Cyber Essentials, ISO 27001, SOC 2: which one do you actually need?
If you're a UK business and someone has just told you that you need to "get compliant," you're probably staring at a list of acronyms wondering where to even start. Cyber Essentials, ISO 27001, and SOC 2 sound related, and they are, but they're not the same thing and they're not interchangeable.
The good news is that you probably will not have to decide completely on your own. Your client will usually tell you. Very specifically. They are not going to say "get some kind of compliance cert, you decide" -- they are going to say "we require ISO 27001" or "we need Cyber Essentials as a minimum." So in practice, the decision often makes itself. But it is still worth understanding what you are signing up for before you dive in.
Start with Cyber Essentials
If nobody has told you what they want yet, or you are just getting started, start with Cyber Essentials. Do not overthink it.
Cyber Essentials is a UK government-backed certification that covers five common ways organisations get breached: firewalls, secure configuration, access control, malware protection, and patch management. It is a self-assessment, which means you answer a structured set of questions about how you run your IT, and an assessor reviews your responses. There is no months-long audit process. If your policy documents are in order, there is no reason you cannot get this done in a week. With the right tools, potentially an afternoon.
In the UK, Cyber Essentials is increasingly a baseline expectation rather than a nice-to-have. If you are selling to other businesses -- especially in public sector, financial services, or enterprise contexts -- you will be asked for it. Not having it can take you out of conversations before they properly start.
Cyber Essentials first, everything else second
A lot of people assume Cyber Essentials is just a watered-down version of ISO 27001 -- something you do if you cannot afford the "real" thing. That is not really the right way to think about it. Cyber Essentials is the foundation that everything else builds on, and if you start with it and do it properly, you have already done meaningful groundwork for whatever comes next.
Going through the CE process forces you to create things you will need anyway: a device register, an access control policy, a patch management process, and documented configurations. These are not FwdCheck-specific requirements -- they are exactly the kind of artefacts ISO 27001 auditors will ask to see. So when you eventually move to ISO and start uploading documents into your GRC platform, many boxes are already ticked because you have already done the work.
If you want a practical walkthrough of how this looks in real life, see How We Got Cyber Essentials Certified in 2026.
ISO 27001 and SOC 2 are siblings. Both represent a serious, audited commitment to information security, and both take real time and resources to implement. ISO is more often requested by UK and European enterprise customers. SOC 2 is more common with US-based SaaS buyers. Either way, neither is usually where you start from scratch.
Cyber Essentials Plus: do you need it?
Cyber Essentials Plus is the audited version. Instead of self-assessing, an independent assessor verifies your controls through technical testing. It costs more and takes longer than standard CE.
For most SMEs, the honest answer is: not yet. Get standard Cyber Essentials first, get your controls genuinely embedded rather than just documented, then consider Plus once you know you would pass technical verification. The distinction matters -- standard CE says you believe you are doing these things, Plus says someone checked and you are.
The bit most companies get wrong
Getting certified is the start, not the finish. Cyber Essentials renews annually. ISO 27001 has ongoing surveillance audits. These are not one-and-done achievements; they are ongoing commitments. Companies that treat them as box-ticking exercises usually find that out the hard way when renewal comes around and half of what they documented has drifted, staff have changed, and they are effectively starting over.
The other gap is people. A cert says your policies exist. It does not say your employees know what they mean or what to do. Auditors are increasingly alert to the difference between what documentation says and what actually happens in day-to-day operations.
Where FwdCheck fits
FwdCheck is a Cyber Essentials readiness tool. You can upload your existing policy documents and the platform will process them and produce the output you need for your CE self-assessment submission. If you do not have documents yet, you can generate them directly in the platform. The goal is to make the path from "we have never thought about this" to "we have a CE submission ready" as short as possible.
FwdCheck is also working towards becoming an accredited Cyber Essentials certification body, so over time you will be able to complete the full certification journey without leaving the platform.
And yes, there is training built in. Not the kind where everyone watches a long video once a year and it never comes up again -- adaptive training that works out what your people already know and fills the gaps where they actually exist. Getting the cert is one thing. Making sure your team knows what it means is what keeps you compliant between now and the next renewal.
If you are a UK business at the start of this journey, Cyber Essentials is the move. FwdCheck is how you get there without it taking over your life.