ISO 27001 and Cyber Essentials Plus: how they differ and when each is asked for

UK organisations weighing up information security credentials often ask whether they need ISO/IEC 27001 or Cyber Essentials Plus. The two are sometimes treated as rival options, but they answer different questions. Cyber Essentials Plus tests whether a defined set of technical controls is in place. ISO/IEC 27001 certification assesses whether an organisation runs a management system for information security risk. This article explains the difference and the situations in which each tends to be requested.

What Cyber Essentials covers

Cyber Essentials is a UK government-backed scheme developed by the National Cyber Security Centre (NCSC). The NCSC describes it as the minimum standard of cyber security recommended by government for organisations of all sizes [1]. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection [1].

IASME is the government's Cyber Essentials delivery partner. Assessment and certification are carried out by certification bodies licensed by IASME [2]. There are two levels:

• Cyber Essentials, a verified self-assessment in which the organisation answers a question set and a qualified assessor marks the answers [3]
• Cyber Essentials Plus, which adds a technical audit, including external vulnerability scanning and testing of a representative sample of devices, to verify that the controls are in place [3]

Both levels are renewed annually. The Cyber Essentials Plus audit must be completed within three months of the organisation's Cyber Essentials certification [3].

The requirements are updated from time to time. As at September 2026, the current document is Requirements for IT Infrastructure v3.3, which applies to assessments from late April 2026 and uses the Danzell question set. Among other changes, it states that cloud services cannot be excluded from scope, makes multi-factor authentication on cloud services an automatic fail point where it is available but not used, and treats failure to apply high-risk or critical security updates within 14 days as an automatic fail [4].

What ISO/IEC 27001 covers

ISO/IEC 27001:2022 is an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS) [5]. Its requirements cover the context and scope of the ISMS, leadership, risk assessment and treatment, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in organisational, people, physical and technological themes. An organisation decides which apply on the basis of its risk assessment and records the decision in a Statement of Applicability [5].

ISO itself does not certify organisations. Certificates are issued by independent certification bodies [6]. Under ISO/IEC 17021-1:2015, initial certification involves a Stage 1 and a Stage 2 audit, followed by surveillance audits and recertification on a three-year cycle [7].

The main differences

• Focus: Cyber Essentials Plus tests a fixed set of technical controls. ISO/IEC 27001 assesses a management system that selects controls on the basis of risk.
• Breadth: Cyber Essentials does not address governance, supplier management, incident management, business continuity or physical security in any depth. ISO/IEC 27001 covers all of these.
• Method: Cyber Essentials Plus relies heavily on technical testing of devices and internet-facing services. ISO/IEC 27001 audits rely on interviews, documents, records and sampled evidence of controls in operation.
• Recognition: Cyber Essentials is a UK scheme and is referenced in UK public sector procurement policy. ISO/IEC 27001 is an international standard recognised by buyers in many countries.

Who tends to ask for which

In UK public procurement, Procurement Policy Note (PPN) 014 applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. For relevant contracts, such as those involving personal information or certain information and communication technology services, suppliers are asked to hold Cyber Essentials or Cyber Essentials Plus, or to demonstrate equivalent controls, before contract award. The note says the scheme should not be applied to every contract as a matter of course [8]. The buyer decides which level to ask for.

Private sector buyers, particularly larger enterprises and regulated organisations, more often refer to ISO/IEC 27001 in supplier questionnaires, and overseas buyers are unlikely to be familiar with Cyber Essentials. These are patterns in buyer practice rather than rules, and individual procurement teams vary. The most reliable guide is what the organisation's own customers and target tenders actually ask for.

Using them together

The technical controls in Cyber Essentials correspond to a subset of the controls in ISO/IEC 27001 Annex A, so work on one supports the other. Organisations that already run an ISMS generally find that Cyber Essentials Plus tests controls they have documented, while organisations that start with Cyber Essentials gain a technical baseline that an ISMS can build on. The order that makes sense depends on which customers need to be satisfied first, the current state of the technical estate, and the resources available to run an ISMS once it is in place. Support is available for organisations deciding how to sequence the two.