All services Every engagement has a fixed, published price. Book a strategy call
Cyber Essentials vs ISO 27001, compared by a firm that delivers both: what each proves, who asks for which, the real costs side by side, the right order to do them in, and the mistake that wastes tens of thousands of pounds.
Most comparisons of Cyber Essentials and ISO 27001 are written by firms that sell one of them. This one is written by a firm that delivers both: Intelance is an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus, and we deliver ISO 27001 gap assessments, implementations and internal audits, all at published fixed prices. We have no incentive to steer you either way, which makes the honest answer easier to give.
The short answer. Cyber Essentials is a UK government-backed baseline: five technical control areas, self-assessed, £320 to £600 + VAT, done in days to weeks. ISO 27001 is an international management system standard: externally audited, typically tens of thousands of pounds and several months of work in year one. They answer different questions. Cyber Essentials proves your basic technical hygiene is in place today. ISO 27001 proves you run a system that manages information security continuously. Most UK SMEs should do Cyber Essentials first, and add ISO 27001 when a customer, regulator or market genuinely requires it, in that order, for reasons this article sets out.
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| What it is | A UK government-backed certification of five technical control areas: firewalls, secure configuration, access control, malware protection and security updates | An international standard for an information security management system (ISMS): risk assessment, policies, controls, leadership and continuous improvement |
| What it proves | Baseline technical hygiene is in place at the date of certification | The organisation runs a managed, audited system that keeps security working over time |
| Who assesses it | Self-assessment marked by a licensed certification body. Cyber Essentials Plus adds a hands-on technical audit | An accredited certification body audits the management system, then returns for surveillance audits in a three year cycle |
| Scope | Whole organisation in almost all cases. Technical controls only | A scope you define: people, processes, suppliers and technology, with 93 reference controls in Annex A |
| Effort | Days to a few weeks, mostly IT time | Typically three to nine months to build, involving leadership, HR, suppliers and IT |
| Typical cost | £320 to £600 + VAT official fee. Cyber Essentials Plus commonly £1,500 to £3,000 (our published price £1,150 + VAT) | Commonly £30,000 to £70,000 or more in year one all-in. Full breakdown below |
| Renewal | Every 12 months | Three year certification cycle with annual surveillance audits and internal audits |
| Who asks for it | UK government contracts, UK supply chains, insurers | Enterprise customers, international buyers, regulated sectors, security questionnaires at scale |
| Best first move for | Most UK SMEs, and anyone selling into UK public sector | Organisations whose customers or regulators name it, or whose scale makes managed security unavoidable |
Cyber Essentials is the UK’s minimum standard for technical cyber hygiene, run by IASME for the National Cyber Security Centre. It tests whether five families of controls are genuinely in place: boundary firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment. Cyber Essentials Plus has an assessor test a sample of your systems directly. It is deliberately narrow, deliberately cheap, and renewed annually. If you want the current rules, our guide to the Cyber Essentials 2026 changes covers the question set and the new auto-fail marking, and our Cyber Essentials cost guide covers every fee.
ISO/IEC 27001 is an international standard for how an organisation manages information security as a system. Certification means an accredited auditor has examined your information security management system: how leadership sets direction, how risks are assessed and treated, how policies translate into controls across people, premises, suppliers and technology, and how the whole thing is measured, audited internally and improved. Annex A provides 93 reference controls, but the standard’s centre of gravity is the management system rather than any individual control. Certification runs on a three year cycle with annual surveillance audits, which is why ISO 27001 is a way of operating rather than a purchase.
The comparison becomes simple once you see that the two schemes answer different questions. Cyber Essentials answers: are the basics in place right now? It is a checkpoint, examined at a point in time, about specific technical configurations. ISO 27001 answers: does this organisation have a working system for making security decisions, forever? It covers risk, people, suppliers, incidents and improvement, and it is audited repeatedly.
That is why one cannot substitute for the other. An ISO 27001 certificate does not prove your laptops are patched this fortnight, because the auditor examined your system rather than every endpoint. A Cyber Essentials certificate does not prove you manage supplier risk or train staff, because the scheme never looked. Buyers understand this instinctively, which is why serious supply chains increasingly ask for the Cyber Essentials ISO 27001 difference to be covered from both ends: the baseline verified annually, and the management system audited on cycle.
| Your situation | What you need | Why |
|---|---|---|
| Bidding for UK government or public sector work | Cyber Essentials, often Cyber Essentials Plus | Many UK government contracts require it by name. ISO 27001 does not substitute where the contract says Cyber Essentials |
| A large customer’s security questionnaire keeps asking about your ISMS | ISO 27001, with Cyber Essentials as the quick first win | Enterprise procurement teams recognise ISO 27001. The questionnaire is telling you what they will eventually require |
| Selling software or services internationally | ISO 27001 | Cyber Essentials is UK-specific. International buyers rarely recognise it |
| An SME with no certification and no specific demand yet | Cyber Essentials now | Days of effort, hundreds of pounds, immediate risk reduction and eligibility. Decide on ISO 27001 when a real demand appears |
| Regulated sector, or holding large volumes of sensitive data | Both: Cyber Essentials annually, ISO 27001 on cycle | The baseline proves hygiene. The management system proves governance. Regulators and insurers increasingly expect both |
| A contract deadline names a certification | Exactly what the contract names | Buy what the buyer asked for. Substituting the one you prefer is the most expensive mistake in this market |
For almost every organisation that will eventually need both, the order is Cyber Essentials first, then ISO 27001, and the reasons are practical rather than doctrinal. Cyber Essentials is fast and cheap, so it removes the basic technical risks immediately rather than after a nine month programme. The work it forces, asset lists, access control, patching discipline, becomes direct evidence for the technical controls in ISO 27001’s Annex A, so nothing is wasted. And passing it early keeps you eligible for UK contracts while the longer ISO 27001 build runs.
The order reverses only when a specific buyer or regulator demands ISO 27001 on a date and does not mention Cyber Essentials. Even then, most organisations fold the Cyber Essentials controls into the ISO programme’s first quarter, because the overlap makes it nearly free at that point.
Neither, and the question costs organisations real money every year. Do I need Cyber Essentials if I have ISO 27001? If a contract or framework asks for Cyber Essentials by name, yes: the schemes are administered separately, and an ISO certificate does not appear on the Cyber Essentials register a procurement officer checks. The reverse is also true: Cyber Essentials satisfies nobody who has asked for ISO 27001. The technical overlap is genuine, the five Cyber Essentials control areas map comfortably into Annex A, so holding both is much cheaper than the sum of doing each cold. But recognition is by name, and buyers check registers rather than equivalences.
Is Cyber Essentials cheaper than ISO 27001? Dramatically, and by enough that the comparison should be made in real figures. Ours are published prices. Market figures are typical ranges worth checking in your sector.
| Item | Cyber Essentials | ISO 27001 |
|---|---|---|
| Getting assessed | £320 to £600 + VAT official fee, by organisation size. Guided support £950 + VAT with us | Certification body audit fees commonly £4,000 to £12,000 across the three year cycle, paid to the auditor |
| Getting ready | Often nothing beyond internal time. Remediation of basics if needed | Gap assessment £8,500 + VAT with us. Implementation from £25,000 + VAT fixed by scope |
| The technical audit level | Cyber Essentials Plus: £1,150 + VAT with us, fixed. Commonly £1,500 to £3,000 in the market | Included in the certification audit. Internal audits required annually, £4,500 + VAT with us |
| Keeping it | Annual renewal at the official fee | Annual surveillance audits, annual internal audits, and the management system’s running cost. A managed ISMS is £2,500 per month with us |
| Realistic year one total | From £320 to roughly £3,000 all-in depending on support and Plus | Commonly £30,000 to £70,000 or more all-in, depending on scope and how much you build yourselves |
The gap is the point. Cyber Essentials is priced so that no organisation has a cost excuse for skipping the basics. ISO 27001 is priced like the organisational change it is. Budgeting one when the buyer asked for the other, in either direction, is the expensive version of not reading the question.
A common middle question: does Cyber Essentials Plus close the gap to ISO 27001? It closes the verification gap rather than the scope gap. Cyber Essentials Plus vs ISO 27001 is still a comparison between a technically verified baseline and a full management system: the Plus audit proves the five control areas are genuinely implemented on real devices, which satisfies many UK buyers and frameworks, but it says nothing about risk management, suppliers, people or improvement. Where a buyer’s concern is “are they safe to plug into our supply chain”, Cyber Essentials Plus often suffices. Where the concern is “do they run security as a discipline”, only the management system answers it.
The most expensive mistake we see is buying ISO 27001 because it sounds more senior, when every contract on the table asked for Cyber Essentials. That spends tens of thousands of pounds and most of a year acquiring a certificate nobody asked for, while the tender that started the conversation lapses for want of a £440 assessment. The mirror-image mistake is slower but just as costly: scraping through Cyber Essentials while your customer base shifts to enterprises whose questionnaires all point at ISO 27001, then starting a nine month programme under deadline pressure. The cure for both is the same: read what your buyers require, in writing, and buy that. Certifications are answers to buyers’ questions rather than statements about ambition.
For Cyber Essentials, we are the certification body: the official fee of £320 to £600 + VAT passed through at cost on basic certification, guided support at £950 + VAT, and Cyber Essentials Plus at £1,150 + VAT fixed. For ISO 27001, we deliver the gap assessment at £8,500 + VAT, implementation at from £25,000 + VAT fixed by scope, internal audits at £4,500 + VAT, and a managed ISMS at £2,500 per month, with the accredited certification body you choose kept fully independent. Because we sell both, our advice on which you need costs nothing to be honest.
Yes, whenever a contract or framework asks for Cyber Essentials by name. The schemes are administered separately and checked on separate registers, so an ISO 27001 certificate does not satisfy a Cyber Essentials requirement. The good news: an organisation running a real ISMS passes Cyber Essentials with very little extra work.
For many UK SMEs, yes for now. It proves baseline technical hygiene, keeps you eligible for UK public sector work and satisfies many supply chains. It stops being enough when customers ask about risk management, suppliers and policies, which is management system territory.
By an order of magnitude. Cyber Essentials runs from £320 + VAT to roughly £3,000 all-in with support and the Plus audit. ISO 27001 commonly costs £30,000 to £70,000 or more in year one once implementation, certification audits and internal audits are counted.
The work does, even though the certificate does not. The five Cyber Essentials control areas map into ISO 27001’s Annex A controls, so asset lists, access control and patching discipline built for Cyber Essentials become direct evidence in an ISO 27001 programme.
Cyber Essentials: days to a few weeks, including remediation. Cyber Essentials Plus: one to three weeks. ISO 27001: typically three to nine months to build the management system, then the certification audit, then a three year cycle of surveillance.
Many UK government contracts involving personal data or certain services require Cyber Essentials, and some specify Cyber Essentials Plus. ISO 27001 appears in some higher-assurance procurements, but where a contract names Cyber Essentials, only Cyber Essentials satisfies it.
No law requires ISO 27001 certification. It becomes effectively mandatory through contracts: enterprise customers, regulated sectors and international buyers write it into supplier requirements, which is why the decision should follow your buyers rather than fashion.
Cyber Essentials Plus is a hands-on technical audit of the five baseline control areas on real devices. ISO 27001 audits an entire management system: risk, leadership, people, suppliers and improvement. Plus verifies the basics are real. ISO 27001 verifies security is managed.
Cyber Essentials first in almost all cases: it is faster, far cheaper, fixes the basics immediately, and its evidence feeds the ISO 27001 programme. Reverse the order only when a buyer or regulator demands ISO 27001 on a date and does not require Cyber Essentials.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus, and a provider of ISO 27001 assessment, implementation and audit services. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
