If a UK government or defence buyer is asking, start with Cyber Essentials. If an enterprise customer, an investor or an overseas buyer is asking, start with ISO 27001. Many UK companies end up with both, and the work overlaps.
Checked against NCSC and IASME sources on 25 October 2026.
What each one is
Cyber Essentials is the UK government-backed scheme run by IASME for the National Cyber Security Centre. It checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds a hands-on technical audit by an IASME-licensed certification body. Both are renewed every year.
ISO/IEC 27001:2022 is the international standard for an information security management system. It covers risk assessment and treatment, policies, people, suppliers, incident response, internal audit and management review, with 93 Annex A controls to consider. An accredited certification body audits it in two stages, then runs surveillance audits in years one and two and a recertification audit in year three.
What changed in Cyber Essentials in April 2026
Version 3.3 of the Cyber Essentials Requirements for IT Infrastructure applies to assessment accounts created after 27 April 2026 (IASME). Two changes matter most:
- Cloud services cannot be excluded from scope. If your data or services sit in Microsoft 365, Google Workspace or another cloud service, those services are in scope (NCSC, Requirements v3.3).
- Multi-factor authentication is expected on every cloud service that offers it, for every user, not only administrators (IASME, April 2026 update).
Check what your current setup does before you apply. Missing multi-factor authentication on a cloud service is now one of the most common reasons to fail.
Which buyers ask for which
| Who is asking | What they usually ask for | Where to start |
|---|---|---|
| UK central government contract | Cyber Essentials or Cyber Essentials Plus, depending on the contract's risk (PPN 014) | Cyber Essentials |
| Defence supply chain | Defence Cyber Certification. Cyber Essentials is a prerequisite for DCC Level 0 | Cyber Essentials, then DCC |
| Enterprise customer's security questionnaire | ISO 27001 or a SOC 2 report | ISO 27001 |
| Investor or acquirer due diligence | Evidence of a working security programme, often ISO 27001 | ISO 27001 |
| US or EU customers | ISO 27001 or SOC 2; Cyber Essentials is rarely recognised outside the UK | ISO 27001 |
| A tender that names both | Both | Cyber Essentials first, ISO 27001 in parallel |
The MoD has asked all defence industry partners to achieve DCC Level 0 by 31 December 2026. It is not a legal requirement.
Side by side
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| Scope | Five technical controls across your IT, including cloud services | The whole information security management system: people, processes, technology and suppliers |
| Assessed by | An IASME-licensed certification body | An accredited certification body, in two stages |
| Renewal | Every year | Three-year certificate with annual surveillance audits |
| Typical time to ready | Weeks, depending on your current setup | Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week |
| Recognised | Mainly the UK | Internationally |
| Goldline readiness price | Cyber Essentials readiness from £595, plus VAT; Cyber Essentials Plus readiness from £1,250, plus VAT | ISO 27001 Sprint £7,000 fixed, plus VAT |
Prices from goldlineconsultancy.co.uk/pricing. The certification body's fee is separate. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready; the certification body then sets its own Stage 1 and Stage 2 dates.
Doing both
The five Cyber Essentials controls sit inside ISO 27001's Annex A, so the technical work overlaps. If your pipeline includes a government or defence buyer and an enterprise buyer, run Cyber Essentials first because it is quicker, and build ISO 27001 alongside it. Goldline includes Cyber Essentials readiness support in the ISO 27001 Sprint at no extra charge.
Common mistakes
- Choosing Cyber Essentials because it is quicker, when the customer's questionnaire names ISO 27001 or SOC 2.
- Leaving cloud services or personal devices out of the Cyber Essentials scope. Under v3.3 cloud services cannot be excluded.
- Building ISO 27001 when every current and near-term buyer only asks for Cyber Essentials.
- Treating either as a one-off. Cyber Essentials is renewed every year, and ISO 27001 has surveillance audits every year.
Not sure which?
Look at what the buyer actually wrote: the questionnaire, the tender clause or the email. Bring it to the free 45 minute diagnostic and you will leave with a one-page roadmap. See what ISO 27001 costs, Cyber Essentials readiness and the ISO 27001 Sprint.