Cyber Essentials or ISO 27001: which should you tackle first?
Two very different standards, often asked for in the same tender. Here’s how they compare and where to start.
Both standards show customers you take security seriously, but they work in very different ways. Understanding the difference helps you spend effort in the right order.
Cyber Essentials
Cyber Essentials is a UK government-backed scheme focused on five technical controls: firewalls, secure configuration, user access control, malware protection and security update management.
Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same controls but adds hands-on technical testing by an assessor. Certification is renewed every year, and it’s a requirement for many public-sector contracts.
ISO 27001
ISO/IEC 27001 is an international standard for an information security management system (ISMS). Rather than a fixed checklist, it asks you to assess your own risks, choose appropriate controls and show that you manage and improve security continuously.
Certification is issued by an accredited certification body after an external audit, with surveillance audits in the following years. It takes more time and commitment than Cyber Essentials, and it’s often requested by larger enterprise and financial-services customers.
Which comes first?
For most organisations, Cyber Essentials first. It fixes the technical basics that stop the majority of common attacks, it’s quicker to achieve, and much of the work carries straight into ISO 27001 later.
Go straight to ISO 27001 if a key customer or contract requires it, or if you handle sensitive data at scale and need a formal management system now. Even then, the Cyber Essentials controls are a sensible early milestone.
Getting started
A short gap analysis against both standards shows where you are today and what it would take to reach each one. From there, you can plan the work in the order that suits your contracts and budget.
