Most UK businesses need Cyber Essentials first, because it is the government-backed baseline that public sector and many private buyers check for. Add ISO 27001 when customers or tenders want proof that you manage security as an ongoing, audited system. SOC 2 is usually only needed when US customers, or buyers who follow US practice, ask for it by name.
The three are often listed side by side in procurement questionnaires, so it is easy to assume they are rival versions of the same thing. They are not. Each answers a different question, is assessed by a different kind of organisation and suits a different stage of growth. This guide compares them so you can decide which one to pursue now and which can wait.
Executive Summary & Key Takeaways
- Cyber Essentials checks five technical controls. ISO 27001 certifies a whole information security management system. SOC 2 is an auditor’s report on your controls, not a certificate.
- None of the three is required by UK law. They become necessary through contracts, tenders and customer due diligence.
- Cyber Essentials has fixed published fees for the basic level and renews every 12 months. ISO 27001 runs on a three-year audit cycle. SOC 2 is issued by a licensed CPA firm.
- Only 5% of UK businesses reported holding Cyber Essentials, rising to 35% of large businesses, so certification still sets you apart in many supply chains.
- The controls overlap heavily. Building once and mapping to each framework is far cheaper than running three separate projects.
The short answer: three different kinds of proof
| model | Cyber Essentials | ISO/IEC 27001:2022 | SOC 2 |
|---|---|---|---|
| What it is | UK government-backed certification of five technical controls | International standard for an information security management system (ISMS) | US attestation report on controls relevant to security and up to four other categories |
| Who sets it | NCSC, delivered by IASME | ISO and IEC | AICPA |
| Who assesses you | IASME-licensed certification body | Accredited certification body (in the UK, ideally UKAS-accredited) | Licensed CPA firm |
| What you receive | Certificate | Certificate | Report (Type 1 or Type 2) |
| How long it lasts | 12 months | Three-year cycle with annual surveillance audits | Covers a point in time (Type 1) or a period (Type 2) |
| Typical trigger | UK public sector contracts, supplier checks, insurance | Enterprise and regulated customers, tenders, international buyers | US customers and US-style procurement |
Cyber Essentials: the UK baseline
Cyber Essentials is the minimum standard of cyber security the government recommends for organisations of all sizes. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection (NCSC, retrieved 16 October 2026). The basic level is a verified self-assessment signed off by a board member. Cyber Essentials Plus adds a hands-on technical audit of the same controls.
IASME publishes fixed fees for the basic level, set by organisation size: £320 + VAT for micro organisations (0 to 9 employees), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250 or more). Cyber Essentials Plus is quoted individually because it depends on the size and complexity of your network. Both levels expire after 12 months (IASME, retrieved 16 October 2026).
For central government work, Cabinet Office Procurement Policy Note 014 requires suppliers bidding for certain higher-risk contracts to hold Cyber Essentials or Cyber Essentials Plus, or show equivalent controls, before award (Cabinet Office, retrieved 16 October 2026). Our Cyber Essentials service page covers the certification process itself.
ISO 27001: a management system you can certify
ISO/IEC 27001:2022 sets out requirements for establishing, implementing, maintaining and continually improving an ISMS. It is the world’s best-known standard of its kind, with over 70,000 certificates reported in 150 countries in the ISO Survey 2022 (ISO, retrieved 16 October 2026).
Where Cyber Essentials asks “are these five controls in place?”, ISO 27001 asks “do you run security as a managed process?” You define a scope, assess risks, choose controls from a reference set of 93, and prove through internal audits and management reviews that the system works and improves. An independent certification body audits you, then returns for surveillance audits in the following years. Whether that effort pays off for a smaller firm is covered in our article on whether ISO 27001 is worth it.
SOC 2: an attestation report for service organisations
SOC 2 is an examination of a service organisation’s controls relevant to security, availability, processing integrity, confidentiality or privacy, performed under AICPA standards (AICPA, retrieved 16 October 2026). Security is always in scope; the other four categories are added where they are relevant to your service. The output is a CPA firm’s opinion, with a detailed description of your system and, in a Type 2 report, the auditor’s tests and results.
Because SOC 2 is a US framework, UK companies usually meet it through a US customer’s procurement process. We cover when it is genuinely needed, and the alternatives, in Do UK companies need SOC 2?.
How to decide: start with who is asking
The fastest way to choose is to look at who is asking for proof and what they will accept.
- A UK government department or NHS body. Cyber Essentials, or Cyber Essentials Plus if the contract specifies it. ISO 27001 will not replace it where the tender asks for Cyber Essentials by name.
- A large UK or European enterprise, bank or insurer. ISO 27001 is the credential most procurement teams recognise. Many will also expect Cyber Essentials as a baseline.
- A US customer or a US-headquartered buyer. Ask directly whether they require SOC 2 or will accept an ISO 27001 certificate. Some accept either; others have SOC 2 written into their vendor policy.
- Your insurer or board. Neither is likely to insist on a particular framework, but Cyber Essentials gives a clear, independently checked baseline and ISO 27001 shows governance and risk management.
- Nobody yet. Start with Cyber Essentials. It is affordable, fast and fixes the controls that stop the most common attacks.
If you sell to several of these audiences, you will probably end up with more than one. That is normal, and the order matters more than the total.
How they fit together
The three frameworks are layered, not competing. A sensible sequence for most growing UK businesses looks like this:
- Cyber Essentials to put the five technical controls in place and evidence them.
- ISO 27001 when the business needs a formal, audited management system around those controls: risk assessment, policies, supplier management, incident response and continual improvement.
- SOC 2 if and when a US customer requires it, reusing the ISO 27001 controls and evidence.
The overlap is substantial. The AICPA publishes its own mapping between the Trust Services Criteria used in SOC 2 and ISO 27001 (AICPA, retrieved 16 October 2026). In our experience, a well-run Cyber Essentials programme also covers much of the technical ground an ISO 27001 auditor will look at. A single control register, mapped outward to each framework, means each policy, access review and patch record counts several times. That mapping is the core of our compliance support work.
What drives effort and cost
No two programmes cost the same, but the drivers are predictable:
- Scope. The number of people, sites, cloud services and products covered. A tightly scoped ISO 27001 certificate or SOC 2 report costs less than an organisation-wide one.
- Starting point. If Cyber Essentials controls are already in place, ISO 27001 and SOC 2 build on them rather than starting from scratch.
- Evidence period. A SOC 2 Type 2 report needs controls to operate over a period before the auditor can test them, which sets a minimum timeline.
- Assessor fees. Cyber Essentials basic has fixed published fees. Cyber Essentials Plus, ISO 27001 certification audits and SOC 2 examinations are quoted.
- Internal time. Often the largest cost. Someone has to own policies, collect evidence and answer auditor questions.
Falx is not a certification body or a CPA firm. We prepare organisations for these assessments; the certificate or report always comes from an independent body.
Common mistakes
- Treating ISO 27001 as a substitute for Cyber Essentials in public sector bids. If the tender asks for Cyber Essentials, provide Cyber Essentials or evidence of equivalent controls as the PPN allows.
- Pursuing SOC 2 because it sounds more rigorous. It is the right answer only when your customers ask for it. For most UK buyers, ISO 27001 carries more recognition.
- Running three separate projects. Separate spreadsheets, owners and evidence stores triple the work and drift out of step.
- Scoping too broadly too early. Certifying the whole group when customers only buy one product delays the result and raises the cost.
- Forgetting renewal. Cyber Essentials lapses after 12 months and ISO 27001 surveillance audits arrive every year. Plan the ongoing effort, not just the first certificate.
Frequently asked questions
Does holding ISO 27001 mean we also meet Cyber Essentials?
Not automatically. ISO 27001 lets you choose controls based on your own risk assessment, while Cyber Essentials sets specific technical requirements, such as removing unsupported software. A well-run ISMS usually covers most of them, but you still need to certify separately if a customer or tender asks for Cyber Essentials.
Will a US customer accept ISO 27001 instead of SOC 2?
Sometimes. Some US buyers accept an ISO 27001 certificate with a clear scope and Statement of Applicability, while others require SOC 2 under their vendor policy. Ask early in the sales process, before committing to a SOC 2 examination.
Can we work towards all three at the same time?
Yes, if one team owns a single control set mapped to each framework. In practice most businesses certify to Cyber Essentials first, because it is quick, then build ISO 27001 and SOC 2 on the same evidence. Running them in parallel without a shared control map is where cost and confusion grow.
Do any of these satisfy UK GDPR on their own?
No. UK GDPR requires appropriate technical and organisational measures to protect personal data, and these frameworks are strong evidence of that. They do not cover lawful basis, data subject rights, retention or the other data protection duties, which need their own work.
Getting started
If you are not sure which framework your customers will accept, start by listing who is asking and what they have written into contracts and tenders. That usually settles the order. Our compliance support team can map your current controls against Cyber Essentials, ISO 27001 and SOC 2 and show you the shortest path to each. Talk to our team to discuss your situation.
Ashley Argyle
Writing about cyber security and technology at Falx.
