// Cybersecurity & Compliance

ISO 27001 vs SOC 2 vs Cyber Essentials: which certification do UK businesses actually need in 2026?

TL;DR

Cyber Essentials is the cheapest, fastest UK certification (£300 to £600, days, government-backed). Cyber Essentials Plus adds an independent technical audit (£1,500 to £3,500, 2 to 4 weeks). ISO 27001 is the international gold standard (£15k to £80k, 6 to 12 months). SOC 2 is what US enterprise procurement asks for (£20k to £100k, 6 to 12 months for Type 2). Most UK SMEs should start with Cyber Essentials Plus. Sell to enterprise UK or US? Add ISO 27001 or SOC 2 respectively. This guide explains why, with a decision tree at the bottom.

If you sell B2B in the UK in 2026, sooner or later a procurement team asks for a security certification. The market keeps acting as if these four certifications are interchangeable. They are not. Picking the wrong one costs months of effort and tens of thousands of pounds you do not need to spend.

This is a senior-CIO view of which certification to chase, when, and what each actually buys you in the real world.

Quick comparison at a glance

Certification Realistic UK cost Time to certify Best for
Cyber Essentials £300 to £600 1 to 5 days UK SMEs, public sector tenders, basic procurement requirements.
Cyber Essentials Plus £1,500 to £3,500 2 to 4 weeks UK businesses bidding for government contracts (mandatory above £100k MoD).
ISO/IEC 27001:2022 £15,000 to £80,000 6 to 12 months Enterprise sales, international clients, regulated industries (FCA, NHS, MoD).
SOC 2 Type 1 £20,000 to £40,000 3 to 4 months SaaS companies selling into US enterprise. Snapshot of controls at a point in time.
SOC 2 Type 2 £35,000 to £100,000 6 to 12 months (3 to 12 month observation window) SaaS in mature US enterprise sales. Demonstrates controls operated effectively over time.

Cyber Essentials: the UK starting point

What it is: a UK government-backed scheme run by the National Cyber Security Centre (NCSC) and administered by IASME. It certifies you have basic technical controls in place against the most common cyber attacks.

What you actually do: complete a self-assessment questionnaire covering five technical control areas: firewalls, secure configuration, access control, malware protection and patch management. Submit it. Pass. Get the badge. It really is that simple.

Realistic cost: £300 for micro businesses (up to 9 staff), rising to around £600 for organisations of 100+. Annual renewal required.

Realistic time: 1 to 5 days once you start, assuming your controls are already in place. If they are not, budget 2 to 4 weeks for remediation first.

Who needs it:

Common mistake: assuming Cyber Essentials proves you are secure. It does not. It proves you have the basics. Sophisticated attackers walk around it without breaking a sweat. Treat it as the floor, not the ceiling.

Cyber Essentials Plus: the same thing, externally verified

What it is: Cyber Essentials with an independent technical audit. A certified assessor remotely tests a sample of your devices and confirms the controls are actually in place, not just claimed.

What you actually do: after passing Cyber Essentials, an assessor schedules vulnerability scans and authenticated tests of your laptops, servers and cloud configurations. They check patch levels, browser security, malware detection and account separation.

Realistic cost: £1,500 to £3,500 depending on size and number of devices. Annual renewal.

Realistic time: 2 to 4 weeks from kickoff. Most of that is scheduling and remediating findings.

Who needs it:

Cyber Essentials Plus is the highest cost-to-credibility ratio in UK security certification. If you are doing one thing this quarter, do this.

ISO 27001: the international gold standard

What it is: the global standard for information security management systems (ISMS) published by the International Organization for Standardization. Updated in 2022 to ISO/IEC 27001:2022 with 93 controls (down from 114 in the 2013 version) across four themes: organisational, people, physical and technological.

What you actually do: build, document and operate an Information Security Management System covering policies, risk assessment, control implementation, internal audit, management review and continuous improvement. Then an external UKAS-accredited certification body (BSI, BSI, LRQA, DNV, NQA and others) runs a Stage 1 (documentation review) and Stage 2 (operational audit). If you pass, you get certified for three years with annual surveillance audits.

Realistic cost:

Realistic time: 6 to 12 months from kickoff to certificate, depending on maturity. If you already have most controls and just need to formalise them: 4 months. From a near-zero starting point: 9 to 12 months.

Who needs it:

Common mistake: buying ISO 27001 when your buyers actually want SOC 2. If you sell SaaS into US tech buyers, SOC 2 is what they will ask for. ISO 27001 will be a curiosity to them. Match the cert to the buyer.

SOC 2: the US enterprise gatekeeper

What it is: a US auditing standard from the American Institute of Certified Public Accountants (AICPA). Not actually a certification, technically: it is an attestation report produced by a licensed CPA firm. There are two flavours: Type 1 (controls in place at a point in time) and Type 2 (controls operated effectively over a 3 to 12 month observation window). Most US enterprise buyers will accept Type 1 to unblock a deal but want Type 2 for renewal.

What you actually do: select the relevant Trust Services Criteria (Security is mandatory; Availability, Confidentiality, Processing Integrity and Privacy are optional). Build and document controls. Engage a CPA firm (Schellman, A-LIGN, BARR, Dansa D'Arata, Prescient Assurance and others) to conduct the audit. Get the report.

Realistic cost:

Realistic time: Type 1 in 3 to 4 months from kickoff. Type 2 is dictated by the observation window: 3 months minimum for first-time, 12 months for mature reports. Total elapsed from start to Type 2 report: 6 to 12 months.

Who needs it:

The decision tree

Pick the cert that matches your actual buyers.

  • IF you have nothing AND you sell B2B in the UK START with Cyber Essentials Plus. £1,500 to £3,500, weeks, satisfies most UK procurement.
  • IF you sell to UK government or MoD Cyber Essentials Plus is mandatory above £100k MoD contracts. Add ISO 27001 if you want to compete for Tier 1 supplier status.
  • IF you sell SaaS into US enterprise Skip ISO 27001. Go straight to SOC 2 Type 1 to unblock deals, then schedule Type 2 within 12 months. Add Cyber Essentials Plus alongside if you also sell UK.
  • IF you sell to UK enterprise (financial services, healthcare, large corporate) ISO 27001 is what procurement will ask for. Cyber Essentials Plus alongside is good belt-and-braces.
  • IF you sell to global enterprise (US + EU + APAC) You will eventually need both ISO 27001 and SOC 2 Type 2. Most companies do ISO first, then add SOC 2 once US deal flow justifies the cost.
  • IF your cyber insurance broker is asking for it Cyber Essentials Plus. Increasingly standard for cyber insurance underwriting in the UK in 2026.

What procurement teams actually look for

Having a certificate is necessary but not sufficient. Mature procurement teams are looking for three things behind the badge:

  1. Scope: is the certificate's scope statement actually relevant to what you sell to them? An ISO 27001 certificate scoped to "our London office" is worthless if the system serving the client runs in AWS Frankfurt. Read the scope carefully.
  2. Currency: when was the certificate issued and when does it expire? Surveillance audits passed? SOC 2 reports older than 12 months are stale.
  3. Evidence: can you produce the supporting documents on request? Risk assessments, incident response runbooks, vendor risk policies, penetration test reports. Increasingly, procurement asks for these in addition to the cert.

Three traps to avoid

Trap 1: starting with ISO 27001 because it sounds best. Many UK companies waste 9 months and £40,000 on ISO 27001 when their actual UK buyers would have been happy with Cyber Essentials Plus and a clean penetration test. Match the cert to who is actually buying.

Trap 2: thinking SOC 2 Type 1 is "good enough". US enterprise will accept Type 1 to start a conversation. They will renew the contract conditional on Type 2 within 12 months. Plan for Type 2 from day one.

Trap 3: outsourcing the certification without owning the ISMS. Some consultants will write your policies for you, get you certified, then vanish. A year later you cannot answer surveillance audit questions because nobody internally understands the system. You need an internal owner from day one, even if the heavy lifting is outsourced.

How long until you can credibly say "we have it"?

For a 25-person UK SaaS business starting from a near-zero baseline today and aiming for both ISO 27001 and SOC 2 Type 2:

Total programme cost over 12 to 15 months: £60,000 to £120,000 depending on tooling, consultants and audit firms. Most UK SaaS companies that win enterprise contracts above £100k ACV consider this money very well spent.

Need to get certified, fast?

Apex Options sources vetted security consultants and audit firms, then project-manages your certification end-to-end. Cyber Essentials Plus in weeks, ISO 27001 in months. Send a brief, a human replies within 30 minutes.

Start a brief →