Customers, insurers and tenders increasingly ask for evidence of good security, and two names come up again and again: Cyber Essentials and ISO 27001. They’re often treated as alternatives, but they do very different jobs.
Cyber Essentials: a technical baseline
Cyber Essentials is a UK government-backed scheme focused on five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. It’s designed to stop the most common, opportunistic attacks.
- Scope: technical controls on your IT
- Effort: relatively quick for a well-run environment
- Recognition: widely recognised in the UK, and required for many government contracts
- Renewal: every 12 months
ISO 27001: a management system
ISO/IEC 27001 is the international standard for an information security management system (ISMS). Rather than a checklist of technical settings, it requires you to understand your information risks, choose controls to manage them, and continually improve. The 2022 version includes 93 Annex A controls covering organisational, people, physical and technological areas.
- Scope: how your whole organisation manages information risk
- Effort: a significant programme, involving leadership, policies, processes and evidence
- Recognition: internationally recognised and often required by larger or overseas customers
- Certification: by an accredited certification body, with surveillance audits over a three-year cycle
Side by side
- Cyber Essentials answers “Are the basic technical controls in place?”
- ISO 27001 answers “Does this organisation manage information security systematically?”
Which should you choose?
If you need a quick, credible baseline, or a UK public sector contract requires it, start with Cyber Essentials. If customers ask for ISO 27001, you handle sensitive data at scale, or you want security embedded in how the business runs, plan for ISO 27001.
Many organisations do both. Cyber Essentials gets the technical fundamentals right quickly, and those controls then support the wider ISO 27001 programme.
Not sure where you stand?
AskQ’s free ISO 27001 Readiness Check gives you an indicative readiness score in two minutes, and our Certification Support team can help with either standard.
What ISO 27001 auditors look for
ISO 27001 auditors want to see that your management system is real and working, not just documented. Expect them to look for:
- A clearly defined scope for your ISMS
- A risk assessment and risk treatment plan
- A Statement of Applicability explaining which controls apply, and why
- Policies that staff know about and follow
- Records showing controls operating over time
- Internal audits and management reviews, with actions followed through
How much effort is involved?
For ISO 27001, effort depends on the size and complexity of your scope, how much is already documented, and whether someone internally can own the programme. A clear scope, strong leadership support and a realistic timeline make the biggest difference. Cyber Essentials is usually a much smaller undertaking, focused on getting the five technical controls right.
Talk to us about certification
Whether you need Cyber Essentials, ISO 27001 or both, we’ll help you choose the right route and get there.
