%20(11)%20(1).png)
Key takeaways:
- Cyber Essentials and ISO 27001 are not the same: they cover different scopes, serve different buyer audiences, and require different levels of investment. Choosing the wrong one wastes months of effort.
- Cyber Essentials is mandatory for UK government contracts involving sensitive information. ISO 27001 is what UK and international enterprise buyers require for vendor qualification.
- Cyber Essentials takes 1-4 weeks and costs £300-£600. ISO 27001 takes 6-9 months and costs +£6,000 in Year 1.
- Cyber Essentials is not recognised outside the UK. ISO 27001 is accepted globally through the IAF mutual recognition arrangement.
- If you need both, for the UK public sector pipeline and enterprise commercial deals, pursue Cyber Essentials first, then ISO 27001 immediately after. Don’t let Cyber Essentials delay ISO 27001 if enterprise deals are the real destination.
Did you ever get an RFP and the security section asked for Cyber Essentials, ISO 27001, or both? And you were not entirely sure whether they’re the same thing, which one matters more for your situation, or whether having one covers the other?
Well, this post answers all of those.
They’re not the same. They serve different purposes, satisfy different buyers, and require very different levels of investment.
Here you will find a decision framework to help you choose the right one for your specific situation. If you’re new to ISO 27001 and want the full picture first, check this post.
Cyber Essentials vs. ISO 27001: what each one actually is
Cyber Essentials
Cyber Essentials is a UK government-backed certification scheme, introduced by the National Cyber Security Centre (NCSC) in 2014. It covers five technical controls: firewalls, secure configuration, user access control, malware protection, and security update management.
Two levels are available:
- Cyber Essentials: a self-assessed questionnaire, reviewed and verified by a certifying body. It confirms whether your controls are in place based on your answers.
- Cyber Essentials Plus: independent technical verification. An assessor actually tests your systems to confirm the controls are operating correctly, not just documented.
It is required for all UK government contracts involving the handling of sensitive information or personal data, and can be achieved in 1-4 weeks for most small companies. It typically costs £300-£600 for Cyber Essentials and £1,500-£3,000 for Cyber Essentials Plus.
ISO 27001
ISO 27001 is an international information security management standard published by the International Organization for Standardization. It covers 93 controls across four domains: organisational, people, physical, and technological, plus a full Information Security Management System in governance, risk assessment, risk treatment, policies, internal audit, management review, and continuous improvement.
For a full breakdown on timeline and costs, check this post.
Cyber Essentials vs ISO 27001: a comparison
What Cyber Essentials covers and what it doesn’t
Cyber Essentials covers:
- Protection against commodity cyber attacks, since the majority of attacks targeting small businesses exploit the exact gaps Cyber Essentials closes
- A credible minimum baseline that signals basic security hygiene to UK public sector buyers
- Quick, low-cost entry into government supply chains
What it doesn’t cover (and this is where the gap with ISO 27001 opens up significantly):
- Risk management: No requirement to assess, document, or treat information security risks. You implement the five controls, but there’s no risk-based framework behind them.
- Supplier and vendor security: Your supply chain is outside scope. Third parties with access to your systems or data are not subjected to assessment.
- Incident response: No requirement for a documented response process, escalation paths, or post-incident review.
- Data governance: No direct connection to GDPR beyond the technical controls. Data subject rights, lawful basis, and data minimisation are not addressed.
- Continuous improvement: Point-in-time assessment, renewed annually. There’s no management system requiring ongoing review and improvement between assessments.
What ISO 27001 covers that Cyber Essentials doesn’t
Five areas where the gap is commercially significant:
Risk Management
ISO 27001 requires a formal risk assessment, risk treatment plan, and Statement of Applicability. Every control you implement must trace back to an identified and documented risk.
This risk-based approach is what enterprise security teams evaluate when they review your certificate: it demonstrates that your security decisions are deliberate, not just reactive.
Supplier and Vendor Security
Annex A includes dedicated supplier relationship controls. Every significant third party handling your data needs to be assessed for security risks, contracted appropriately, and monitored over time.
For a SaaS startup with dozens of cloud integrations and sub-processors, this is one of the most valuable controls, and one of the areas enterprise procurement teams probe most carefully.
Incident Response
ISO 27001 requires a documented incident response process with defined escalation paths, severity criteria, and post-incident review.
For a startup handling personal data, this directly supports GDPR Article 33 compliance: the 72-hour breach notification requirement is significantly easier to meet when you have a functioning incident response process rather than improvising one during an active incident.
GDPR Alignment
ISO 27001’s Annex A controls directly address GDPR Article 32 technical and organisational measures.
Achieving ISO 27001 doesn’t mean you’re fully GDPR compliant, since data subject rights, lawful basis, and privacy notices require separate work, but it materially advances your GDPR posture and creates the evidence trail the accountability principle requires.
For the full overlap map, check this post.
Management System and Governance
ISO 27001 requires leadership commitment, defined roles and responsibilities, management reviews, and internal audits, none of which are optional.
These are the elements that enterprise security teams look for when evaluating you as a long-term vendor: evidence that security governance sits at the executive level, not just in IT.
Who recognises what
UK Government and Public Sector
Cyber Essentials is mandatory for all UK government suppliers handling sensitive information or personal data, and Cyber Essentials Plus is required for some contracts explicitly.
ISO 27001 is increasingly expected for larger public sector contracts and is required for some central government frameworks. If the UK public sector is your primary market, Cyber Essentials is the baseline, but ISO 27001 may be required on top for larger contracts or more sensitive data.
UK Enterprise (Private Sector)
Most UK enterprise procurement teams expect ISO 27001. Cyber Essentials is recognised but not considered equivalent.
A security questionnaire from a UK bank, insurer, or large retailer will ask for ISO 27001. Cyber Essentials alone will not satisfy enterprise procurement at that level.
EU and International Markets
Cyber Essentials is not recognised outside of the UK. A European enterprise buyer, an APAC partner, or a US multinational will not recognise it as a vendor security credential.
However, ISO 27001 travels globally and is recognised everywhere through the IAF mutual recognition arrangement, which is why it unlocks markets that Cyber Essentials cannot.
UK SMB and Mid-Market
Cyber Essentials may be recognised and considered sufficient for deals with UK SMBs, mid-market companies, and a few technology partners. Check the RFPs you usually get.
Can Cyber Essentials work as a stepping stone to ISO 27001?
Yes, but with an important warning. Cyber Essentials requires implementing five foundational technical controls (firewalls, secure configuration, access control, malware protection, and security update management), which map directly to ISO 27001 Annex A technological controls and contribute to the technical foundation an ISMS requires.
However, the overlap is limited to technical controls only. The additional work for ISO 27001 (risk assessment, ISMS documentation, vendor management, incident response, internal audit, and management review) is substantial and doesn’t reduce because you have Cyber Essentials.
If you genuinely need both:
- Go with Cyber Essentials first if you need to qualify for a specific UK government contract immediately
- Do ISO 27001 immediately after, don’t pause between them if enterprise deals or international expansion are on the 12-month horizon
- Do Cyber Essentials Plus only if specific contracts require it, but don’t let it delay ISO 27001 if that’s the real destination
Which one does your startup need: ISO 27001 or Cyber Essentials?
Get Cyber Essentials if:
- You’re bidding on UK government contracts that explicitly require it
- All your current customers are UK SMBs or mid-market companies who ask for it
- You need a security credential in 1-4 weeks to unblock a specific deal
- Your compliance budget for Year 1 is under £4,000
Get ISO 27001 if:
- Any enterprise buyer, from the UK, EU, US, or APAC, has asked for it specifically
- You’re expanding beyond the UK into European or international markets
- You handle sensitive personal data and need demonstrable GDPR-aligned security
- You’re raising a Series A or B, and investors are asking about security posture
- You want a certification that will still satisfy buyers in 5 years as you scale
Get both if:
- You’re selling to the UK public sector (requires Cyber Essentials) and UK or international enterprise (requires ISO 27001)
- The UK government is a meaningful part of your pipeline alongside commercial enterprise deals
Neither yet if:
- You’re pre-seed with no enterprise pipeline and no government contracts in sight
How SecureLeap approaches ISO 27001 for Startups
For startups pursuing ISO 27001, whether as a standalone or as the step after Cyber Essentials, SecureLeap manages the full program: gap analysis, ISMS design, control implementation, accredited certification body selection, and audit facilitation through to report issuance.
For startups that already hold Cyber Essentials, we map your existing technical controls to ISO 27001 Annex A requirements at the start of the engagement, identifying what transfers directly and what’s genuinely new. This typically reduces the technical control implementation phase and avoids rebuilding work you’ve already done.
If you want to know which certification your customers require and how to get there, click here to book a free 30-minute consultation.
Frequently Asked Questions
What is the difference between Cyber Essentials and ISO 27001?
Cyber Essentials is a UK government-backed scheme covering five basic technical controls: firewalls, secure configuration, access control, malware protection, and security update management.
ISO 27001 is an international management standard covering 93 controls across four domains, plus a full risk-based Information Security Management System. Cyber Essentials takes 1-4 weeks and costs £300-£600. ISO 27001 takes 6-9 months and costs +£6,000 in Year 1.
Cyber Essentials is recognised primarily in the UK, while ISO 27001 is recognised globally.
Is Cyber Essentials the same as ISO 27001?
No. Cyber Essentials covers five technical controls and is UK-specific. ISO 27001 covers 93 controls plus a full management system and is internationally recognised.
They address different scopes, serve different buyer audiences, and require very different levels of investment.
Does Cyber Essentials satisfy all ISO 27001 requirements?
No. Cyber Essentials covers a subset of the technical controls ISO 27001 requires, primarily in the technological domain. It doesn’t address risk management, supplier security, incident response, governance, or the management system requirements that ISO 27001 mandates. Having Cyber Essentials reduces some of the technical implementation work for ISO 27001, but doesn’t substitute it.
Which is better: Cyber Essentials or ISO 27001?
Neither is universally better, considering they serve different purposes. Cyber Essentials is better if your primary market is the UK public sector and you need a fast, low-cost credential. ISO 27001 is better if you’re selling to enterprise buyers anywhere in the world, expanding internationally, or need a certification that will still satisfy buyers as you grow. If you need both, pursue Cyber Essentials first, then ISO 27001 immediately after.
Do I need Cyber Essentials Plus or basic Cyber Essentials?
Basic Cyber Essentials is accepted for most UK SMB and enterprise procurement. Cyber Essentials Plus is required for some UK government contracts that specify it explicitly. If your target is a non-government enterprise, basic Cyber Essentials is usually sufficient. The additional cost and time of Cyber Essentials Plus are only justified if a specific contract requires it.
Will ISO 27001 replace the need for Cyber Essentials for government contracts?
Not automatically. Cyber Essentials is specifically required by UK government policy for contracts involving sensitive information, and ISO 27001 doesn’t substitute for it in that context. If you’re bidding on UK government contracts, you need Cyber Essentials regardless of your ISO 27001 status. Some larger government frameworks accept ISO 27001 as equivalent or preferred, but the specific contract requirements take precedence.
%20(12)%20(1).png)
%20(8)%20(1).avif)
%20(6)%20(1).avif)