Introduction
In the year 2022, many companies still find themselves asking this ever-important question: “Do I need Cyber Essentials or ISO 27001?”
The short answer to the above is this:
Cyber Essentials protects your data and systems on local networks, servers, computers and other elements within your IT infrastructure. ISO 27001 takes into consideration every piece of information pertaining to your company, be it paper-based information or digital information stored on information systems and digital media.
However, it’s worth noting that there’s a lot more to these two cyber security standards, so arming yourself with the right information should help answer “Do I need cyber essentials or ISO 27001?” more faithfully and comprehensively.
What is Cyber Essentials?
Cyber Essentials certification has become one of the most common and popular ways of enabling businesses to protect their data and systems from everyday cyber threats. Cyber attacks are becoming increasingly common and more sophisticated, with many companies falling victim to attacks without warning. Cyber Essentials can help protect businesses against a variety of common cyber attacks.
In order to achieve certification, five key controls must be implemented:
• Secure devices and software
• Secure internet connection
• Virus and malware protection
• Controlled access to company data and services
• All devices and software up-to-date
What is ISO 27001?
ISO 27001 certification is designed to help businesses comply with the international standard for information security. The certification was first introduced in 2005 and defines what businesses need for the establishment, maintenance, and improvement of their Information Security System.
Many organisations choose ISO 27001 over Cyber Essentials as they benefit from the best practice set by its standards. Clients also get reassurance that the recommendations set out by these standards have been strictly followed in terms of cyber security.
What are the key differences?
Cyber Essentials is ideal for businesses of all sizes that wish to implement just the basic cyber security measures, whereas ISO 27001 is suitable for all organisations in any industry who want to keep every piece of information on their assets secure.
Where the Cyber Essentials scheme has five controls to protect businesses, ISO 27001 has 10 clauses along with 114 generic security controls grouped into 14 unique sections (referred to as “Annex A”).
For suppliers bidding on UK Government contracts where the handling of sensitive and personal information comes into play, Cyber Essentials is a must. As for ISO 27001, some businesses achieve the Standard merely in order to benefit specifically from the best practice it contains – while others achieve it to reassure their clients that the Standard’s recommendations have been strictly followed.
Which is best for my business?
In conclusion, you need to carefully consider the requirements of your business.
Our cyber security experts may initially recommend Cyber Essentials to help you implement some basic controls for protection against common cyber attacks – and then make you ISO 27001 compliant to help you enjoy the full extent of the Standard.
Get in touch with us now to understand the full scope of both services, and so we can guide you through the process of complying to these standards.
Back to resources
