If you have been asked for security credentials by a customer, an insurer or a tender process, you have probably run into both Cyber Essentials and ISO 27001. They get discussed as though they are alternatives, and the question usually arrives as "which one do we need?"
They are not really alternatives. They certify different things, they take very different amounts of effort, and one of them is frequently a sensible step towards the other.
The short answer
Cyber Essentials certifies that five specific technical controls are in place. It is a UK government-backed scheme, the scope is deliberately narrow, and it is achievable for most small and medium-sized businesses in weeks rather than months.
ISO 27001 certifies that you run a management system for information security. It is an international standard, and it is concerned with whether you have a repeatable system for identifying risks and managing them over time. The technical controls matter, but the system around them is the thing being assessed.
Put simply: Cyber Essentials asks "are these controls configured correctly?" ISO 27001 asks "how does your organisation decide what to protect, and how do you prove that keeps happening?"
What Cyber Essentials actually requires
Cyber Essentials covers five technical control areas. Every one of them has to be satisfied across the scope you declare.
Firewalls. Every device in scope has to sit behind a correctly configured firewall. Default administrative passwords must be changed, and unnecessary inbound services must be blocked.
Secure configuration. Devices and software are hardened rather than left at defaults. Unused accounts and applications are removed, and auto-run features that execute code without user consent are disabled.
User access control. Accounts follow least privilege. Administrative accounts are separate from day-to-day accounts, and administrative access is not used for routine work like reading email or browsing. Multi-factor authentication is required on cloud services.
Malware protection. In-scope devices are protected by anti-malware, application allow-listing, or code execution restrictions.
Security update management. Software is supported and patched. High-severity and critical vulnerabilities must be patched within 14 days of a fix being released, and unsupported software has to be removed from scope.
Certification is by self-assessment, verified against the scheme's question set.
Cyber Essentials Plus requirements
Cyber Essentials Plus assesses the same five controls, but independently rather than by self-assessment. An assessor carries out technical testing, including vulnerability scanning of in-scope devices and sampling of end-user devices, to verify the controls are genuinely in place rather than merely declared.
This is the distinction that matters commercially: Plus is the version that carries weight when a customer wants assurance rather than a statement. It also tends to be where organisations discover the gap between their documented position and their actual configuration.
What ISO 27001 actually requires
ISO 27001 is a broader piece of work because it certifies a system, not a configuration.
An information security management system. You define the scope of what you are protecting, establish policies, assign responsibilities and document how security is governed.
Risk assessment and treatment. You identify risks to your information, assess them consistently, and decide how each will be treated. This risk assessment is central; the controls you implement have to trace back to it.
Controls selected from Annex A. The standard provides a reference set of controls covering organisational, people, physical and technological areas. You justify which apply to you and which do not.
Management review and internal audit. Leadership reviews the system, internal audits test whether it works, and non-conformities get corrected.
Continual improvement. You monitor, measure and improve. This is why ISO 27001 is a commitment rather than a project: certification is maintained through surveillance audits, and it lapses if the system stops operating.
Certification is awarded by an external certification body after a two-stage audit.
How they compare
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| What is certified | Five technical controls | An information security management system |
| Origin | UK government-backed scheme | International standard |
| Assessment | Self-assessment, verified | External audit by a certification body |
| Independent testing | Only in Cyber Essentials Plus | Yes, at every audit |
| Typical timescale | Weeks | Many months |
| Ongoing commitment | Annual renewal | Surveillance audits and a working management system |
| Documentation burden | Light | Substantial |
| Best suited to | SMEs needing credible baseline assurance | Organisations handling significant data or facing enterprise procurement |
Which should you do first?
For most UK small and medium-sized businesses, Cyber Essentials first is the right sequence, and not only because it is easier.
The five Cyber Essentials controls are the ones that block the majority of opportunistic attacks. Patching, MFA, least privilege, hardened configuration and malware protection are what stop the commodity attacks that make up most real-world incidents. If those are not solid, an ISO 27001 management system built on top of them is documenting a weak foundation.
There are situations where ISO 27001 is the actual requirement and you should not defer it:
- A customer or tender explicitly demands ISO 27001, and Cyber Essentials will not satisfy it.
- You process significant volumes of personal or sensitive data and need to demonstrate governance, not just configuration.
- You sell into large enterprises or the public sector, where security questionnaires assume a management system exists.
- You operate internationally, where ISO 27001 is recognised and Cyber Essentials is less familiar.
Even then, the Cyber Essentials controls are not wasted work. They overlap substantially with what you will implement for ISO 27001 anyway, so achieving Cyber Essentials early gives you demonstrable assurance while the longer programme runs.
What tends to go wrong
Scoping too broadly, too early. Scope drives effort. An unnecessarily wide Cyber Essentials scope pulls in legacy devices and unsupported software that then have to be fixed or removed before you can certify.
Unsupported software found late. Software that no longer receives security updates cannot stay in scope. This regularly surfaces at assessment, when it is expensive to resolve quickly.
Treating the 14-day patch window as aspirational. It is a requirement for high-severity and critical fixes. Without a patching process that actually delivers it, you will fail on renewal even if you passed initially.
Administrative accounts used for daily work. Common, and a straightforward failure against user access control.
Documenting an ISO 27001 system nobody operates. Certification is not the end. Internal audits and management reviews have to genuinely happen, or the system decays and surveillance audits find it.
Where Synergi Tech fits
Synergi Tech is Cyber Essentials certified and applies the scheme's controls in our own estate. For clients, we run gap analysis against the five controls, remediate the findings in priority order, and support you through submission and annual renewal. We can also prepare you for a Cyber Essentials Plus assessment, where the independent technical testing means the underlying configuration has to be right rather than merely documented.
For organisations pursuing ISO 27001, we align the technical controls to the standard's expectations and provide the evidence your auditor will ask for around patching, access control, monitoring and backup. We are not a certification body, and no provider can certify you against ISO 27001 while also implementing your controls.
If you are unsure which applies to your situation, the practical starting point is a gap analysis. It tells you where you actually stand against the five Cyber Essentials controls, which is useful whichever route you take. You can read more about our cyber security services or get in touch to talk it through.
Frequently asked questions
Is ISO 27001 better than Cyber Essentials?
Neither is better; they answer different questions. ISO 27001 is broader and carries more weight in enterprise and international procurement, because it certifies a whole management system. Cyber Essentials is narrower and faster, and it verifies the specific technical controls that prevent most common attacks. Many organisations hold both.
Can Cyber Essentials count towards ISO 27001?
Not formally, as they are separate schemes with separate assessments. In practice there is significant overlap: the technical controls you implement for Cyber Essentials, such as patching, access control and malware protection, are the same controls you will need evidence for under ISO 27001. Doing Cyber Essentials first usually reduces the ISO 27001 workload.
How long does Cyber Essentials take?
For a business whose systems are in reasonable shape, certification is typically achievable in a few weeks, most of which is remediation rather than paperwork. The variable is what the gap analysis finds. Unsupported software, missing MFA or no patching process will extend it, because those have to be fixed before you can honestly answer the question set.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both assess the same five controls. Cyber Essentials is verified self-assessment, while Cyber Essentials Plus adds independent technical testing by an assessor, including vulnerability scanning and device sampling. Plus provides stronger assurance, which is why customers and tenders increasingly specify it.
Do we need ISO 27001 to win enterprise contracts?
Sometimes, but not always. Some tenders name ISO 27001 as a hard requirement, in which case nothing else substitutes. Many others accept Cyber Essentials or Cyber Essentials Plus alongside evidence of good practice. Check the actual requirement before committing to a certification programme, because ISO 27001 is a significant ongoing commitment rather than a one-off exercise.
How often do these certifications need renewing?
Cyber Essentials and Cyber Essentials Plus are annual, so you recertify each year and the controls must still hold. ISO 27001 certificates run on a longer cycle with surveillance audits in between, which means the management system has to be demonstrably operating throughout, not just at audit time.