Cyber Essentials or ISO 27001: which does your organisation need?

This guide is for security leaders, compliance teams, finance directors and boards deciding which security certification to pursue. It compares Cyber Essentials and ISO/IEC 27001 in plain terms: what each covers, what each demonstrates, the work involved and the situations where one, the other or both make sense.

The short version is that they are different tools. Cyber Essentials certifies a defined set of technical controls. ISO/IEC 27001 sets requirements for a management system that governs information security across the organisation. The right choice depends on who is asking for assurance, and why.

#What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification showing that an organisation has five technical controls in place against common internet-based threats: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC describes it as the minimum standard of cyber security recommended by the government for organisations of all sizes.

The NCSC explains that IASME is its official Cyber Essentials Delivery Partner. The basic level is a verified self-assessment: a board member or equivalent signs off the answers, and an assessor marks them. You can take a self-led route, or a supported route using a Certification Body licensed by IASME. IASME states that certification is valid for 12 months, so it needs renewing each year.

The requirements are set out in the NCSC's Requirements for IT Infrastructure v3.3, dated April 2026. They state that authentication to cloud services must always use multi-factor authentication, that updates fixing critical or high-risk vulnerabilities are applied within 14 days of release, and that software is licensed and supported. Cloud services cannot be excluded from scope.

#What does Cyber Essentials Plus add?

Cyber Essentials Plus applies the same protections with more rigorous, independent technical testing. IASME describes it as a technical audit of your IT systems, checking the controls on a representative set of devices, all internet gateways and internet-facing servers. The verified self-assessment for Cyber Essentials is a prerequisite.

#What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard that sets out requirements for an information security management system. Rather than certifying a fixed list of technical controls, it asks an organisation to apply a risk management process suited to its size and needs, and to establish, maintain and continually improve how it manages information security.

The current edition is ISO/IEC 27001:2022, with an amendment published in 2024 covering climate action changes. ISO says the standard is for companies of any size and from all sectors, and that it helps prepare people, processes and technology across the organisation to face technology-based risks and other threats.

Certification is optional. ISO describes it as one way to demonstrate to stakeholders and customers that an organisation can manage information securely, and notes that a certificate from an accredited conformity assessment body may bring an additional layer of confidence. Whether you are seeking certification or relying on someone else's, check exactly which parts of the organisation, sites and services the certificate covers, because the scope matters as much as the certificate.

#How do Cyber Essentials and ISO 27001 differ?

Cyber Essentials certifies that specific technical controls are in place, using fixed requirements that apply to every applicant. ISO/IEC 27001 sets requirements for a risk-based management system covering people, processes and technology, with continual improvement built in. Cyber Essentials is narrower and more prescriptive; ISO/IEC 27001 is broader and shows how security is governed.

• What is assessed: Cyber Essentials covers five technical controls. ISO/IEC 27001 covers a management system for information security.
• Approach: Cyber Essentials sets the same requirements for every organisation. ISO/IEC 27001 asks you to apply a risk management process adapted to your size and needs.
• Scope: Cyber Essentials should cover the whole IT infrastructure, or a well-defined and separately managed subset. For ISO/IEC 27001, always check the scope shown on the certificate.
• Assessment: Cyber Essentials is a verified self-assessment, with a technical audit at the Plus level. ISO/IEC 27001 certificates are issued by certification bodies.
• Renewal: Cyber Essentials certification is valid for 12 months. ISO/IEC 27001 expects the management system to be maintained and continually improved.
• Who does the work: Cyber Essentials is largely technical work for IT teams. ISO/IEC 27001 involves people, policies and processes across the organisation.

#Which one does your organisation need?

Choose based on who needs assurance and what they are asking for. Cyber Essentials demonstrates a baseline of technical controls and is specified for some public sector contracts. ISO/IEC 27001 demonstrates a risk-based management system across the organisation. Check tender documents, customer contracts and insurer questions for the exact certification, level and scope they require.

#Cyber Essentials is likely to fit if:

• You bid for central government or NHS contracts that involve personal information or government ICT systems.
• You need a clear, achievable technical baseline for your IT team to work towards.
• Customers, partners or insurers ask for evidence of basic technical controls.
• You want an annual, independent check that key controls are still in place.

#ISO/IEC 27001 is likely to fit if:

• Clients ask for evidence of a formal information security management system.
• You handle sensitive information on behalf of others and need to show governance, not only technical controls.
• You want a framework for managing information risk across people, processes and technology.
• Your board wants a structure for assurance and continual improvement.

The two are not strict alternatives. Cyber Essentials can be a practical first step, and a useful annual technical check, within a broader ISO/IEC 27001 programme.

#What do public sector contracts require?

Under Procurement Policy Note 014, central government departments, their executive agencies, non-departmental public bodies and NHS bodies should expect Cyber Essentials or Cyber Essentials Plus for certain higher-risk contracts. Examples include suppliers handling citizens' or government staff's personal information, or ICT systems designed to handle OFFICIAL-level data. Certification should be in place before contract award.

PPN 014 was published by the Cabinet Office in February 2025 and replaces PPN 09/14 and PPN 09/23. It says the requirement should be applied only where relevant and necessary, not to every contract, and that suppliers without certification may be able to demonstrate equivalent controls, normally verified by an independent third party. Where basic Cyber Essentials is required, it must be renewed annually for the life of the contract.

Other public sector bodies may choose to follow the same approach, so always check the specific tender documents for what is required.

#How should you plan for certification?

Plan for certification by confirming what customers, contracts and insurers require, defining your scope and running a gap assessment against the relevant requirements. For Cyber Essentials, check the current requirements document before you start. For ISO/IEC 27001, allow time to establish the management system, risk process and policies before seeking certification.

1. List the certifications, levels and scopes that customers, contracts and insurers ask for.
2. Decide the scope: the whole organisation, or a defined and separately managed part.
3. Run a gap assessment against the Cyber Essentials requirements, ISO/IEC 27001, or both.
4. Fix technical gaps first, such as MFA on cloud services, patching timescales and unsupported software.
5. For Cyber Essentials, choose a self-led route or a Certification Body licensed by IASME.
6. Set a renewal calendar so that certificates do not lapse.

#What to do next

Next, gather what your customers, contracts and insurers actually require, then compare your current controls with the Cyber Essentials requirements. That gap assessment is useful even if ISO/IEC 27001 is your eventual goal. Agree scope and ownership, set a target date and brief the board on the plan, the effort involved and the benefits.

#Frequently asked questions