Comparison
ISO 27001 vs Cyber Essentials
ISO/IEC 27001:2022 · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of ISO/IEC 27001:2022 and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in ISO 27001, 0 are only loosely related, and 0 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Mapped (5)
| Cyber Essentials | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Technical controls · 5 | ||||
| CE 1 | Firewalls | Editorial | A.8.20A.8.21A.8.22 | Same topic: Firewall / Net Seg (editorial pick) |
| CE 2 | Secure Configuration | Editorial | A.6.7A.8.1A.8.9 | Same topic: Mobile Security, Secure Config (editorial pick) |
| CE 3 | Security Update Management | Editorial | A.5.9A.5.11A.7.14+1 | Same topic: Asset Management (editorial pick) |
| CE 4 | User Access Control | Editorial | A.5.15A.5.16A.5.18+5 | Same topic: Access Control (editorial pick) |
| CE 5 | Malware protection | Editorial | A.8.1A.8.7A.8.19 | Same topic: Endpoint Protection (editorial pick) |
Of 123 ISO/IEC 27001:2022 requirements, 20 map to something in Cyber Essentials, 19 are only loosely related, and 84 have no mapping in our data.
Likely new work: ISO 27001 requirements with no mapping to Cyber Essentials (84)
| ISO 27001 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 22 | ||||
| A.5.2 | Information security roles and responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.4 | Management responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.5 | Contact with authorities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.6 | Contact with special interest groups | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.7 | Threat intelligence | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.10 | Acceptable use of information and other associated assets | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.20 | Addressing information security within supplier agreements | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.21 | Managing information security in the ICT supply chain | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.24 | Information security incident management planning and preparation | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.25 | Assessment and decision on information security events | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.26 | Response to information security incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.27 | Learning from information security incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.28 | Collection of evidence | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.29 | Information security during disruption | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.30 | ICT readiness for business continuity | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.32 | Intellectual property rights | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.33 | Protection of records | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.34 | Privacy and protection of PII | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.35 | Independent review of information security | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.36 | Compliance with policies, rules and standards for information security | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.5.37 | Documented operating procedures | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6 People controls · 7 | ||||
| A.6.1 | Screening | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6.2 | Terms and conditions of employment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6.3 | Information security awareness, education and training | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6.4 | Disciplinary process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6.5 | Responsibilities after termination or change of employment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6.6 | Confidentiality or non-disclosure agreements | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.6.8 | Information security event reporting | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7 Physical controls · 11 | ||||
| A.7.1 | Physical security perimeters | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.2 | Physical entry | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.3 | Securing offices, rooms and facilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.4 | Physical security monitoring | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.5 | Protecting against physical and environmental threats | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.6 | Working in secure areas | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.7 | Clear desk and clear screen | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.8 | Equipment siting and protection | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.9 | Security of assets off-premises | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.11 | Supporting utilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.7.12 | Cabling security | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8 Technological controls · 18 | ||||
| A.8.10 | Information deletion | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.11 | Data masking | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.12 | Data leakage prevention | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.13 | Information backup | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.14 | Redundancy of information processing facilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.15 | Logging | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.17 | Clock synchronization | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.24 | Use of cryptography | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.25 | Secure development life cycle | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.26 | Application security requirements | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.27 | Secure system architecture and engineering principles | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.28 | Secure coding | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.29 | Security testing in development and acceptance | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.30 | Outsourced development | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.31 | Separation of development, test and production environments | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.32 | Change management | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.33 | Test information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| A.8.34 | Protection of information systems during audit testing | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| ISMS clauses 4–10 · 26 | ||||
| Clause 4.1 | Understanding the organization and its context | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 4.2 | Understanding the needs and expectations of interested parties | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 4.3 | Determining the scope of the ISMS | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 4.4 | Information security management system | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 5.1 | Leadership and commitment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 5.2 | Policy | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 5.3 | Organizational roles, responsibilities and authorities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 6.1.1 | General | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 6.1.3 | Information security risk treatment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 6.2 | Information security objectives and planning to achieve them | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 6.3 | Planning of changes | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.1 | Resources | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.2 | Competence | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.3 | Awareness | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.4 | Communication | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.5.1 | General | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.5.2 | Creating and updating | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 7.5.3 | Control of documented information | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 8.1 | Operational planning and control | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 8.2 | Information security risk assessment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 8.3 | Information security risk treatment | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 9.2.1 | General | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 9.2.2 | Internal audit programme | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 10.1 | Continual improvement | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Clause 10.2 | Nonconformity and corrective action | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (19)
| ISO 27001 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 9 | ||||
| A.5.1 | Policies for information security | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.5.3 | Segregation of duties | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.5.8 | Information security in project management | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.12 | Classification of information | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.13 | Labelling of information | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.14 | Information transfer | CE 1CE 2CE 4 | Only shares CSF ID.AM-03, PR.AA-05: related, not a mapping | |
| A.5.17 | Authentication information | CE 4CE 2 | Only shares CSF PR.AA-03, PR.AA-05: related, not a mapping | |
| A.5.19 | Information security in supplier relationships | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.22 | Monitoring, review and change management of supplier services | CE 3CE 4 | Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping | |
| A.7 Physical controls · 2 | ||||
| A.7.10 | Storage media | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.7.13 | Equipment maintenance | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.8 Technological controls · 4 | ||||
| A.8.4 | Access to source code | CE 2CE 4 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.8.6 | Capacity management | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| A.8.16 | Monitoring activities | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| A.8.23 | Web filtering | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| ISMS clauses 4–10 · 4 | ||||
| Clause 6.1.2 | Information security risk assessment | CE 3 | Only shares CSF ID.RA-08: related, not a mapping | |
| Clause 9.3.1 | General | CE 2CE 4 | Only shares CSF PR.PS-01: related, not a mapping | |
| Clause 9.3.2 | Management review inputs | CE 2CE 4 | Only shares CSF PR.PS-01: related, not a mapping | |
| Clause 9.3.3 | Management review results | CE 2CE 4 | Only shares CSF PR.PS-01: related, not a mapping | |
Mapped (20)
| ISO 27001 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 6 | ||||
| A.5.9 | Inventory of information and other associated assets | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| A.5.11 | Return of assets | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| A.5.15 | Access control | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| A.5.16 | Identity management | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| A.5.18 | Access rights | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| A.5.23 | Information security for use of cloud services | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
| A.6 People controls · 1 | ||||
| A.6.7 | Remote working | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| A.7 Physical controls · 1 | ||||
| A.7.14 | Secure disposal or re-use of equipment | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| A.8 Technological controls · 12 | ||||
| A.8.1 | User endpoint devices | Editorial | CE 2CE 5 | Same topic: Mobile Security, Endpoint Protection (editorial pick) |
| A.8.2 | Privileged access rights | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| A.8.3 | Information access restriction | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| A.8.5 | Secure authentication | Editorial | CE 4 | Same topic: Multi-Factor Auth (editorial pick) |
| A.8.7 | Protection against malware | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| A.8.8 | Management of technical vulnerabilities | Editorial | CE 3 | Same topic: Vulnerability Mgmt, Patch Management (editorial pick) |
| A.8.9 | Configuration management | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| A.8.18 | Use of privileged utility programs | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| A.8.19 | Installation of software on operational systems | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| A.8.20 | Networks security | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| A.8.21 | Security of network services | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| A.8.22 | Segregation of networks | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
By topic
Both cover (11):
Asset ManagementVulnerability MgmtAccess ControlMulti-Factor AuthPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigMobile SecurityCloud Security
Only ISO 27001 (39):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationThreat IntelligenceEncryptionData ProtectionBackup & RecoverySecure DevelopmentEmail SecurityWeb SecurityZero TrustDNS SecurityWAFDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryAPI SecurityInsider ThreatVendor Risk MgmtPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.