Cyber Essentials vs ISO 27001: the difference, in plain English
Share
If a customer or a tender asks about your cyber security, two names tend to come up: Cyber Essentials and ISO/IEC 27001 (usually shortened to ISO 27001). In a January 2024 NCSC blog post, the author says he's often asked why an organisation with another standard also needs Cyber Essentials. In a lot of cases, that other standard is ISO/IEC 27001. The two are different kinds of thing. This guide sets out the difference using what the NCSC and IASME publish.
What Cyber Essentials is
The NCSC calls Cyber Essentials "the minimum standard of cyber security recommended by the Government for organisations of all sizes". It's a certification scheme built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC's Cyber Essentials overview has more on the scheme.
The NCSC says the scheme was launched in 2014. It was aimed at a specific risk scenario: an attacker on the internet using publicly available tools and techniques.
The controls are fixed. IASME explains that the UK Government has already carried out a risk assessment of commodity cyber attacks and defined an acceptable level of risk. The five controls come from that assessment. Every certified organisation meets the same baseline.
There are two levels. Cyber Essentials is a combination of self-assessment and independent audit. Cyber Essentials Plus assesses the same five controls and adds independent technical testing of your systems.
On the self-led route, you register via IASME, pay, and complete the verified self-assessment. Your answers are signed off by a board member or equivalent and then marked by an assessor. Cyber Essentials is priced by the size of your organisation, and Cyber Essentials Plus by the size and complexity of your network.
What ISO 27001 is
ISO 27001 is a standard for an Information Security Management System, or ISMS. The NCSC describes an ISMS as a set of policies, procedures and roles for identifying and managing cyber security risks.
Where Cyber Essentials gives you fixed controls, ISO 27001 asks you to work them out. IASME puts it this way: the standard requires organisations to understand and assess their own risks and decide their own risk appetite. The NCSC says the five Cyber Essentials controls sit within the list of controls an organisation chooses from. Whether they're covered depends on how the organisation has put the standard in place, after its own risk assessment.
The NCSC also says ISO 27001 is one of many standards you can use to set up an ISMS. If you're planning to use it, the NCSC suggests thinking about which parts help your objectives, as full certification may not be needed.
The main differences
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| What it's built on | Five fixed technical controls | A management system for information security risk |
| Who decides the controls | Set from the UK Government's risk assessment | The organisation, from its own risk assessment |
| Who can certify | Only companies recognised by the NCSC can issue a certificate, which are Certification Bodies licensed by IASME | Any company can offer certification. UKAS accreditation confirms the certifier has met criteria for competence and impartiality |
| Hands-on testing | Included in Cyber Essentials Plus | Physical testing isn't part of the standard assessment |
| Scope | Agreed with your Certification Body, and must include end-user devices and cloud services | For certification, can be set by the organisation being assessed |
| Cost | Cyber Essentials is priced by organisation size | Not covered in this guide |
Is one the same as the other?
No, not automatically. The NCSC says "you can't simply say that an ISO/IEC 27001 Certificate is 'equivalent' to a Cyber Essentials Certificate".
It doesn't rule out some equivalence in a particular case. To judge it, the NCSC says you'd need to check that the certifying company was accredited by UKAS. You'd also check that the five controls or the overall outcome had been assessed. For equivalence to Cyber Essentials Plus, you'd also need evidence of physical testing against the controls or outcome.
Scope is part of the reason. The NCSC points out that the scope of an ISO/IEC 27001 certification can be defined by the organisation being assessed. So the two assessments may not cover the same things.
There's a softer use, too. The NCSC says some procurement teams use a certificate as an "indicator of good practice". In that case, an ISO/IEC 27001 certificate could provide the same confidence as a Cyber Essentials certificate. The NCSC adds that an indicator of good practice isn't evidence that a particular risk you care about is being managed.
Which one does a small business need?
It depends on who's asking and why. Start with the wording in front of you, whether that's a contract, a tender or a supplier questionnaire.
- If it names Cyber Essentials, the NCSC's view is that an ISO 27001 certificate isn't automatically a substitute. It's worth asking the customer what they'll accept.
- If it asks for "a recognised certification", ask what they'll accept. In its guidance on choosing a managed service provider, the NCSC gives Cyber Essentials Plus and ISO 27001 as examples of recognised certifications.
- If you hold neither, it helps to know that Cyber Essentials has five fixed controls and a published question set. ISO 27001 starts from your own risk assessment instead.
If a customer has sent a security questionnaire rather than asking for a certificate, see our Supplier Security Questionnaire Answer Kit.
If you're not sure which first step fits your business yet, try our Small Business Cyber Starter Checklist.
What this guide doesn't cover
This guide doesn't give ISO 27001 certification costs or timescales. A UKAS-accredited certification body can tell you.
Where to start with Cyber Essentials
The NCSC's first step is to set the boundary of your scope. Then you review the five control themes and work to meet every requirement for that scope. IASME publishes the question set, currently Danzell version 16.3, and the NCSC offers a free Readiness Tool. Our guide to Cyber Essentials scope covers the first step in more detail.
Ad – our own product. For Cyber Essentials question help, our Cyber Essentials Questionnaire Prep Kit (£39) explains the self-assessment questionnaire in plain English. It has a workbook for drafting your answers before you buy the assessment. It's self-serve. You work through the files yourself, with no calls or meetings with us.
Preparation only, not certification. The kit isn't made or endorsed by IASME or the NCSC, and Secordit isn't a Certification Body. It doesn't cover ISO 27001. General information, not legal advice.
