Cyber Essentials to ISO 27001 — a certification ladder, not a cliff

No — each rung is a finished certificate, and the right place to stop is wherever your buyers stop asking. If UK public-sector work is the goal, Cyber Essentials on its own may be the whole answer. If a single enterprise customer has sent an ISO 27001 questionnaire, you may need to go straight to rung three. The reason to think of it as a ladder rather than a menu is that the work compounds: the access control, patching and logging evidence built for Cyber Essentials is the same evidence ISO 27001 asks for, so climbing later costs far less than starting from scratch.

ISO 27701 is a privacy extension to ISO 27001 rather than a standalone standard — it cannot be certified on its own. It adds privacy-specific controls on top of the same management system, which means the same auditor certifies both in the same visit. Doing them together costs a fraction of what a separate privacy project would, and it converts "we take GDPR seriously" from an assertion into a certificate you can send a customer. If you process personal data at any volume, it belongs in the same engagement.

Typically three to six months from a standing start to Stage 2 audit, and the variance is almost entirely about two things: how tightly you scope, and how much already exists. A company with a single cloud product, an identity provider and reasonable engineering discipline sits at the short end. A company with acquired subsidiaries, on-premise servers and no central identity sits at the long end. The gap analysis in the first three weeks is what turns that range into a date.

It's the international management-system standard for AI, the same shape as ISO 27001 but for how you govern, risk-assess, and monitor AI systems rather than information security broadly. Worth pursuing once AI features are customer-facing or a procurement/investor questionnaire starts asking AI-specific questions. If you already hold ISO 27001, the ISMS foundations overlap heavily, which is usually what keeps the ISO 42001 timeline at the shorter end.

Weeks, not months. Cyber Essentials is a self-assessment against five technical control areas, reviewed independently. Cyber Essentials Plus adds a hands-on technical audit, so it needs the underlying configuration to genuinely be right rather than merely described correctly. For most small companies the honest answer is that certification takes days and fixing what it uncovers takes the rest of the time — which is why I would rather look at your estate before quoting you a date.

No. Every engagement runs on a compliance workspace I deploy into your own cloud tenant in week one — it holds the risk register, the Statement of Applicability, the policy set and the evidence trail, and it connects to the cloud, identity and device management you already pay for. That means no per-seat licence, no data leaving your environment, and nothing to keep renewing once you are certified. It is not magic: it evidences controls, it does not implement them, and the implementation is the part I do. If you already run Vanta or Drata I will work with what you have rather than move you off it mid-project.

No one honest can, because the assessor makes that call, not me. What I can tell you is that the failures I see come from predictable places — a scope drawn too wide, controls documented but not implemented, or an internal pentest skipped so the external one becomes the first real test. Doing the internal pentest first, remediating properly, and scoping deliberately is what makes the assessment uneventful. If the gap analysis says the target date is unrealistic, you hear that in week three rather than at the audit.

Yes, and it is a common starting point. A failed or ugly pentest report is a prioritisation problem more than a security one — the report lists everything it found, in its own order, with no reference to your architecture or your deadline. The work is triaging it against real exploitability, doing the infrastructure fixes properly rather than patching symptoms, and getting it re-tested to closure. I will also sit between you and the testing firm on the retest so scope and findings get argued rather than accepted.

It depends entirely on who is asking you for it. UK public-sector contracts handling personal data require Cyber Essentials by procurement policy, so that is a hard gate. Enterprise and international buyers tend to ask for ISO 27001 or SOC 2 by name. If nobody has asked yet, Cyber Essentials is the sane starting point — it is fast, it is the recognised UK baseline, and the controls underneath it are the same foundation ISO 27001 builds on later. Certifying ahead of demand mostly buys you an annual renewal cost.

It varies too much with scope for a number on a page to be useful, and anyone quoting you one before looking at your estate is guessing. There are three separate costs to plan for: the certification body's fees, the independent testing along the way — a pentest, and for ISO an internal audit that has to be run by someone other than me — and the engineering work to close the gaps. That third one is the one that moves, and the gap analysis is what sizes it. Book a call and I will give you a real range once I know what is in scope.