ISO 27001 Explained: A Plain-English Guide for UK Businesses

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 8 November 2026.

In one sentence: ISO 27001 is an international standard that shows a customer you run information security as a managed, checked and improving system, not as a set of one-off fixes.

Part of our Compliance library.

What it is

The standard is ISO/IEC 27001. Its full name covers “information security management systems”, usually shortened to ISMS. The NCSC describes an ISMS as a set of policies, procedures and roles designed to make sure cyber security risks are identified and managed.

Two things are easy to miss. First, ISO 27001 is about management, not a checklist of settings. You decide your own scope, assess your own risks and choose your own controls. Second, a certificate comes from an outside auditor. Being “aligned with” ISO 27001 and being certified are different statements.

How it works

A plain-English guide from the consultancy GRC Solutions sets out the building blocks, which I have summarised here:

Scope. Decide which parts of the business, people and systems the ISMS covers.
Leadership. Top management owns the policy and the objectives.
Risk assessment. Work out what could go wrong with the information you hold.
Controls. Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement all of them. You assess your risks, choose what you need and justify what you leave out.
Internal audit and management review. You check your own work, then keep improving.
Certification. An independent auditor checks in two stages: a review of the design on paper, then a check that the system runs as documented. The same guide says certificates last three years with surveillance audits in between.

What ISO 27001 does not do: it does not name specific settings such as “turn on multi-factor authentication”, and it does not test whether your servers can be broken into. The NCSC points out that physical testing of controls is not part of a standard ISO/IEC 27001 assessment.

Who it affects and how badly

Sole trader to 10 staff: rarely needed. Cyber Essentials usually covers what customers ask for.
10 to 50 staff (SaaS start-ups, recruitment, accountancy, MSPs): most often triggered by a customer questionnaire or tender. Worst case: a lost contract because you cannot show a recognised standard.
50 to 250 and 250 plus (fintech and insurance, healthcare suppliers, telecoms, manufacturing): routinely asked for in supplier due diligence. Worst case: a failed audit, delayed deals, and in regulated sectors, questions from regulators.
Across the UK, EU, US and Armenia: the standard is international, so a certificate travels well in tenders. The same GRC Solutions guide notes that SOC 2 reports are generally more popular in North America than Europe, so US buyers may ask for SOC 2 instead.

Real examples

These are official positions, not breaches.

The NCSC’s Cyber Assessment Framework lists ISO 27001 among well-known risk management standards for governance, and says organisations using it should consider which elements help their objectives because full compliance and certification may be unnecessary.
The NCSC blog on alternative standards explains that you cannot simply say an ISO/IEC 27001 certificate is “equivalent” to a Cyber Essentials certificate. It adds that in some procurement an ISO/IEC 27001 certificate can serve as an “indicator of good practice”.

The UK angle

The NCSC lays out the difference carefully. Cyber Essentials covers five technical controls aimed at common internet attacks, while an ISO 27001 scope is chosen by the organisation. Any company may offer ISO/IEC 27001 certification, but only bodies accredited by UKAS confirm competence and impartiality. For Cyber Essentials Plus equivalence, the NCSC says you would also need evidence of physical testing, and physical testing is not part of a standard ISO assessment.

The ICO says the UK GDPR does not define the security measures you need. It must be “appropriate” to your risk. It lists Cyber Essentials as a good starting point. The ICO also says that if you rely on a certification scheme, check that the scheme has been approved by the ICO.

What we check in a readiness review

This is method, not a list of findings, and it is readiness only. Wolfcore is not a certification body.

Whether the scope is realistic and written down.
Whether there is an asset list and a risk assessment you could show an auditor.
Whether access control, patching, logging, backups and supplier checks work in practice, not just on paper.
Whether policies match what staff really do.
Whether the Statement of Applicability can be justified line by line.

How the cycle runs

Worked example (an illustration, not a real client)

A 30-person SaaS start-up is asked by a larger customer to show ISO 27001 before signing. The founder assumes a certificate means installing a tool. The customer’s questionnaire actually asks who owns security, how risks are assessed and how suppliers are checked. The start-up has none of that written down. Starting with a small scope (the product and the team that runs it) keeps the work manageable. The cost is mostly staff time and the auditor’s fee, and the risk of waiting is a stalled contract. A readiness review first shows how big the gap is before anyone books an audit.

How to prepare

Pick a small, sensible scope and write it down.
Name one senior person who owns information security.
List your assets and the people who access them.
Run a simple risk assessment and keep the output.
Put the Cyber Essentials basics in place first (firewalls, secure settings, updates, access control, malware protection).
Write only the policies you will really follow.
Check your suppliers, including your IT provider.
Choose a UKAS-accredited certification body before booking an audit.

Frequently asked questions

Is ISO 27001 the same as Cyber Essentials? No. The NCSC says you cannot simply call an ISO/IEC 27001 certificate equivalent to a Cyber Essentials certificate.

How many controls does ISO 27001 have? Annex A lists 93, but you choose the ones your risks require and justify the rest.

Does ISO 27001 include penetration testing? Not as standard. The NCSC says physical testing of controls is not part of a standard ISO/IEC 27001 assessment.

Back to the Compliance hub.

Sources

How Wolfcore helps

Wolfcore’s secure-by-design consulting gets you ready for Cyber Essentials Plus, ISO 27001, SOC 2 or NIS2 without the paperwork taking over. See https://wolfcore.co.uk/services/secure-by-design-compliance/ for details.

What is ISO 27001? A plain-English guide for UK businesses