Cyber Essentials (UK) vs. ISO 27001

Why is it that even in Europe, there are several variants of certification to be considered a secure company? How to keep track? Let's take a look at the United Kingdom....

What is the difference between the UK’s Cyber Essentials and the international standard ISO 27001?

Difference between Cyber Essentials and ISO 27001​​

Cyber Essentials is a UK certification scheme designed to demonstrate that an organization has a minimum level of cyber security. This is done through annual assessments to maintain certification. Cyber Essentials was developed by the National Cyber Security Centre (NCSC), supported by the UK government and also overseen by the NCSC. It is the UK government's answer to a safer cyberspace for businesses of all sizes and industries.

Cyber Essentials is also an industry-backed program designed to help businesses protect themselves against cyber-attacks and makes a clear list of the basic controls businesses should put in place to protect themselves.

And it is also revealed  that Gaining Cyber Essentials certification enables organizations to showcase their credentials as trustworthy and secure when it comes to cyber security. So, the companies have proven measures in place to protect sensitive information such as financial and customer data from the most common cyber attacks. Sounds familiar, right? So why not ISO 27001, because ISO 27001 is the internationally recognized standard for information security.

In Detail: Cyber Essentials is a basic certification that provides a statement of the basic controls your organization should put in place to mitigate the risk of common cyber threats. Cyber Essentials BASIC is a self-certification. This means that you will be asked to answer a questionnaire (with supporting documents). The application will be audited by IASME (Information Assurance for Small and Medium Enterprises Consortium). IASME became the National Cyber Security Centre’s Cyber Essentials Partner, responsible for the delivery of the scheme from April 1st 2020. IASME Governance is an information security standard that is particularly relevant for SMEs that want to demonstrate their commitment to cybersecurity without incurring the cost and complexity of ISO 27001 certification. The standard also meets certain GDPR requirements.

Cyber Essential PLUS is like an upgrade, it still has the simple approach of Cyber Essentials, and the protections you need to take are the same, but this time an auditor performs a technical audit of your systems to verify that the Cyber Essentials controls are in place.

Cyber Essentials is an effective, government-backed minimum standard program that helps organizations protect their data and programs from cyberattacks of all types and sizes, lasts for 12 months and is also, like ISO 27001, not mandatory for everyone.

‍

ISO 27001 on the other hand, supports companies that want to comply with the international standard for information security.

The certification specifies what an organization must do to establish, implement, maintain and continuously improve an information security system.

At this point, we recommend you read our Cybersecurity vs. Information Security blog to understand the difference between these two certifications!

‍

ISO 27001 certification takes into account all information, whether it is paper, information systems or digital media. It is a comprehensive assessment of an entire organization's ability to securely manage information in all contexts. Cyber Essentials, on the contrary, protects IT infrastructure data, such as programs in networks, computers, servers and other elements of the IT infrastructure.

Avoiding cyber attacks vs. Building a complete information security system. Something to think about.  

As a result, many organizations choose ISO 27001 certification because they can benefit from the best practices contained in the standards. Customers and clients can therefore be confident that the recommendations of the standard will be followed.

ISO 27001 provides the framework for managing information security

Although ISO 27001 has more security elements than Cyber Essentials, organizations are not required to have ISO 27001 when working with the UK public sector. Even though Cyber Essentials and ISO 27001 have different requirements, the two should be viewed as complements, not competitors.