All services Every engagement has a fixed, published price. Book a strategy call
The three UK security certifications compared, including the one most guides skip: what each covers, what each costs, and the ladder order that means no money is wasted, from a certification body that holds two of them itself.
Three certifications dominate UK conversations about proving cyber security, and they are routinely confused: Cyber Essentials, ISO 27001 and IASME Cyber Assurance. Most comparison articles cover the first two and ignore the third entirely, which is a disservice, because IASME Cyber Assurance is often the right answer for organisations caught between a baseline they have outgrown and an international standard they do not yet need.
This guide is written from an unusual position: we are an IASME licensed certification body for Cyber Essentials, we implement and internally audit ISO 27001 for a living, and we hold Cyber Essentials Plus and IASME Cyber Assurance Level 1 ourselves. What follows is the comparison we give clients, with the prices we publish.
The short answer. Cyber Essentials is the UK government backed baseline: five technical controls proving you block the most common attacks, from £320 + VAT. IASME Cyber Assurance is the governance step above it: risk management, policies, data protection and resilience, sized and priced for smaller organisations. ISO/IEC 27001 is the international information security management standard that enterprise and overseas procurement demands, and it costs and takes the most. They are a ladder rather than rivals.
| Cyber Essentials | IASME Cyber Assurance | ISO/IEC 27001 | |
|---|---|---|---|
| What it is | UK government backed certification of five technical controls. | A governance standard for smaller organisations, built to sit above Cyber Essentials. | The international standard for an organisation wide information security management system. |
| Who runs it | NCSC scheme, delivered by IASME and its licensed certification bodies. | IASME. | ISO/IEC standard, certified by accredited certification bodies, UKAS accredited in the UK. |
| What it covers | Firewalls, secure configuration, access control, malware protection, security updates. | Everything in Cyber Essentials plus risk management, policy, people, data protection aligned to UK GDPR, backup and resilience. | Whatever your risk assessment says it must: a full management system with leadership, risk treatment, controls and continual improvement. |
| Assessment | Verified self assessment. Cyber Essentials Plus adds an independent technical audit. | Level 1 is a verified self assessment. Level 2 adds an independent audit. | Stage 1 and Stage 2 certification audits, then annual surveillance on a three year cycle. |
| Typical cost | Official fee £320 to £600 + VAT by organisation size. Plus from £1,150 + VAT with us. | Fees published by IASME, tiered by size. Sits between the other two. | Implementation from £25,000 + VAT with us, plus certification body fees. |
| Time | Days to weeks. | Weeks. | Three to six months to build, then the audit cycle. |
| Renewal | Annual. | Annual. | Three year certificate with annual surveillance audits. |
| Who asks for it | UK customers, insurers, many public sector contracts. | UK supply chains wanting governance evidence without ISO overhead. | Enterprise procurement, regulated sectors, international customers. |
Cyber Essentials certifies that five technical controls are in place and working. It is deliberately narrow: the scheme exists to stop the commodity attacks that cause most breaches, and it succeeds at exactly that. The standard version is a verified self assessment. Cyber Essentials Plus adds an independent technical audit of your live systems, and is what larger customers increasingly specify.
It is the right first certificate for almost every UK organisation, and for many small firms with simple estates it is genuinely enough. Its limits are equally clear: it says nothing about how you govern risk, train people, protect data or recover from incidents. When customers start asking those questions, you have outgrown the baseline. Our cost guide covers the fees in detail, and guided certification starts at the official fee of £320 + VAT.
IASME Cyber Assurance is the scheme the usual comparison articles skip, and it fills a real gap. Built by IASME to sit above Cyber Essentials, it adds the governance layer: risk assessment and management, security policies people follow, roles and training, data protection aligned to UK GDPR, and backup, continuity and resilience. Level 1 is a verified self assessment. Level 2 adds an independent audit for organisations that need the stronger claim.
It suits organisations that handle sensitive data, sit in demanding supply chains, or keep being asked governance questions that Cyber Essentials does not answer, but whose size makes a full ISO 27001 management system disproportionate. It is a fraction of the cost and effort, annually renewed, and credible precisely because it is not a stretched version of anything else.
We say this with some conviction because we hold IASME Cyber Assurance Level 1 ourselves, alongside our Cyber Essentials Plus certificate. It is the standard we chose for our own governance, and both can be checked from our About page.
ISO/IEC 27001 certifies a management system rather than a checklist: leadership commitment, a live risk register, a statement of applicability, controls chosen because your risks demand them, internal audit and continual improvement, examined by an accredited certification body on a three year cycle. It is the only one of the three that enterprise procurement, regulated sectors and international customers reliably accept without discussion.
It earns that acceptance with cost and effort. A properly built implementation runs from £25,000 + VAT over three to six months with us, with certification body fees on top, and the system then needs running: reviews, evidence, internal audits from £4,500 + VAT, or a managed ISMS from £2,500 a month. Bought for the right reason, a contract, a market, a regulator, it pays for itself. Bought as a badge, it becomes the most expensive folder in the building.
The three stack rather than compete. IASME designed Cyber Assurance to build on Cyber Essentials, and everything both schemes make you do, asset lists, patching discipline, policies, risk thinking, is reusable evidence when ISO 27001 eventually arrives. Money spent lower on the ladder is not wasted. It is groundwork.
No. It is a proportionate alternative for smaller organisations, covering governance, risk, data protection and resilience at SME scale. If your customers or regulators name ISO 27001, only ISO 27001 satisfies them. If they simply want evidence of good governance, IASME Cyber Assurance answers at a fraction of the cost.
In practice yes: IASME designed Cyber Assurance to build on the Cyber Essentials controls, and doing them in that order means each certificate reuses the last one’s work. Cyber Essentials first, Cyber Assurance when governance questions start arriving.
Start with Cyber Essentials: it is the baseline UK customers and insurers recognise, from £320 + VAT. Move to IASME Cyber Assurance when you handle sensitive data or your supply chain asks about governance. Take on ISO 27001 only when a contract, market or regulator makes it worth the investment.
No. ISO 27001 is a management system whose controls depend on your risk assessment. Cyber Essentials is a fixed set of five technical controls with UK government backing. Many organisations hold both, because Cyber Essentials proves the technical baseline instantly while ISO 27001 proves the system around it.
Cyber Essentials, then Cyber Essentials Plus if customers demand audited evidence, then IASME Cyber Assurance for governance, then ISO 27001 when the market you sell into requires it. Each rung reuses the evidence of the one below.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
