Essential Eight, Cyber Essentials or ISO 27001: which do you need?

A business that has just failed a client security review usually asks which certification to get. It is the wrong first question. The right one is: what is the specific outcome you need, fewer incidents, a passed assessment, or a contract you cannot currently bid for? Each points somewhere different.

The ACSC Essential Eight

Published by the Australian Signals Directorate’s Australian Cyber Security Centre, the Essential Eight is a set of eight mitigation strategies (application control, patching applications, configuring macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication, and regular backups) defined across three maturity levels.

It is a technical control baseline rather than a management system, and it is not certified in any general commercial sense: you assess against it, and self-assessment is normal for private businesses. Its virtue is that it is specific. It tells you what to do rather than what to have a policy about.

Start here if your concern is genuinely reducing the chance of an incident, you operate in or sell into Australia, or you want a concrete, orderable list of technical work. It is also the cheapest of the three to make real progress against.

NCSC Cyber Essentials

A UK government-backed scheme covering five technical control themes: firewalls, secure configuration, user access control, malware protection and security update management. Certification is available at two levels, Cyber Essentials, which is verified self-assessment, and Cyber Essentials Plus, which adds independent technical testing.

It is deliberately narrow and achievable, and it is issued through certification bodies licensed by the scheme’s delivery partner. For many UK public sector contracts it is a stated minimum, which makes it a commercial requirement as much as a security one.

Start here if you sell into the UK public sector or to UK enterprises who ask for it, and you want a recognised badge at modest cost and effort, typically weeks rather than months.

ISO/IEC 27001

A different category of thing. ISO/IEC 27001 specifies an information security management system: a governance framework requiring defined scope, risk assessment methodology, leadership involvement, documented controls, internal audit and continual improvement. Certification is issued by an accredited certification body following a two-stage audit, with surveillance audits thereafter.

It is the heaviest of the three and the most widely recognised internationally. It is also the one most often pursued for the wrong reason, as a response to a single lost deal, rather than as a considered commitment to an ongoing management system with real annual cost in audit fees and internal time.

Start here if it is a contractual requirement you cannot negotiate, you sell internationally to enterprises who insist on it, or your business model makes information security a core commercial promise.

What they have in common

A great deal, in practice. All three require the same foundations, and this is the useful insight for a business deciding where to start:

• Multi-factor authentication applied everywhere, not selectively.
• A known inventory of systems, data and who can access them.
• Timely patching, with evidence that it happens.
• Backups that have been test-restored, not merely configured.
• Access removed promptly when people leave or change role.
• A documented incident response path with a named decision-maker.

That work is not wasted whichever direction you eventually take, and it is where the actual risk reduction lives. Doing it first also makes any subsequent certification programme considerably cheaper, because most of the evidence already exists.

A pragmatic order of operations

1. Fix the shared foundations above. Nothing else is a better use of the first month.
2. Establish what your market actually demands, ask your three largest prospects what they require of suppliers, in writing.
3. If the answer is "demonstrable controls", document what you have and build the evidence pack. Many buyers stop there.
4. If the answer is a specific certification, pursue that one, with the foundations already in place.
5. Do not pursue two certification programmes at once. It doubles the cost and halves the attention.

One honest note on advisers

No consultancy can certify you against any of these. Certification is issued only by an accredited certification body, or for Cyber Essentials by a licensed certifying body, deliberately, so that the party preparing you is not the party judging you. What an adviser can legitimately do is assess your position, close the gaps, assemble the evidence and prepare your team for the assessment.

If anyone offers to both prepare and certify you, that is the moment to ask who accredits them.