Pass the audit, and mean it.
Almost nobody starts this for fun. A tender asks, an insurer asks, or a customer's procurement form lands on your desk. I take organisations through Cyber Essentials, Cyber Essentials Plus and ISO 27001, either as a consultant pointing your own team at the right work, or as the hands-on implementer who goes and does it.
The baseline
Self-assessment · verified by a certification body
The five controls every UK business is expected to have, answered honestly and backed by evidence. This is the certificate most tenders and insurers are actually asking for.
- The five controls mapped to what you really run
- Firewalls, secure configuration, user access control
- Patching and malware protection, on every device
- The questionnaire answered in plain English
- Gaps closed before you submit, not after you fail
Typically 2 to 4 weeks
The five controls, explained Cyber Essentials PlusThe same, tested
Hands-on audit · your real devices
The identical five controls, except an assessor now tests a sample of your actual laptops, phones and servers. Nothing here can be rounded up on a form.
- A dry run on your own machines first
- Devices brought up to standard, not just listed
- Device management, patching and accounts sorted
- Evidence gathered the way the assessor wants it
- Someone who knows the test, there on the day
Within 3 months of your Cyber Essentials pass
What the audit day involves ISO 27001The whole system
Full ISMS · Stage 1 and Stage 2
An information security management system built to survive the audit, the surveillance visits after it and the staff changes in between, rather than a folder of templates with your logo dropped on the front.
- Scope, context and the Statement of Applicability
- Risk assessment and a treatment plan you can defend
- Annex A controls applied to how you actually work
- Internal audit and management review, run properly
- Documentation your team will still be using next year
- Stage 1 and Stage 2 supported end to end
Typically 4 to 9 months
How an ISMS gets builtStart by working out what you were asked.
A surprising amount of money gets spent on the wrong certification, because a procurement form said the words information security and somebody reached for the biggest standard they had heard of. The two are a long way apart in effort and they answer different questions.
Cyber Essentials is a government-backed baseline: five technical controls, a self-assessment questionnaire, verified by a licensed certification body. It is the thing most UK tenders, most insurers and most larger customers are genuinely asking for, and it takes two to four weeks.
ISO 27001 is a management system. It is not a checklist of technical controls but a structure for deciding which risks matter to your business, doing something about them, and proving that the deciding and the doing keep happening after the auditor leaves. Four to nine months, for most small and medium businesses.
If you are not sure which one you have been asked for, forward me the form. It is a five minute answer and it occasionally saves people several months.
Rough rules of thumb
- A UK public sector tender. Usually Cyber Essentials, sometimes Plus. ISO 27001 appears in larger or more sensitive contracts.
- An insurer asking before renewal. Almost always Cyber Essentials.
- A large customer's supplier questionnaire. Often either, and often they will accept Cyber Essentials Plus in place of ISO 27001 if you ask.
- You handle other people's personal data at scale. ISO 27001 starts to earn its cost, and it is a better answer than a stack of individual assurances.
- You are going for both. Cyber Essentials first. The work overlaps, and it gets you something to show while the longer piece runs.
Point your team at it, or hand it over.
Both of these are real options and the right one depends on whether you have somebody with the time. Picking honestly at the start is cheaper than discovering in week six that nobody had the time after all.
As a consultant
- The gap analysis first. Where you are against where the standard needs you to be, written in plain words rather than a spreadsheet of control numbers.
- Your team does the work. I set the direction, write the policies and review what comes back, before anybody submits it.
- Evidence that holds up. You find out what an assessor will ask for, and what a good answer looks like, while there is still time to go and get one.
- On the phone through the audit. Including the awkward questions, and the ones nobody prepared for.
As a hands-on implementer
- I do the work. Firewalls, device management, patching and access control configured by me, not handed over as a to-do list for somebody who already has a job.
- Policies written, not templated. About how your business actually runs, so your staff can follow them without a translator.
- Remediation finished. Whatever the gap analysis turns up gets fixed, rather than logged and carried forward to next year.
- Handed over working. You own it at the end, and somebody in your team knows how it runs.
- How it is priced
- Scoped, then fixed
- Two businesses the same size can be a month apart on this, so it starts with a short call and a look at what you actually run. Then a fixed number, because an estimate that drifts is no use to anyone working to a tender deadline.
- The certificate
- Paid direct, not marked up
- Cyber Essentials is issued through IASME, and ISO 27001 by an accredited certification body. You pay their fee direct, at their price. My job is making sure you pass first time.
- If there is a deadline
- Say so in the first email
- A contract award date or a renewal changes the order the work gets done in, and occasionally changes which certification is worth going for at all. Much better known at the start than found out in week three.
This is the same standard I hold my own client work to: the business systems on this site are built to these controls rather than retrofitted to them once somebody asks. If a form has landed on your desk and you are not sure what it is really asking for, send it over and I will tell you.
Will my data be used to train an AI model?
No. Your customer data is not used to train anything, and that is a configuration decision made when the integration is built rather than a promise in a brochure. You get it in writing, along with a plain list of which tools are involved, what each one sees and where it runs. If a question about this turns up on a procurement form later, the answer already exists.
Can you get us Cyber Essentials certified?
Yes, and Cyber Essentials Plus too. I have taken organisations through both. You can have me as a consultant, setting the direction, writing the policies and reviewing what your team produces, or as a hands-on implementer who configures the firewalls, the device management, the patching and the access control myself. The certificate is issued through IASME by a certification body and you pay their fee direct, so my part is making sure you pass it first time. Cyber Essentials usually takes 2 to 4 weeks, and Cyber Essentials Plus has to follow within 3 months of it.
Do you do ISO 27001 implementation?
Yes, and I have taken organisations through it before. It is a full information security management system rather than a document pack: scope and context, the risk assessment and treatment plan, the Statement of Applicability, the Annex A controls applied to how your business actually works, and the internal audit and management review an auditor will ask to see. For most small and medium businesses it runs 4 to 9 months to Stage 2. The certification audit itself comes from an accredited certification body rather than from me, so the evidence has to stand up on its own.
Are you a certification body or an assessor?
No, and it is worth being clear about it. Cyber Essentials certificates are issued through IASME by a licensed certification body, and ISO 27001 certificates by an accredited certification body. I am the person who gets you ready for them, and in the hands-on version the person who does the work that gets you ready. You pay the certifying body their fee direct, at their price, with nothing added by me. Anybody who implies they can both prepare you and hand you the certificate is worth a second question.
We have a tender deadline. Can you work to it?
Often, yes, and the date belongs in the first email rather than week three. Cyber Essentials is usually 2 to 4 weeks, so a tender closing next month is realistic. Cyber Essentials Plus has to follow within 3 months of the Cyber Essentials pass, which fixes the order those two happen in. ISO 27001 is 4 to 9 months for most small and medium businesses, so if a contract closes in six weeks and the form asks for ISO 27001, the useful conversation is about what you can honestly say by then, not about compressing a management system into a fortnight.
Send me
the form.
If a tender, an insurer or a customer has asked you for something and you are not sure what it really means, forward it. I will tell you which certification it is actually asking for, whether your deadline is realistic, and what it would take to get there.
dave@daveellis.devEdinburgh · Working with businesses across Scotland, the UK and worldwide