Cyber Essentials vs ISO 27001 Information Security

Cyber Essentials is a UK government-backed scheme that protects organisations from common online threats. Its primary goal is to establish a foundation of basic cybersecurity measures. The framework focuses on five key areas:

1. Firewalls: protecting your internet connection from unauthorised access.   
2. User access control: limiting access and permissions to reduce the risk of unauthorised access.
3. Malware protection: implementing measures against malware including viruses, ransomware, and other malicious software. 
4. Updating software and devices: keeping software and devices up to date with the latest security updates to address known vulnerabilities.
5. Secure configuration: ensuring the most secure settings for your devices and software.    

There are two levels of certifications:

1. Cyber Essentials: this is the basic level of certification and involves you completing a self-assessment questionnaire that demonstrates you have effective cyber security measures in place. This is then reviewed by a certified Cyber Essentials assessor. 
2. Cyber Essentials Plus: this is the enhanced level which encompasses the same set of controls as the basic level. However, a certified Cyber Essentials assessor will conduct an audit to prove your cyber controls are implemented and functioning as expected. This provides additional assurance to both you and your stakeholders. 

Cyber Essentials Plus must be achieved within three months of your self-assessment for Cyber Essentials.