ISO 27001 vs Cyber Essentials: what's the difference?

Cyber Essentials is the UK Government-backed scheme that checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. ISO 27001 is an international standard for a whole information security management system: risk assessment, policies, people, suppliers and physical security as well as technology, with annual external audits. Many businesses hold both.

What does ISO 27001 cost?

There's no standard price, because the work depends on your scope. We give you a fixed-price quote after a 30-minute scoping call. The certification body's audit fees are separate, depend on your size and complexity, and are quoted by them.

Do we need Cyber Essentials first?

No. ISO 27001 doesn't require Cyber Essentials, and you can certify to it on its own. If you already hold Cyber Essentials, the five controls it checks give you a head start on some of the technological controls in Annex A.

Is ISO 27001:2013 still valid?

No. Under IAF MD 26, all certifications to ISO/IEC 27001:2013 had to expire or be withdrawn at the end of the transition period on 31 October 2025, and new certifications have had to be to the 2022 edition since 30 April 2024. If a supplier shows you a 2013 certificate, it is no longer current.

An independent certification body accredited for ISO/IEC 27001. In the UK, accreditation comes from UKAS, and you can check a body's accreditation in the UKAS directory. Certification bodies manage the conflict between consultancy and certification, so the organisation that helps you implement the ISMS and the one that certifies it will be different. We are a consultancy, not a certification body.

ISO 27001 consultants for UK businesses

ISO 27001 certification, done properly

ISO/IEC 27001 is the international standard for an information security management system: the risk process, policies and controls an organisation uses to keep its information safe, and the evidence that they work. We're UK ISO 27001 consultants who help small and growing businesses build one that holds up when a customer, an investor or a certification body looks behind the certificate.

Book a 30-minute call

What ISO 27001 is, and who asks for it

ISO/IEC 27001:2022 is the current edition of the standard for an information security management system (ISMS). ISO published it on 25 October 2022, replacing the 2013 edition (IAF MD 26). It sets out what an organisation must do to establish, operate, maintain and continually improve an ISMS: understand its context, show leadership, assess and treat information security risk, support the system with people and documents, run it, measure it and fix what it finds.

It is a management system standard. It doesn't hand you a fixed checklist; it makes you work out your own risks, choose controls to treat them and keep the evidence.

In our experience, three groups ask:

Enterprise customers. Security questionnaires get shorter when you can show a certificate and a scope that covers the service they're buying.
Tenders. Public and private sector bids often ask whether you hold ISO 27001, or score you higher if you do.
Investors. Technical due diligence looks at how you protect customer data. A working ISMS answers most of those questions before they're asked.

ISO 27001 vs Cyber Essentials

They answer different questions, and many businesses end up with both.

Cyber Essentials is the UK Government-backed minimum standard, developed by the NCSC. It checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus tests the same controls independently on your systems (NCSC). We compare the two in Cyber Essentials vs Cyber Essentials Plus.

ISO 27001 covers the whole management system: risk assessment, policies, supplier management, people, physical security and incident handling as well as technology, with leadership accountable for it and an external audit every year. It takes longer and costs more, and it tells a customer much more about how you run security.

If a customer has only asked for Cyber Essentials, start there. If they've asked for ISO 27001, Cyber Essentials won't substitute for it. Our guide to cyber assurance for small businesses sets out which one your customer is actually asking for.

What ISO 27001 certification involves

The 2022 edition follows the harmonised structure shared by ISO management system standards, and its Annex A now lists 93 controls, down from 114 in the 2013 edition (IAF MD 26), grouped into four themes: organisational, people, physical and technological. In practice, ISO 27001 implementation and certification look like this.

Set the scope. Decide which parts of the business, which locations, services and systems the ISMS covers. Scope is what appears on the certificate and what customers check, and it drives the cost and length of the external audit.
Assess and treat risk. Run an information security risk assessment, then decide how to treat each risk and record it in a risk treatment plan.
Write the Statement of Applicability. Compare the controls you've chosen with the reference set in Annex A, so nothing necessary is left out, and record which controls apply and why in a Statement of Applicability (IAF MD 26).
Implement the Annex A controls. Put the controls in place and make them stick: access control, device management, logging, backup, supplier checks, training and the rest.
Policies and objectives. Agree an information security policy at leadership level, measurable objectives, and the supporting procedures and records the standard asks for.
Internal audit and management review. Audit the ISMS against the standard yourselves, fix what you find, and hold a management review where leadership looks at the results and decides what changes.
Stage 1 and Stage 2 audits. A UKAS-accredited certification body carries out the initial audit in two stages. Stage 1 reviews your ISMS documentation, scope and understanding of the standard; Stage 2 assesses whether the ISMS is implemented and effective. Certification follows once any nonconformities are addressed.
Surveillance and recertification. Certification runs on a three-year cycle, with annual surveillance audits and a recertification audit before the end of the cycle (IAF MD 5).

How we work

Step 1

Gap analysis

We look at what you already have against the clauses and Annex A, agree a scope with you, and give you a written gap report and a plan with dates.

Step 2

Implementation

We build the ISMS with your people: the risk assessment, Statement of Applicability, policies and records. For businesses that run on Microsoft, much of the control work lands in Microsoft 365, Entra and Intune, which is where our engineers work every day.

Step 3

Audit support

We run the internal audit, prepare you for management review, help you choose an accredited certification body, and stay with you through Stage 1, Stage 2 and the surveillance audits that follow.

ISO 27001 and ISO 42001 together

If you use or build AI and your customers are asking about that too, ISO 27001 and ISO 42001 share the same harmonised clause structure. One management system can carry both: the same document control, internal audit, management review and corrective action, with AI risk added alongside information security risk. We explain where they overlap, and which to do first, in ISO 42001 vs ISO 27001.

How long does ISO 27001 take?

It depends on scope, and we won't quote a number before we've seen yours. The main factors are how many people, sites and systems are in scope, how much of the control set is already in place, and how quickly your team can make decisions about risk. The external audit has two stages, and the certification body sets the length of its own audits. After the gap analysis you get a plan with dates, so you know before you commit.

What ISO 27001 costs

We don't publish an ISO 27001 price, because the work depends on your scope. After a 30-minute scoping call we give you a fixed-price quote for the gap analysis, implementation and audit support, so the number doesn't move once we start. The certification body's audit fees are separate and quoted by them directly; they depend on the size and complexity of your organisation.

Why &DEV

&DEV is a UK engineering company, founded in 2019 and based in Cambridge. We secure, certify and run the systems businesses depend on, so the people who scope your ISMS also know how to configure the controls it calls for. When you call, you speak to an engineer, not a salesperson. ISO 27001 certification for a small business has to fit the way the business actually works, and we build it that way. We're a consultancy, not a certification body: we prepare you for the audit, and an independent accredited body carries it out.

The team includes:

James Meek, Principal Security Consultant: ISO/IEC 27001 Lead Implementer

Our own certification

Cyber Essentials Plus certified: view &DEV Limited's certificate

&DEV is certified to Cyber Essentials Plus (whole organisation). View the certificate

ISO 27001 questions

Book a 30-minute consultation

Tell us who is asking for ISO 27001 and what you'd want in scope. We'll tell you what certification would involve for you and follow up with a fixed-price quote. Prefer email? Contact us.