ISO 27001 is worth it when a customer, a tender or a regulator requires it, or when you handle data where a breach would end the business. For most other small firms it is an expensive answer to a question nobody is asking yet, and Cyber Essentials gets you most of the security benefit for a fraction of the cost. I have led businesses through ISO 27001 and I would still say that plainly. Here is how to tell which side of the line you are on, what it really costs, and how to do it without wasting money if you go ahead.
What it actually is
ISO 27001 is the international standard for an information security management system. In plain terms, a documented set of policies, controls, risk assessments and reviews that show you manage security deliberately rather than by luck. An accredited certifier audits you against it, then audits you again every year, with full recertification every three years. It is a system you run, not a badge you buy.
The distinction from Cyber Essentials matters. Cyber Essentials checks that five specific technical controls are in place. ISO 27001 checks that you have a working process for identifying your security risks, deciding what to do about them, doing it, and reviewing it. One is a snapshot of your defences. The other is proof that you manage them.
When it is clearly worth it
Procurement demands it. Public-sector frameworks, large enterprises and regulated industries increasingly require ISO 27001 from suppliers who touch their data. If you are losing tenders or stuck at the security questionnaire stage, the certificate pays for itself on the first contract it unlocks. This is the most common reason, and the clearest.
Your data would ruin you. If you hold financial, medical or otherwise sensitive personal data at scale, the discipline of the standard is a genuine protection, not only a certificate. The risk assessment process alone tends to find things that would otherwise have surfaced as an incident.
You are selling into a bigger market. Firms heading for enterprise customers or an exit find that buyers and acquirers read ISO 27001 as proof the house is in order. It shortens due diligence and removes a category of objection.
You are a supplier to a regulated firm. Banks, insurers and healthcare providers push their own compliance down the supply chain. If your customers are regulated, their requirements will eventually become yours.
When it is probably not, yet
Nobody is asking for it and your data is ordinary. In that case Cyber Essentials, and Plus if you need independent proof, gives you the practical security at a few hundred to a couple of thousand pounds. Our comparison of Cyber Essentials or Cyber Essentials Plus covers that route.
You cannot run it afterwards. The certificate is the start. If nobody in the business will own the policies, the risk register and the annual audits, you will spend the money and let it lapse, which is worse than never having had it, because a lapsed certificate raises questions a missing one does not.
You are doing it for marketing. A certificate nobody asked for, on a website nobody checks it on, is money spent on reassurance you did not need.
What it costs, honestly
For a small business the first year typically lands somewhere between £6,000 and £25,000, depending on scope, how much consultancy you buy and whether you use a UKAS-accredited certifier. Audit fees are the smaller part, usually a few thousand pounds for the two-stage initial audit. Preparation is the larger, and it depends on how far your current practice is from the standard.
Ongoing costs run a few thousand a year for surveillance audits and the time to keep the system alive. Full recertification every three years costs more.
Those figures come from firms that sell the service, so get two or three written quotes against a defined scope before you decide. And treat the UKAS question seriously. Non-accredited certifiers are cheaper and their certificates are worth correspondingly less to the customers who ask for ISO 27001 in the first place.
The hidden cost is internal time. Someone senior has to own it for months. That is usually the real reason small firms stall, and it should be in the budget as a number of days, not an assumption.
What this looks like in practice
A 45-person software firm selling to financial services clients. Two prospects in a row ask for ISO 27001 in the security questionnaire. The firm has Cyber Essentials Plus and decent practice but nothing documented as a system.
Month one, scoping. The certification covers the product and the teams that touch customer data, not the whole company. A fixed-fee adviser is engaged. An operations manager is named as owner with two days a week ring-fenced.
Months two to four, building the system. Risk assessment, policies written to match what the firm actually does rather than a template, the controls mapped, the gaps closed. The biggest practical changes are a supplier review process and a formal access review.
Month five, internal audit and management review. Month six, stage one audit with the certifier, a few findings, fixed. Month seven, stage two audit, certificate issued.
Total cost a little under £15,000 in fees and around 40 days of internal time. Both prospects close in the following quarter, and the firm stops losing bids at the questionnaire stage. The system runs on about two days a month afterwards.
How to do it without wasting money
Scope it tightly. Certify the parts of the business that touch customer data, not the whole company on day one. A tight scope is cheaper, faster and still satisfies most customers. You can widen it later.
Fix the basics first, because an ISO audit on a business with no patching discipline is a slow way to fail. Cyber Essentials Plus first is the sensible order.
Put one named person in charge, with time to do it. Not the IT provider, not a consultant, someone inside the business.
Use a fixed-fee adviser rather than an open day rate, so the bill is known before you start. And use a UKAS-accredited certifier, because the customers who ask for ISO 27001 will check.
Write policies that describe what you actually do. Templates that describe a fictional company fail audits and, worse, get ignored by staff.
The common mistakes
Certifying the whole company when a tight scope would do. It doubles the cost and the time.
Buying a document pack and calling it a system. Auditors can tell, and so can your staff.
Letting it lapse after the first certificate. The surveillance audits are the point. A lapsed certificate is a red flag to the customers who wanted it.
Starting ISO 27001 before Cyber Essentials. The technical basics have to be in place, and the cheaper scheme proves them.
The honest bottom line
ISO 27001 is a commercial decision dressed as a security one. If a contract or a market needs it, do it properly and it pays. If not, build real security first and come back to the certificate when a customer asks. A technology review will tell you which situation you are in, and a fractional CIO is often the person who owns it if you go ahead.
Frequently asked questions
Is ISO 27001 worth it for a small business?
When a customer, tender or regulator requires it, or when a breach would be catastrophic, yes. Otherwise Cyber Essentials gives most of the security benefit at far lower cost.
How much does ISO 27001 cost in the UK?
For small firms, typically £6,000 to £25,000 in the first year depending on scope and consultancy, then a few thousand a year to maintain. Get written quotes against a defined scope.
How long does ISO 27001 take?
Usually four to nine months for a small business, driven more by internal time and preparation than by the audit itself.
What is the difference between ISO 27001 and Cyber Essentials?
Cyber Essentials checks five technical controls are in place. ISO 27001 checks you have a working process for managing security risk. One is a snapshot of defences, the other is proof you manage them.
Does the certifier need to be UKAS accredited?
For a certificate that satisfies the customers who ask for ISO 27001, yes. Non-accredited certificates are cheaper and worth correspondingly less.
Should I get Cyber Essentials first?
Yes. It fixes the practical basics, costs little, and makes the ISO 27001 work far easier if you go on to it.