The short answer
The first cyber security certification for most UK organisations is Cyber Essentials, the government-backed baseline that many public-sector contracts require, with Cyber Essentials Plus added when buyers want audited proof. ISO 27001 suits firms that need an internationally recognised management system. PCI DSS applies to anyone handling card payments, and SOC 2 is a US attestation report, not a certificate.
On this page
- UK cyber security certifications compared
- What is the best cyber security certification for a UK business?
- Which certification do customers ask for?
- How do the pairwise comparisons work out?
- Do I need Cyber Essentials if I have PCI DSS?
- Cyber security certification vs accreditation: what is the difference?
- Which cyber security standards have no certificate?
- Why Sovereign Secure
- Next step
The right cyber security certification in the UK depends on who is asking for it. For most organisations the first step is Cyber Essentials, the government-backed baseline that UK central government and NHS contracts often require. Cyber Essentials Plus adds an independent technical audit. ISO 27001 is the international standard for running an information security management system, and it is what enterprise and overseas buyers usually want. PCI DSS is not optional if you take or handle card payments. SOC 2 is a US attestation report that many American customers expect from service providers.
Looking for a personal cyber security qualification? This guide covers certifications for organisations; for individual courses see NCSC Assured Training and the UK Cyber Security Council.
This page compares the organisational certifications in one place and helps you choose; detailed pairwise comparisons are linked rather than repeated.
UK cyber security certifications compared
| Aspect | Who it is for | How you are assessed | Validity | Main cost driver | Who issues it |
|---|---|---|---|---|---|
| Cyber Essentials | UK organisations of any size, especially public-sector and NHS suppliers | Self-assessment against the IASME question set, approved by a board member or equivalent and marked by an assessor | 12 months | Organisation size: IASME fee bands from £320 to £600 + VAT | An IASME-licensed certification body, such as Sovereign Secure |
| Cyber Essentials Plus | Organisations whose buyers want audited proof | Hands-on tests: external vulnerability scan, authenticated scans of sample devices, malware protection and MFA checks, within three months of the Cyber Essentials certificate | 12 months | Number of devices, users, sites and cloud services sampled | An IASME-licensed certification body, such as Sovereign Secure |
| IASME Cyber Assurance | Smaller organisations wanting governance assurance beyond Cyber Essentials. It is also where IASME now points anyone looking for IASME Cyber Baseline, which is no longer available | Level One is a verified self-assessment; Level Two adds an audit. A valid Cyber Essentials certificate is a prerequisite | Level One one year; Level Two three years, with Cyber Essentials and Level One renewed yearly | Organisation size and level | Certification bodies licensed by IASME for the scheme, including Sovereign Secure |
| ISO 27001 | Organisations needing an internationally recognised management system; see What is ISO 27001? | Stage 1 and Stage 2 audits of your ISMS against ISO/IEC 27001:2022 (clauses 4 to 10 and the Annex A controls you apply): documents, records, interviews and sampling | Three years, with surveillance audits every year | Scope: people, sites and complexity, which set the audit days | An independent certification body |
| PCI DSS v4.0.1 | Any business that stores, processes or transmits card data, or can affect its security | Self-Assessment Questionnaire or Report on Compliance by a QSA, plus an Attestation of Compliance and quarterly ASV scans where they apply | Validated every year | Size of the cardholder data environment and your merchant or service provider level | No certificate: you, and your QSA where one is used, sign an Attestation of Compliance |
| SOC 2 | Service organisations selling to US customers | Attestation against the AICPA Trust Services Criteria: Type 1 tests design at a point in time, Type 2 also tests operating effectiveness over a period | Covers a past period; usually renewed every year | Criteria in scope and the length of the Type 2 period | A licensed CPA firm |
The Cyber Essentials fee bands are IASME’s official prices: £320 for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all + VAT. Our own Cyber Essentials certification packages start at the same £320 + VAT.
Sovereign Secure is an IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, so we issue those certificates directly. For card payments, the PCI SSC also runs programmes beyond PCI DSS for payment solution providers, and as a PCI SSC-listed assessor we carry out PCI P2PE assessments for point-to-point encryption solutions and PCI 3DS assessments for 3-D Secure providers.
What is the best cyber security certification for a UK business?
There is no single best certificate. Answer each question in turn; many organisations end up needing more than one.
- Do you take card payments or handle card data? PCI DSS applies whatever else you hold. Your acquirer or the card brands decide how you validate.
- Does a UK government or NHS contract name Cyber Essentials? Get Cyber Essentials, and Cyber Essentials Plus if the contract asks for it. The NCSC’s Cyber Essentials overview explains the scheme.
- Do enterprise or overseas buyers ask for ISO 27001, or send long security questionnaires? Plan for ISO 27001, which typically takes months rather than weeks.
- Are your main customers US companies asking for a SOC 2 report? You will need a licensed CPA firm. Read our guide to SOC 2 compliance before choosing between SOC 2 and ISO 27001.
- Do you want governance assurance beyond the technical baseline, without a full ISMS? Look at IASME Cyber Assurance.
- Nobody is asking yet? Start with Cyber Essentials. It is the cheapest recognised baseline, and ISO 27001 and PCI DSS both expect its five controls in some form.
Which certification do customers ask for?
Buyers tend to fall into clear groups.
| Buyer | What they usually ask for |
|---|---|
| UK central government departments, their agencies and NHS bodies | Cyber Essentials for relevant contracts; Cyber Essentials Plus where the risk is higher |
| NHS suppliers and care providers with access to patient data | An annual NHS DSPT self-assessment; outside Category 1, a current Cyber Essentials Plus certificate on top of Standards Met lifts the published status to Standards Exceeded |
| Defence suppliers | Cyber Essentials or Cyber Essentials Plus, plus a Defence Cyber Certification level where the contract sets one |
| Large UK and international enterprises | ISO 27001, often with Cyber Essentials for UK work |
| US customers of software and service providers | A SOC 2 Type 2 report; some accept ISO 27001 instead |
| Acquirers, payment partners and card brands | PCI DSS compliance, shown by an Attestation of Compliance |
How do the pairwise comparisons work out?
Each of these has its own page. In one line:
| Comparison | The short answer |
|---|---|
| Cyber Essentials vs ISO 27001 | Five technical controls in days or weeks, against a whole management system in months; many firms hold both |
| PCI DSS vs ISO 27001 | Prescriptive card data requirements, against a risk-based framework; ISO 27001 does not replace PCI DSS |
| ISO 27001 vs SOC 2 | A certificate recognised worldwide, against a US attestation report; firms selling into both the UK and US markets often hold both |
Do I need Cyber Essentials if I have PCI DSS?
Yes, if a contract asks for Cyber Essentials. PCI DSS protects cardholder data and covers the systems that store, process or transmit it, plus anything that can affect their security. Cyber Essentials checks five basic technical controls across your whole organisation, or a clearly separated part of it. Holding one says nothing formal about the other.
The controls do overlap, so the work is not wasted:
| Cyber Essentials control | Closest PCI DSS v4.0.1 requirements | Watch out for |
|---|---|---|
| Firewalls | Requirement 1: network security controls | PCI DSS also needs rule sets reviewed at least every six months (1.2.7) |
| Secure configuration | Requirement 2: secure configurations | PCI DSS needs configuration standards for every system type |
| Security update management | Requirement 6.3.3 | Cyber Essentials is stricter: high and critical updates within 14 days, against one month for critical vulnerabilities in PCI DSS, with other patches on a timescale you define |
| User access control | Requirements 7 and 8, including MFA for all non-console access into the cardholder data environment (8.4.2) | PCI DSS adds password, session and access review rules |
| Malware protection | Requirement 5 | PCI DSS adds periodic evaluation for systems not commonly at risk |
Can Cyber Essentials Plus evidence count towards PCI DSS?
It can inform your PCI DSS evidence, but it cannot replace it. The technical tests are similar in spirit and different in rules:
- A Cyber Essentials Plus external scan is not an ASV scan. PCI DSS Requirement 11.3.2 needs passing external scans at least every three months, performed by a PCI SSC Approved Scanning Vendor.
- Cyber Essentials Plus device scans are not your internal scanning programme. Requirement 11.3.1 needs internal scans of in-scope systems at least every three months, and 11.3.1.2 has required authenticated scanning since 31 March 2025.
- Cyber Essentials Plus is not a penetration test. Requirement 11.4 needs internal and external penetration tests at least every 12 months and after significant change, to a defined methodology, plus segmentation tests where segmentation reduces your scope.
What does carry across is supporting evidence: asset inventories, patch records, MFA settings and anti-malware reports can be reused where the scopes match.
Our independence note. Sovereign Secure is both an IASME-licensed Cyber Essentials certification body and a PCI SSC QSA company. We keep each assessment to its own scheme’s rules. A Cyber Essentials Plus certificate from us never stands in for PCI DSS validation, and where we have advised you, we check IASME’s certification body rules on consultancy and assessment before we certify. Advice from us does not make any assessment easier to pass.
Cyber security certification vs accreditation: what is the difference?
Your organisation is certified; the body that certifies you is accredited, licensed or qualified to do so. People searching for “cyber security accreditation” usually mean a certificate their organisation can show buyers, but the words matter when a buyer asks for proof, and attestation and validation are different again.
| Term | What it means | Examples |
|---|---|---|
| Certification | Your organisation receives a certificate from a licensed or independent body, valid for a fixed period | Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance, ISO 27001 |
| Accreditation, licensing or qualification | A scheme owner or accreditation body approves the organisation that assesses you | IASME licenses Cyber Essentials certification bodies; the PCI SSC qualifies QSA companies; accreditation bodies accredit ISO certification bodies |
| Attestation | An auditor’s report giving an opinion on your controls | SOC 2 Type 1 and Type 2 |
| Validation | A Report on Compliance or Self-Assessment Questionnaire with an Attestation of Compliance, sent to your acquirer, payment brands or customers | PCI DSS |
When a tender asks for an “accredited” certificate, check what it means in practice: for Cyber Essentials, a certificate from an IASME-licensed certification body; for ISO 27001, a certificate from a certification body accredited for that standard. Our ISO certification guide explains ISO accreditation in more detail.
Which cyber security standards have no certificate?
Several widely used cyber security standards and frameworks have no certificate at all. You can be assessed against them, and buyers may ask how you align, but nobody issues a pass:
- NCSC Cyber Assessment Framework (CAF): outcome-based assessment for essential services, NHS bodies and the public sector.
- NIST Cybersecurity Framework 2.0: six functions (Govern, Identify, Protect, Detect, Respond, Recover), common with US customers.
- CIS Controls: a prioritised list of technical safeguards.
- NCSC 10 Steps to Cyber Security: guidance written for medium to large organisations, although the principles apply to all.
Among information security standards, ISO/IEC 27002 gives control guidance but is not certifiable; ISO/IEC 27001 is the one you certify against.
Why Sovereign Secure
Sovereign Secure Ltd was incorporated in 2012 and is headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
- IASME schemes. We are an IASME-licensed certification body and issue Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1 certificates directly.
- PCI SSC approvals. We are a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA), a Card Production Security Assessor (CPSA), a P2PE Assessor (Europe and USA) and a 3DS Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
- ISO 27001. We are ISO 27001 certified and provide ISO 27001 consultancy. Certification audits are carried out by our partner certification body, MQA International.
- Testing. Penetration testing and vulnerability scanning, with external ASV scans delivered through a PCI SSC Approved Scanning Vendor partner.
See how these fit together in our cyber security consultancy overview.
Next step
Tell us which contracts, customers or acquirers are asking for proof, and by when. We will tell you plainly which certification to start with. Contact our team or call +44 161 523 5276.
Already know which one you need? Check where you stand for free with our Cyber Essentials readiness check, PCI compliance check or ISO 27001 checklist.
Free tools and services
- PCI compliance checkAnswer 22 questions for a readiness score, your likely SAQ and a fix list.Start the free check
- Cyber Essentials readiness checkAnswer 20 questions for a readiness score and a fix list before you apply.Start the free check
- Talk to usTell us what you need. We aim to reply within one working day.Get a quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
