It is one of the most common questions I'm asked: "Should we get Cyber Essentials or ISO 27001?" The honest answer is that they do different jobs, and for many organisations the right answer is "Cyber Essentials first, ISO 27001 next".

What Cyber Essentials covers

Cyber Essentials is a UK Government-backed scheme focused on five technical controls that protect against the most common internet-based attacks:

  • Firewalls
  • Secure configuration
  • Security update management
  • User access control
  • Malware protection

Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit. Both are relatively quick to achieve and are often required for public sector contracts.

What ISO 27001 covers

ISO/IEC 27001 is broader. It is a management system standard, which means it is about how you govern information security: understanding your context, assessing risk, choosing controls, measuring performance and continually improving. Annex A of the 2022 edition lists 93 controls across organisational, people, physical and technological themes.

Certification involves an external audit by a certification body and ongoing surveillance audits. It carries significant weight internationally and in enterprise procurement.

How to choose

Start with Cyber Essentials if…

  • You need a recognised certificate quickly, for example for a public sector bid.
  • You don't yet have consistent technical security basics in place.
  • You are a smaller organisation with limited internal resource.

Go straight to ISO 27001 if…

  • Enterprise or international customers are asking for it by name.
  • You handle large volumes of sensitive or regulated data.
  • You need to demonstrate governance and risk management, not just technical controls.

Why many organisations do both

The two work well together. Cyber Essentials establishes technical hygiene, which supports many of the technological controls in ISO 27001. Achieving it first gives you a quick win and a solid foundation, and much of the evidence can be reused later.

The best first step

If you're unsure, a short gap analysis will show where you stand against both and which route delivers the most value for your situation.