Frameworks compared
Which cyber security framework does your business need?
Start with the risks you need to manage and the requirements you need to demonstrate. The Cyber Essentials framework, ISO 27001, SOC 2 and NIST CSF have different scopes and purposes. This comparison helps you understand the questions to ask before committing to a programme.
The five frameworks, compared
The five frameworks, compared
| Framework | What it is | Who it can help | Possible trigger | Work involved | Key distinction |
|---|---|---|---|---|---|
| Cyber Essentials | UK certification assessing five technical control areas. | Organisations seeking a defined security baseline. | A contract, customer request or internal improvement programme. | Review the controls, address gaps and complete the verified self-assessment. | Covers specific technical controls, rather than every security obligation. |
| Cyber Essentials Plus | The same controls with independent technical testing. | Organisations seeking additional technical assurance. | A specified requirement or a decision to verify implementation. | Prepare for the assessor's tests and address findings. | Tests whether controls work in practice. |
| ISO 27001 | A standard for an information security management system. | Organisations seeking a structured way to manage information security risks. | Business risk priorities, contracts or customer requirements. | Establish, operate and improve the management system within its defined scope. | Broader management-system requirements than Cyber Essentials. |
| SOC 2 | An assurance report on controls at a service organisation. | Service organisations whose customers request this assurance. | Customer or procurement requirements. | Define the scope and prepare relevant controls and evidence for examination. | An assurance report, rather than Cyber Essentials-style certification. |
| NIST CSF 2.0 | A framework for understanding and managing cyber security risk. | Organisations organising a security improvement programme. | Risk reviews, planning or leadership reporting. | Assess the current position and prioritise improvements. | Using the framework does not itself provide a certification. |
Our view
How to choose a framework that fits
Gather the requirements from your customers, contracts and insurers, then compare them with your own risks and priorities. When considering Cyber Essentials vs ISO 27001, for example, distinguish specific technical controls from a wider information security management system. Choose the approach that addresses the actual requirement.
Need to get certified?
Need to get certified?
We help assess your Cyber Essentials readiness, address gaps and prepare for independent assessment. INDIGO IT holds Cyber Essentials Plus, and we can explain the preparation involved at either level.
Making great IT personal and accessible
Meet Matt, Managing Director of INDIGO IT
Matt is passionate about technology and helping businesses to thrive with it. If your tech is in a tangle, he'd love to help you. Whether it's tricky tech, cyber security, or transforming your business's IT to achieve your goals, Matt can offer clear guidance, free from the technobabble.
Ready to make headway to exceptional IT? It all starts with an informal conversation!
Frequently asked questions
Common questions about security frameworks
If yours isn't here, call us on 01491 693424.
Cyber Essentials can help a small business establish a defined technical security baseline, and some customers or contracts require it. Start with the requirement you've received and the risks you need to address, then review the preparation on our Cyber Essentials support page.
Cyber Essentials Plus covers the same technical controls as Cyber Essentials and adds independent testing to check how they're implemented. INDIGO IT holds Cyber Essentials Plus and helps you prepare for assessment; the certification body makes the certification decision.
Zero Trust means checking access requests against policy rather than trusting someone simply because they're connected to the office network. For a small business, that can involve stronger identity checks, managed devices and permissions limited to the work each person needs to do.
Security information and event management, or SIEM, brings security logs together to help identify activity that needs investigation. Whether it is appropriate depends on your risks, systems and ability to act on alerts, so it needs a clear purpose and someone responsible for the findings.
Yes, a provider can review sign-in controls, administrator access, sharing settings and the security features available through your licences. Ask what will be configured, monitored and reviewed as part of the service so you understand the ongoing responsibility.