Title: ISO 27001 vs Cyber Essentials: the differences

> ISO 27001 and Cyber Essentials are not interchangeable: what each certifies, who assesses it, and how to read a UK tender requirement.

Source: https://aegentra.co.uk/knowledge/iso-27001-and-cyber-essentials  
Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT.  
Published: 2026-10-21  
Updated: 2026-10-25  
Licence: public web content; cite the source URL.

Decision guide

# ISO 27001 and Cyber Essentials are not interchangeable.

Start with the actual requirement in your customer or tender document.

By [Harry Sidhu](https://aegentra.co.uk/about#director) — ISO 27001 Lead Implementer · Director and Principal Consultant, AegentraPublished 21 October 2026 · Updated 25 October 2026

## Read the requirement first

Before selecting a route, identify the exact certificate or evidence requested, the relevant legal entity, the systems in scope and any deadline. Do not substitute one certificate for another without acceptance from the requesting party.

## Different purposes

ISO 27001 addresses an information security management system. Cyber Essentials focuses on five technical-control areas. NCSC explains that Cyber Essentials Plus additionally involves independent testing of those controls.

## Agree what your project must deliver

A useful scoping discussion records the requirement, current evidence, chosen route and exclusions. Neither a generic policy pack nor a training certificate answers every organisational security requirement.

If the requirement is ISO 27001, remember that Clause 9.2 also expects an internal audit of the management system before certification and throughout the cycle. Our [ISO 27001 internal audit service](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) is scoped and priced separately from implementation.

Primary reference: [NCSC Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview)

[Explore services](https://aegentra.co.uk/services)

[Explore courses](https://aegentra.co.uk/academy)