're alternatives — you pick one or the other. In reality, they address different aspects of security at different levels of maturity, and for many businesses, the right answer involves both.
This guide gives you an honest picture of what each certification actually involves, who needs them, and how to make the right decision for your business.
What Cyber Essentials Is and Isn't
Cyber Essentials is the UK government's baseline cybersecurity standard. It focuses on five specific technical control areas: firewalls, secure configuration, user access control, malware protection, and patch management. Getting these five areas right defends against the majority of common cyberattacks.
The standard comes in two forms. Basic Cyber Essentials is a self-assessment against those five areas. You review the controls, implement what's required, and submit the assessment for a light-touch review. Cyber Essentials Plus adds external and internal vulnerability scanning and independent verification that your controls actually work.
Cyber Essentials is specific, narrow, and achievable for almost any business. The five control areas are important, and implementing them properly reduces your risk significantly. The limitations are equally important to understand: it covers a narrow slice of cybersecurity, it doesn't address governance, incident response, supply chain security, physical security, or business continuity, and the basic version is self-assessed rather than independently verified.
What ISO 27001 Is and Isn't
ISO 27001 is an international standard for Information Security Management Systems. It's a framework for managing information security across your entire organisation — not just technical controls, but governance, risk management, policy, procedures, training, physical security, incident response, supplier management, and business continuity.
Achieving ISO 27001 certification requires an independent assessment by an accredited certification body and demonstrates that your organisation has implemented a comprehensive, systematic approach to information security management.
ISO 27001 is demanding. It requires significant time and resource investment, ongoing commitment to maintaining the management system, and regular surveillance audits to maintain certification. For a small business approaching it for the first time, the journey typically takes 12 to 18 months and requires either internal resource or external consultancy support.
What ISO 27001 isn't: it's not a technical security standard. It doesn't specify particular controls in the way Cyber Essentials does. It requires you to identify your risks and implement appropriate controls — but what "appropriate" means depends on your risk assessment. Two ISO 27001 certified organisations might have quite different technical implementations.
Who Needs What
Cyber Essentials is the right starting point for most UK businesses. If you're not yet Cyber Essentials certified, that's where to begin. It's particularly important if you're a supplier to UK government, hold personal data, or operate in any regulated sector. Some government contracts require Cyber Essentials as a minimum; some insurers require it as a condition of cyber insurance.
Cyber Essentials Plus is what you should be aiming for if you operate in a regulated sector, work as a supplier to larger organisations, hold sensitive data, or want independent verification that your controls work rather than just a self-assessment.
ISO 27001 becomes relevant when your risk profile, your clients' requirements, or your regulatory environment demand a more comprehensive assurance. This is common for organisations in financial services, healthcare, legal services, and technology. It's also increasingly required for organisations in the supply chains of large enterprises that have their own ISO 27001 obligations.
ISO 27001 is not right for every business. For a small business with straightforward IT, relatively limited sensitive data, and no supply chain requirements for the standard, the investment in ISO 27001 is unlikely to be proportionate. Cyber Essentials Plus, properly implemented, may provide better practical security improvement for less cost.
Can You Use Them Together?
Absolutely, and many organisations do. Cyber Essentials addresses the technical baseline that should underpin any security programme. ISO 27001 builds the governance framework and broader management system on top of that baseline. Starting with Cyber Essentials Plus gives you verified technical controls and a foundation for the ISO 27001 journey.
If you're working towards ISO 27001, implementing Cyber Essentials Plus first is a sensible stepping stone. The vulnerability assessment requirements of Cyber Essentials Plus overlap with ISO 27001's risk assessment requirements. The technical controls cover significant portions of ISO 27001's Annex A control set. You're not starting from zero.
The Cost Reality
Cyber Essentials self-assessment costs a few hundred pounds in certification fees, plus the time to implement and review the controls. Cyber Essentials Plus adds the cost of independent assessment — typically £2,000 to £5,000 for a small organisation, more for larger ones.
ISO 27001 certification costs are significantly higher. Consultancy support to implement the management system, staff time to develop policies and procedures, training costs, and the certification body's audit fees can total £15,000 to £40,000 for a small organisation pursuing it for the first time, with ongoing annual surveillance audit costs thereafter.
This is a meaningful investment, and it's one that needs to be justified by your risk profile and the value it delivers.
Making the Right Decision
Start by asking what's driving the need for certification. If clients or contracts are demanding it, ask specifically which certification they require — the answer often clarifies the decision. If regulation is the driver, understand what your regulator actually expects.
If the driver is genuinely improving your security, both certifications deliver value in different ways. Cyber Essentials Plus provides verified technical security improvements. ISO 27001 provides a comprehensive management framework. For most SMEs, Cyber Essentials Plus is the better near-term investment; ISO 27001 becomes appropriate as the business grows and the risk profile increases.
We work with businesses across West Sussex at all stages of this journey. Whether you're pursuing Cyber Essentials for the first time or planning an ISO 27001 implementation, we can provide the support and context to make it worth the investment. Get in touch to discuss where you are and what makes sense for your business.