Cyber Essentials Plus vs ISO 27001: which does your firm need?
Key takeaways
- Cyber Essentials Plus checks five technical controls with independent testing; ISO 27001 sets requirements for a whole information security management system
- ISO 27001 specifies a management system rather than a fixed list of controls, with requirements in clauses 4 to 10 and a reference set of controls in an annex
- Cyber Essentials is priced from £320 to £600 plus VAT by organisation size, while Plus is quoted individually
- An ISO 27001 certificate applies only within the scope stated on it, so check what a supplier's certificate actually covers
- The government made Cyber Essentials mandatory for central government contracts advertised after October 2014 that involve handling personal information and providing certain ICT products and services
Part of our UK cyber compliance guide. See all guides.
Cyber Essentials Plus and ISO 27001 are two security certifications that UK buyers may ask suppliers for. They are sometimes treated as rival options, but they answer different questions. Cyber Essentials Plus asks: are five basic technical controls in place, and do they work? ISO 27001 asks: does this organisation run a management system that finds its information security risks and deals with them? This guide explains the difference and when you need each.
What Cyber Essentials Plus covers
Cyber Essentials is the government-backed scheme run with the NCSC and delivered by IASME. The government's procurement note describes it as a set of controls which, when properly implemented, will provide organisations with basic protection from the most prevalent forms of threat coming from the internet. There are 2 levels: Cyber Essentials and Cyber Essentials Plus.
Both levels assess the same five technical controls. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds a technical audit to verify that the controls are actually in place, and IASME says the self-assessment is a prerequisite for Plus. Our guide to Cyber Essentials vs Cyber Essentials Plus covers the two levels in detail.
IASME prices Cyber Essentials by organisation size, from £320 plus VAT for the smallest organisations to £600 plus VAT for those with 250 or more employees. It says Plus has to be quoted individually and depends on the size and complexity of your network. Certificates expire after 12 months.
What ISO 27001 covers
ISO/IEC 27001 is the international standard for information security management systems, often shortened to ISMS. It specifies the requirements for establishing, implementing, maintaining and continually improving an ISMS, and includes requirements for assessing and treating information security risks. The requirements are generic and meant to apply to any organisation, whatever its type, size or nature.
The key difference is in that word system. ISO 27001 specifies requirements for a management system rather than a list of security controls to be adopted. To be certified, an organisation must meet the requirements of clauses 4 to 10: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. An annex lists a reference set of information security controls, with ISO/IEC 27002 giving guidance on them.
The standard is also about information, not only IT. It covers information in all forms, including paper-based, cloud-based and digital data, and people and processes as well as technology.
Certification is done by an independent certification body after a successful audit. Certification is optional unless it is required by law, by a contract or by another scheme, and it applies only within the scope stated on the certificate. Certification bodies are commonly accredited by a national accreditation body, although accreditation is not compulsory. To implement the standard you need a copy of it, which BSI sells as BS EN ISO/IEC 27001.
The differences side by side
| Cyber Essentials Plus | ISO 27001 | |
|---|---|---|
| What it checks | Five technical controls, independently tested | A whole information security management system |
| Approach | A fixed baseline that applies to everyone | Risk-based: you assess your risks and choose controls to treat them |
| Covers | The IT systems in scope | Information in all forms, plus people and processes |
| Who certifies | A Certification Body licensed by IASME | An independent certification body, commonly accredited |
| Scope | Set when you certify | Only what is stated on the certificate |
| Cost | Quoted individually; Cyber Essentials is £320 to £600 plus VAT | Quoted by certification bodies, plus a copy of the standard |
Which do you need?
If a contract asks for Cyber Essentials. The government's procurement note makes the scheme mandatory for central government contracts advertised after October 2014 which involve handling personal information and providing certain ICT products and services. Do not assume ISO 27001 will be accepted instead. Check the contract.
If you are a small organisation starting out. In our view, Cyber Essentials is the sensible first step. It is cheaper, and covers the basic controls the government says give basic protection from the most prevalent forms of internet threat. Plus is worth adding when customers ask for evidence that the controls are tested, not just declared.
If customers want assurance about how you manage security overall. That is what ISO 27001 is for. It shows that leadership, risk assessment, operations and review are in place, not only technical settings. In our view, it suits organisations that handle sensitive data for others, or that sell into buyers who ask for an ISMS.
If you need both. In our view, Cyber Essentials Plus fits inside an ISO 27001 programme as tested evidence for some of the technical controls, while ISO 27001 covers the governance around them.
What to check on a supplier's certificate
- Scope. An ISO 27001 certificate applies only within the scope stated on it. A certificate for one office or one service says nothing about the rest of the business.
- Who issued it. Check the certification body, and whether it is accredited.
- Date. Cyber Essentials certificates expire after 12 months, so check the certificate is current.
- Level. Cyber Essentials and Cyber Essentials Plus are different levels. Check which one you are being shown.
For how these fit with the UK's wider rules, see our guide to NIS2 and the UK Cyber Security and Resilience Bill.
FAQ
What is the difference between Cyber Essentials Plus and ISO 27001?
Cyber Essentials Plus checks that five technical controls are in place, with independent testing. ISO 27001 sets requirements for an information security management system that assesses and treats risks and is continually improved, covering leadership, planning, operation and review as well as controls.
Is ISO 27001 better than Cyber Essentials Plus?
They do different jobs. In our view, Cyber Essentials Plus is a tested baseline of technical controls, while ISO 27001 shows a whole, risk-based management system is in place.
Does ISO 27001 replace Cyber Essentials for government contracts?
Do not assume it does. The government's procurement policy note makes Cyber Essentials mandatory for central government contracts advertised after October 2014 that involve handling personal information and providing certain ICT products and services. Check each contract's requirements.
How much does Cyber Essentials Plus cost compared with ISO 27001?
IASME prices Cyber Essentials from £320 to £600 plus VAT by size, and quotes Plus individually based on the size and complexity of your network. ISO 27001 certification is quoted by certification bodies, and you also need a copy of the standard.
Is ISO 27001 certification mandatory?
No. Certification is optional unless it is required by law, by a contract or by another scheme, and it applies only within the scope stated on the certificate.
