Illustrative assessor checking a business laptop and firewall against a security certification checklist

Customers, insurers and tenders increasingly ask for proof that you take cyber security seriously. In the UK, the three names you will hear most are Cyber Essentials, Cyber Essentials Plus and ISO 27001. They are not interchangeable, and choosing the wrong one wastes time and money.

Cyber Essentials

Cyber Essentials is the UK government-backed scheme. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

How it works: you complete an online self-assessment question set, signed off by a senior person, and an assessor from a licensed certification body marks it.
Cost: there is a fixed certification fee set by organisation size, in bands from micro organisations (0–9 employees) to those with 250 or more employees. Check the current fee when you apply.
Validity: 12 months, then you recertify.

Cyber Essentials Plus

Cyber Essentials Plus uses the same five controls, but an assessor tests them on a sample of your actual systems: user devices, internet gateways and internet-facing servers.

How it works: you need Cyber Essentials first, and the Plus audit must be completed within three months of your Cyber Essentials certificate.
Cost: there is no fixed fee; certification bodies quote individually based on the size and complexity of your network.
Validity: 12 months.

Preparation matters: see preparing for the Cyber Essentials Plus technical audit.

ISO/IEC 27001

ISO 27001 is the international standard for an information security management system (ISMS). Rather than checking five technical controls, it checks that you have a managed process for identifying risks, choosing controls, and reviewing and improving them.

How it works: you build and run the ISMS (policies, risk assessments, a statement of applicability, internal audits, management reviews), then an accredited certification body audits it.
Timescale: typically months of preparation for a small organisation.
Validity: certificates usually run on a three-year cycle with surveillance audits in between.

Which one do you need?

Most small businesses: start with Cyber Essentials. It is affordable, practical and often required for government contracts and by some insurers.
If customers or tenders ask for independent testing: Cyber Essentials Plus.
If larger clients ask for ISO 27001, or you handle high-risk data at scale: ISO 27001, usually with Cyber Essentials alongside it for the technical baseline.

Start by checking exactly what your customers, insurer or contract wording asks for. Do not buy ISO 27001 when Cyber Essentials would satisfy the requirement, and do not assume Cyber Essentials will satisfy a client who has asked for ISO 27001.

Common reasons for failing Cyber Essentials

Unsupported operating systems or software still in use.
Security updates not applied within 14 days for high or critical vulnerabilities.
Admin accounts used for everyday work.
No multi-factor authentication on cloud services.
Default passwords left on routers and firewalls.

Our guide to Cyber Essentials preparation costs explains where the real effort goes.

When to speak to BMT

We help businesses prepare for Cyber Essentials and Cyber Essentials Plus, fix the gaps, and keep controls in place all year rather than just at renewal. See cyber security services. Call us on 0161 672 7461 or 01706 391 047, or get in touch online.

Cyber Essentials vs Plus vs ISO 27001