In short
- ✓Cyber Essentials is a UK government-backed certificate covering five technical controls. It costs £320–£600 + VAT and can be done in weeks.
- ✓ISO 27001 is an international standard for a full information security management system. For a business of 10–50 staff it typically costs £12,000–£25,000 in the first year and takes 6–12 months.
- ✓Most small businesses should get Cyber Essentials first. Consider ISO 27001 when larger clients, tenders or international customers require it.
The difference in one sentence
Cyber Essentials proves you have the basic technical controls in place that stop most common attacks, while ISO 27001 proves you run a complete, audited system for managing information security risk across the whole business.
Side-by-side comparison
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| What it covers | 5 technical controls: firewalls, secure configuration, user access, malware protection and security updates | A full management system: risk assessment, policies, roles, suppliers, incidents and 93 Annex A controls |
| Who it suits | Any UK business, especially 1–50 staff | Businesses handling sensitive client data, larger contracts or international customers |
| How you're assessed | Online questionnaire checked by an assessor; Plus adds a hands-on technical audit | Two-stage audit by a certification body (look for UKAS accreditation) |
| Typical cost | £320–£600 + VAT certificate fee; about £1,000–£4,000 total with help | About £12,000–£25,000 in year one for 10–50 staff, plus yearly surveillance audits |
| Time to certify | Days to a few weeks | Typically 6–12 months |
| How long it lasts | 12 months, then recertify | 3-year cycle with annual surveillance audits |
| Recognition | UK government contracts, UK insurers and supply chains | Recognised internationally |
Costs: IASME certificate fees; ISO 27001 ranges from Pyralink's 2026 UK pricing for small organisations.
Which should you get first?
For most small businesses, Cyber Essentials comes first. It's quick, affordable, required for many central government contracts, and fixes the gaps behind most real attacks. UK organisations with turnover under £20m that certify their whole organisation through IASME can also opt in to £25,000 of cyber liability insurance.
ISO 27001 makes sense when a client, tender or regulator specifically asks for it, or when you handle large volumes of sensitive data for other businesses. Having Cyber Essentials in place first makes ISO 27001 easier, because many of the technical controls are already done.
Signs you need ISO 27001
- A client contract or tender explicitly requires ISO 27001 certification.
- You process sensitive data on behalf of larger organisations, for example as a software, data or outsourcing provider.
- You sell to international customers who don't recognise Cyber Essentials.
- You need a formal, audited approach to risk, policies and suppliers, not just technical controls.
Questions
Is Cyber Essentials the same as ISO 27001?
No. Cyber Essentials checks five technical controls and lasts 12 months. ISO 27001 certifies a complete information security management system, with a three-year certificate cycle and annual audits.
Can a small business get ISO 27001?
Yes, but it's a bigger project: typically 6–12 months and £12,000–£25,000 in the first year for 10–50 staff. Most small businesses start with Cyber Essentials.
Does ISO 27001 replace Cyber Essentials?
Not for UK government contracts that specifically ask for Cyber Essentials. Many businesses hold both.