Question 1

A customer is asking for ISO 27001. What do I actually need to do?

Accepted Answer

You need an information security management system covering the 93 controls in Annex A of ISO/IEC 27001:2022, evidence that those controls operate, and an audit by an accredited certification body. Most firms start with a gap analysis to find out which controls they already meet. Many customers will accept Cyber Essentials plus a remediation plan while ISO 27001 is in progress, so it is worth asking what they will accept before committing to the full standard.

Question 2

How long does Cyber Essentials take?

Accepted Answer

The self-assessment itself can be completed in days. The work is usually in fixing what the questions expose, most often multi-factor authentication on cloud services and applying critical security updates within 14 days. A business with reasonable IT hygiene is typically ready in two to four weeks. A business starting from scratch should plan for six to eight.

Question 3

Do I need Cyber Essentials or ISO 27001?

Accepted Answer

Cyber Essentials is a UK government-backed scheme covering five technical controls. It is the usual requirement for Scottish public sector contracts and it cascades down to sub-contractors. ISO 27001 is a full management system standard covering 93 controls including governance, people and suppliers, and is more commonly demanded by large private-sector customers. If a tender or customer has named one, start there. If nobody has named one, Cyber Essentials is almost always the right first step.

Question 4

What changed in Cyber Essentials in 2026?

Accepted Answer

Version 3.3 took effect on 26 April 2026. Multi-factor authentication is now mandatory on all cloud services where it is available, and its absence is an automatic failure. Critical and high severity updates must be applied within 14 days for operating systems and firmware (question A6.4) and for applications (A6.5), and failing either is also an automatic failure. Cloud services can no longer be excluded from scope, and the scheme now encourages passwordless methods such as passkeys.

Question 5

We have been sent a supplier security questionnaire. Can you help?

Accepted Answer

Yes. A security questionnaire is usually a subset of the same controls as Cyber Essentials or ISO 27001. We assess you against the full control set, tell you which answers you can already evidence, and give you a prioritised list of what to fix before you respond. That is normally faster and cheaper than answering the questionnaire blind and being rejected.

Question 6

Do Scottish public sector contracts require Cyber Essentials?

Accepted Answer

Cyber assurance is embedded in the Scottish Government Procurement Journey and in model contract terms, and the requirement cascades to sub-contractors. If you supply a prime contractor on a Scottish public contract and handle relevant data or systems, you may be asked to certify even though your contract is not directly with a public body.

Question 7

Do you issue the certificate?

Accepted Answer

No, and be cautious of anyone who says they do. Cyber Essentials certification is issued by an IASME-accredited certification body, and ISO 27001 certification by an accredited certification body. We get you ready for that assessment and support you through it. Keeping readiness and certification separate is also what keeps the assessment independent.

A customer has asked for Cyber Essentials or ISO 27001. We tell you exactly what you are missing.

Most people call us on one of these days

A customer sent a security questionnaire

A tender demands Cyber Essentials

A large customer wants ISO 27001

We assess the full control set

Cyber Essentials

ISO/IEC 27001:2022

SOC 2

UK GDPR

What you receive

Control-by-control gap analysis

Prioritised remediation plan

Evidence request list

What we are, and what we are not

Common questions

Know what you are missing before your customer does