All services Every engagement has a fixed, published price. Book a strategy call
What buyers mean when they ask for security certification, how the three compare on what matters commercially, and which to buy for which market.
A buyer asks for security certification and the response is usually a guess. Some UK companies pursue ISO 27001 when the customer wanted Cyber Essentials, which costs tens of thousands more than the requirement. Others chase SOC 2 because an American prospect mentioned it, without knowing that SOC 2 is not a certificate and that no UK certification body can issue one.
This guide decodes what buyers mean, sets the three side by side on the differences that matter commercially, and tells you which to buy for which market. Intelance sells ISO 27001 and Cyber Essentials work. We do not and cannot provide SOC 2, which is explained plainly below, so the recommendation on that one carries no commercial interest at all.
The short answer. Cyber Essentials is a UK government backed baseline that proves five technical controls, from £320 + VAT, in days. ISO 27001 is an international certification of a management system, from £25,000 + VAT with us plus audit fees, over three to six months of work. SOC 2 is an American attestation report written by a licensed CPA firm rather than a certificate, and it is what US software buyers usually mean. Buy what the buyer named. Where you sell to UK public sector, Cyber Essentials. UK enterprise procurement, ISO 27001. US technology buyers, SOC 2 Type 2.
Most of the confusion starts with imprecise wording in a procurement email. These are the phrases we see most often and what they usually mean.
| What the buyer wrote | What they almost always want |
|---|---|
| Are you Cyber Essentials certified | Exactly that. It is named in UK government and public sector contracts, and nothing else substitutes for it |
| Please share your security certifications | An ISO 27001 certificate if you have one, otherwise whatever you hold. Send the certificate with its scope statement |
| Can we see your SOC 2 | A SOC 2 Type 2 report under NDA. The buyer is usually American, or UK based with US investors or customers |
| Are you ISO certified | ISO 27001 specifically. Other ISO standards will not satisfy an information security question |
| Complete our security questionnaire | They have no certification requirement yet, but a certificate would shorten the questionnaire considerably |
The cheapest move in this entire subject is asking the buyer one question. Which of these would satisfy you, and is it a condition of contract. Buying the wrong one is the most expensive mistake in the market, and it happens because nobody asks.
| Comparison | Cyber Essentials | ISO 27001 | SOC 2 |
|---|---|---|---|
| What it is | UK government backed scheme proving five technical controls | The international standard certifying an information security management system | American attestation report on controls, written by an accountant |
| What you receive | A certificate, valid twelve months | A certificate with a scope statement, on a three year cycle with surveillance | A report, often sixty pages or more, shared under NDA |
| Who issues it | An IASME licensed certification body | An accredited certification body, UKAS accredited in the UK | A licensed CPA firm. No certification body can issue one |
| Publicly verifiable | Yes, on the IASME register | Yes, with the certification body | No. There is no register, and the report is confidential |
| Time to obtain | Days once the controls are in place | Three to six months of work, plus the audit | Type 1 is a point in time. Type 2 covers an observation window, commonly three to twelve months |
| Indicative cost | Official fee from £320 + VAT by size, guided certification from £950 + VAT with us | Implementation from £25,000 + VAT with us, plus certification body fees | Quoted by the CPA firm, plus readiness work. Pricing is not published in the UK market |
| Who asks for it | UK government, public sector, insurers, UK supply chains | UK and European enterprise procurement, almost universally | US technology buyers, US investors, and increasingly UK SaaS procurement |
ISO 27001 and Cyber Essentials produce certificates. SOC 2 produces a report, and the difference is practical rather than semantic.
A certificate is a short document with a scope statement, publicly verifiable, that says an accredited body examined something and found it satisfactory. A SOC 2 report is a long document containing the auditor’s opinion, a description of your system, the controls tested, and every exception found. Buyers read it. Exceptions are visible. There is no register to check, so the report is requested under NDA and often expires in the buyer’s eyes after twelve months, which is why bridge letters exist to cover the gap between report periods.
Two further points matter commercially. A Type 1 report describes controls at a single date and carries much less weight with sophisticated buyers. A Type 2 report covers a period of operation, which is what people mean when they say SOC 2 without qualifying it. If a buyer asks for SOC 2 and you offer Type 1, expect to be asked again.
The overlap between ISO 27001 and SOC 2 is substantial and widely underestimated, which changes the sequencing decision.
| What you build | Counts towards ISO 27001 | Counts towards SOC 2 |
|---|---|---|
| Access control, joiners and leavers, review evidence | Yes | Yes |
| Change management and deployment records | Yes | Yes |
| Risk assessment and treatment | Central to the standard | Expected, in less prescribed form |
| Incident response, tested | Yes | Yes |
| Supplier and subprocessor management | Yes | Yes |
| Statement of Applicability | Required | Not used |
| Internal audit and management review | Required by clauses 9.2 and 9.3 | Not required, though useful evidence |
| A described system boundary for the report | Covered by the scope statement | Required, and written in detail |
In practice an organisation with a working ISO 27001 management system has most of what a SOC 2 Type 2 examination needs. The remaining work is describing the system properly and running the observation window. Going the other way is harder, because a SOC 2 report does not produce the management clauses ISO 27001 requires.
Being direct about the boundary matters here. SOC 2 examinations must be performed by a licensed CPA firm under American Institute of Certified Public Accountants standards. Intelance is not a CPA firm, so we cannot issue a SOC 2 report and would not claim otherwise. What we can do is get the controls and evidence into the state an examination requires, and tell you honestly whether you need one at all. The AICPA maintains the authoritative description of the SOC suite if you want the primary source.
On the other two we do the work directly. Cyber Essentials certification runs at the official fee from £320 + VAT by organisation size, with guided certification from £950 + VAT where you want the requirements walked through your estate, and Cyber Essentials Plus from £1,150 + VAT fixed. For ISO 27001, a gap assessment starts from £8,500 + VAT, implementation from £25,000 + VAT, internal audit from £4,500 + VAT, and a managed ISMS from £2,500 + VAT per month. Certification body fees are always separate and paid to the auditor.
Deeper detail sits in our guides to Cyber Essentials versus ISO 27001, the three UK schemes including IASME Cyber Assurance, what ISO 27001 costs in the UK and how long it takes. If certificates are being requested because questionnaires keep landing, answering security questionnaires addresses the underlying problem.
Neither is better. They answer different buyers. ISO 27001 is an international certification recognised by UK and European enterprise procurement. SOC 2 is an American attestation report that US technology buyers expect. Where you sell to both markets, most organisations build the management system once and use it for both.
Sometimes as supporting evidence, rarely as a replacement. American security teams have processes built around reading SOC 2 reports, including the exceptions section. Offer the ISO 27001 certificate, ask whether it satisfies the requirement, and expect a proportion of buyers to still want the report.
Yes. A UK company can be examined by a licensed CPA firm and receive a SOC 2 report. The examination has to be performed by that CPA firm rather than by a certification body or a consultancy, which is why no UK certification body issues SOC 2.
Type 1 reports on the design of controls at a single point in time. Type 2 reports on how they operated across a period, commonly three to twelve months. When a buyer says SOC 2 without qualifying it, they almost always mean Type 2.
Follow the buyers. Selling mainly to UK and European enterprises, ISO 27001 first. Selling mainly to US buyers, SOC 2 Type 2 first. Selling to both, build the management system, certify ISO 27001, then use the same controls for the SOC 2 observation window. Cyber Essentials is worth holding either way because it is cheap and UK buyers ask for it.
Cyber Essentials starts at the official fee from £320 + VAT by organisation size, with Cyber Essentials Plus from £1,150 + VAT with us. ISO 27001 implementation starts from £25,000 + VAT with certification body fees separate. SOC 2 is quoted by the CPA firm performing the examination and UK pricing is not published, so obtain quotes directly.
Very few organisations do. Holding Cyber Essentials alongside either ISO 27001 or SOC 2 is common and sensible because the baseline is inexpensive. Holding all three only makes sense where you genuinely sell into UK public sector, UK or European enterprise, and the US market simultaneously.
Cyber Essentials lasts twelve months and is renewed annually. ISO 27001 certificates run on a three year cycle with annual surveillance audits. A SOC 2 report covers a stated period and buyers typically treat it as current for around twelve months, with bridge letters used to cover the gap until the next report.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
