UK cyber security compliance: a guide for IT teams
Key takeaways
- Cyber Essentials is the minimum standard of cyber security recommended by the government, built on five technical controls
- Cyber Essentials is mandatory for central government contracts advertised after 1 October 2014 that involve handling personal information and providing certain ICT products and services
- ISO 27001 specifies requirements for an information security management system rather than a list of controls, and certification applies only within the scope on the certificate
- The NIS Regulations are the UK's only cross-sector cyber legislation, and the Cyber Security and Resilience Bill will update them
- UK GDPR Article 32 expects the ability to restore personal data in a timely manner and regular testing of security measures
UK IT teams are asked about the same handful of rules and certifications again and again: in supplier questionnaires, tenders, audits and board reports. This guide explains what each one is, who it applies to, and how they fit together, with links to our detailed guides.
Cyber Essentials: the baseline
The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the government for organisations of all sizes. It says the scheme is aligned to five technical controls designed to prevent the most common internet-based cyber security threats.
The government made the scheme mandatory for central government contracts advertised after 1 October 2014 which involve handling personal information and providing certain ICT products and services. In our view, many other buyers now ask for it too, so it is the usual first certification.
There are two levels. Our guide to Cyber Essentials vs Cyber Essentials Plus covers cost, renewal and what the independent audit adds.
ISO 27001: the management system
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), including the assessment and treatment of information security risks. It specifies a management system rather than a list of controls to adopt.
Certification is optional unless it is required by law, by a contract or by another scheme, and it applies only within the scope stated on the certificate. Our guide to Cyber Essentials Plus vs ISO 27001 explains which one you need, and when you need both.
The NIS Regulations and the Cyber Security and Resilience Bill
The government describes the NIS Regulations as the UK's only cross-sector cyber legislation, placing security and resilience duties on organisations involved in delivering essential services and some digital services. It also says they are out of date and insufficient for the threats the UK faces.
The Cyber Security and Resilience Bill will update them. The government says the Bill has three pillars of reform, and that the regime will not cover every UK organisation. NIS2 is the EU's equivalent law and does not apply in the UK as such. Our guide to NIS2 and the UK Cyber Security and Resilience Bill tracks who is coming into scope and the new incident reporting rules.
UK GDPR: security and backups
If you process personal data, UK GDPR Article 32 requires appropriate technical and organisational measures for security. It lists, as appropriate, the ability to restore the availability of and access to personal data in a timely manner after a physical or technical incident, and a process for regularly testing, assessing and evaluating those measures.
That makes backups and restore testing a data protection issue as well as an IT one. Our guide to UK GDPR and backups covers retention, the right to erasure and what happens to personal data in backups.
DORA: for financial services with EU links
ESMA says the EU's Digital Operational Resilience Act entered into force on 16 January 2023 and applies as of 17 January 2025. It is EU law, so it applies directly to EU financial entities. Our guide to DORA backup requirements for UK firms covers what it means for UK firms.
How they fit together
In our view, the simplest way to think about them is in layers:
| What it is | Who it applies to | |
|---|---|---|
| Cyber Essentials | Five technical controls, certified | Anyone; required for some government contracts |
| ISO 27001 | A certified information security management system | Anyone who chooses it, or whose contracts require it |
| NIS Regulations | Law for essential and some digital services | Organisations in scope, which the Bill will widen |
| UK GDPR Article 32 | Law on the security of personal data | Anyone processing personal data |
| DORA | EU law on digital operational resilience | EU financial entities and their ICT providers |
Most organisations start with UK GDPR, because almost everyone processes personal data, and Cyber Essentials, because it is the government's recommended minimum. ISO 27001, NIS and DORA then depend on your customers, your sector and where you operate. For the backup side of all of these, see our business backup and recovery guide.
FAQ
What is the minimum cyber security standard in the UK?
The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the government for organisations of all sizes. It is aligned to five technical controls designed to prevent the most common internet-based threats.
Is Cyber Essentials mandatory?
Not for every organisation. The government made it mandatory for central government contracts advertised after 1 October 2014 that involve handling personal information and providing certain ICT products and services. Customers and other contracts may also ask for it.
What is the difference between Cyber Essentials and ISO 27001?
Cyber Essentials checks five technical controls. ISO 27001 specifies requirements for a whole information security management system, built around assessing and treating risks.
Does NIS2 apply in the UK?
NIS2 is an EU directive. The UK's cross-sector cyber law is the NIS Regulations, which the government describes as out of date, and the Cyber Security and Resilience Bill will update them.
What does UK GDPR require for security?
Article 32 requires appropriate technical and organisational measures, including, as appropriate, the ability to restore the availability of and access to personal data in a timely manner after an incident, and a process for regularly testing those measures.
