A prospect emails you: "Before we can proceed, can you send over your security certification?"
Now what? Cyber Essentials or ISO 27001? One takes a few weeks and costs a few hundred pounds. The other takes months and costs thousands. Picking the wrong one wastes either your money or the deal.
Here is how to tell which one they actually mean.
The 30-second answer
- UK public sector contract, or a client asking for "basic cyber hygiene"? They almost certainly mean Cyber Essentials.
- Enterprise client, financial services, healthcare, or anyone sending you a 90-question security questionnaire? They mean ISO 27001 (or SOC 2, if they are American).
If you are still unsure, ask them directly. "Which certification are you looking for, specifically?" is a completely reasonable question, and it has saved companies tens of thousands of pounds.
What Cyber Essentials actually is
Cyber Essentials is a UK government-backed scheme covering five technical controls: firewalls, secure configuration, user access control, malware protection, and patch management.
- Cost: from around £300 + VAT for the self-assessed version
- Time: days to a few weeks
- Effort: a self-assessment questionnaire, verified by a certification body
- Cyber Essentials Plus: the same five controls, but independently tested. Expect £1,500–£3,000+ depending on your size.
It is mandatory for many UK central government contracts involving certain types of data. That is the single biggest reason companies get it.
What it is not: it is not a management system. It says nothing about your risk process, your policies, your suppliers, or your incident response. It is a floor, not a framework.
What ISO 27001 actually is
ISO 27001 is an information security management system — a whole governance apparatus. Risk assessment, a Statement of Applicability across 93 Annex A controls, internal audits, management review, continual improvement.
- Cost: £6,000–£9,000 in audit fees for a 30-person company, plus internal time and tooling (we break this down in full in our ISO 27001 certification cost guide)
- Time: typically 6–12 months for a first certification
- Effort: substantial, and ongoing — surveillance audits every year
It is what enterprise procurement teams recognise internationally. It is the one that unblocks the big deal.
Side by side
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| Scope | 5 technical controls | Full management system, 93 controls |
| Typical cost | £300–£3,000 | £15,000–£30,000+ all-in, year one |
| Time to certify | Days–weeks | 6–12 months |
| Recognised by | UK government, UK SMEs | Enterprise procurement, globally |
| Ongoing burden | Annual renewal | Annual surveillance audits |
| Proves | Basic cyber hygiene | Systematic risk management |
The honest recommendation
Do Cyber Essentials first. It is cheap, quick, and it forces you to fix the technical basics that ISO 27001 will ask about anyway. If a government contract needs it, you are covered. And it is a credible answer to "do you have any security certification?" while you work towards the bigger one.
Then do ISO 27001 when a deal demands it — and it will, the first time you sell to an enterprise. Do not start it speculatively at 10 people. Do start it the moment a six-figure contract is contingent on it, because you will need 6–12 months of runway.
The two are not competitors. Cyber Essentials is a rung on the ladder; ISO 27001 is the ladder.
The overlap nobody mentions
The five Cyber Essentials controls map almost directly onto ISO 27001's Annex A. Patch management, access control, malware protection and secure configuration all appear in both.
So the work is not wasted. If you track your controls properly the first time — with evidence attached, in one place — a large chunk of your Cyber Essentials work becomes ISO 27001 evidence later.
That is exactly why we pre-loaded both frameworks into PilotVantage, alongside SOC 2, GDPR, ISO 42001, DORA, NIS2 and nine others. Map a control once, reuse the evidence everywhere.
Not sure how far along you are? Our free ISO 27001 gap assessment gives you an instant maturity score in 10 questions. No email wall. And PilotVantage starts free — 14 frameworks, from £49/month when you outgrow the free plan.