Can ISO 27001 replace Cyber Essentials in a UK tender?

Sometimes, but not always. Many UK public sector tenders specifically require CE regardless of other certifications. Check the tender wording – the cheapest path is usually to hold both.

Do I need Cyber Assurance if I already have CE Plus?

Not unless a buyer asks. CE Plus covers technical controls verified by audit. Cyber Assurance covers people, process and governance on top of CE.

Which gives the most credibility for investors?

ISO 27001 carries the most international weight. For UK seed and Series A, CE + CA is usually plenty. For Series B+ or international expansion, plan ISO.

Are any of these legally required?

No general legal requirement today. However the upcoming CSR Bill and existing sector rules (FCA, DSPT, MoD DEFCON) reference cyber baseline expectations CE satisfies.

How long does the full CE → CA → ISO journey take?

Realistically 12–18 months for a focused SME. Most spend Q1 on CE, Q2 on Cyber Assurance, then 6–9 months building the ISMS for ISO 27001 Stage 1 audit.

Cyber Essentials vs Cyber Assurance vs ISO 27001: Which Route?

What each one actually proves

Cyber Essentials

Five technical controls verified by self-assessment, reviewed by an IASME-licensed assessor. Proves you have the technical baseline that blocks the most common opportunistic attacks.

IASME Cyber Assurance

14 themes across 4 areas covering people, process, technology and risk. Includes CE as a mandatory prerequisite plus governance evidence – policies, risk register, business continuity. See the 14 themes deep dive.

ISO 27001

A full Information Security Management System (ISMS) audited by a UKAS-accredited certification body. Continual improvement cycle, internal audits, management reviews, documented controls against Annex A. International recognition.

Side-by-side comparison

	Cyber Essentials	Cyber Assurance	ISO 27001
Typical cost	£320–£600 + VAT	£1.8k–£5k + VAT	£15k–£40k all-in
Time to certify	1–2 weeks	4–8 weeks	6–12 months
Audit type	Self-assessment + assessor review	Assessor desk review (L1) or audit (L2)	Stage 1 + Stage 2 + surveillance
Renewal	Annual	L1 annual, L2 every 3 yrs	3-year cycle + annual surveillance
Tender weight	Public sector baseline	Mid-market, regulated SMEs	Enterprise, international
Internal audit needed	No	No (L2 has external)	Yes, recurring
UK-only	Yes	Yes	International

Decision tree

Have you been asked by a UK buyer or grant funder? Start with CE.
Are buyers also asking about policies, risk register, BCP? Add CA.
Are you selling to enterprises, regulated sectors or internationally? Move to ISO 27001.
Are you only being asked once a year by one customer? CE alone may suffice.
Are you holding sensitive personal data at volume? Aim at CA minimum.

The trap: skipping straight to ISO 27001

We regularly see SMEs commit £30k to ISO 27001 before they have CE. The result is an ISMS built on a technical baseline that has never been independently checked. CE first, CA second, ISO third is the cheaper, faster, more defensible sequence.

What about NIS2, DORA, CSR Bill?

The forthcoming UK Cyber Security and Resilience Bill raises the floor for regulated sectors and their suppliers. Even where the new law applies, CE remains the practical baseline and CA the governance layer. ISO 27001 is a sufficient – often more than sufficient – way to evidence the duty for larger organisations.