Both prove you take security seriously. They're not competing options for the same job - they're different tools answering different questions, and most UK small businesses only need one of them at a time. Here's how to tell which.
If a client, tender or insurer named a specific framework, that answers the question for you. If nobody has yet, the difference below usually makes the choice obvious.
You want the UK Government-backed baseline on its own - proof of five fundamental technical controls, achievable in weeks, at a cost that makes sense for a small business. It's very often the actual minimum bar for UK government contracts and cyber insurance applications.
An enterprise client, public sector tender, or your cyber insurer has specifically asked for it, or you're entering a market where a certified Information Security Management System is expected as standard. It's a materially bigger undertaking, and worth it when something concrete depends on having it.
| Cyber Essentials (/ CE+) | ISO/IEC 27001:2022 | |
|---|---|---|
| What it is | A UK Government-backed checklist against five technical controls | An international standard for an ongoing Information Security Management System (ISMS) |
| Scope | 5 technical control areas: firewalls, secure configuration, access control, malware protection, patch management | 93 Annex A controls across organisational, people, physical and technological security |
| How it's verified | Self-assessed questionnaire (Cyber Essentials), or self-assessment plus independent technical testing (CE+) | Formal two-stage audit by a UKAS-accredited certification body |
| Typical timeline | 2-4 weeks | Several months, depending on how much of the ISMS already exists |
| Renewal | Annual re-certification | Annual surveillance audits, full recertification every three years |
| Who usually asks for it | UK government contracts, many cyber insurers, general good-practice baseline | Enterprise vendor risk assessments, public sector procurement, international clients |
The two frameworks aren't mutually exclusive, and doing Cyber Essentials first isn't wasted effort even if ISO 27001 is somewhere on your roadmap. The five Cyber Essentials technical controls overlap with several ISO 27001 Annex A controls, so an earlier Cyber Essentials certification gives your later ISMS a genuine head start rather than starting from zero.
The common pattern: get Cyber Essentials (or CE+) in place quickly to satisfy an immediate requirement and establish the baseline, then move to ISO 27001 later when a specific enterprise client, tender or market genuinely calls for it - not before.
Neither framework is issued by us. Certification for both comes from an independent body - a UKAS-accredited certification body for ISO 27001, and an approved Cyber Essentials certification body for CE/CE+.
What we provide either way is the same: the full, audit-ready documentation set built from your real answers, kept current as your business changes - not the certification itself, and not the underlying technical controls, which stay with you or your IT provider.
The Cyber Assurance Policy Pack covers ISO 27001, CAF and Cyber Insurance documentation together. If you only need the Cyber Essentials baseline, the smaller, separate Cyber Essentials / CE+ package covers exactly that, and nothing more.
Tell us what a client, tender or insurer has asked for, and we'll point you at the right package.