Kyrylo Proskurnya, CEO at BALTUM | Corporate Member Insight Blog | 11 November 2026

A customer asks for "evidence of your security". A tender lists Cyber Essentials as a minimum requirement. An American prospect sends a vendor questionnaire asking for your SOC 2 report. A European partner wants to see an ISO/IEC 27001 certificate. For many organisations, this is how the question first arrives: not as a strategy, but as a request they need to answer quickly.

At BALTUM we work with organisations at every stage of this journey, from start-ups preparing for their first enterprise customer to established firms adding a second or third framework. The most common question we hear is simple: where do we start? This article compares the three routes, explains where they overlap and where they differ, and offers a practical way to decide.

Three different tools

Cyber Essentials is the UK Government-backed scheme, run by IASME on behalf of the NCSC. It focuses on five technical controls that protect against the most common internet-based attacks: firewalls, secure configuration, security update management, user access control and malware protection. The basic level is a verified self-assessment. Cyber Essentials Plus uses the same requirements but adds independent technical testing. Since 27 April 2026, new assessments follow version 3.3 of the requirements and the Danzell question set, which tightened expectations on multi-factor authentication, patching and scoping.

SOC 2 is an attestation report, not a certificate. It was developed by the American Institute of Certified Public Accountants (AICPA) and can only be issued by a licensed CPA firm. The auditor reports on a service organisation's controls against the Trust Services Criteria: security, which is mandatory, plus availability, processing integrity, confidentiality and privacy where relevant. A Type 1 report looks at control design at a point in time. A Type 2 report tests whether controls operated effectively over a period, usually three to twelve months.

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires an organisation to assess its own risks, select controls to treat them (Annex A of the 2022 edition lists 93), and run a management cycle of objectives, internal audit, management review and continual improvement. Certification is granted by an accredited certification body after a two-stage audit and is valid for three years, with annual surveillance audits.

What they have in common

Cyber Essentials, Cyber Essentials Plus, ISO/IEC 27001 and both types of SOC 2 report share more ground than their different names suggest:

Independent verification. In every case, someone outside the organisation checks the claim: a Cyber Essentials assessor, an accredited ISO certification body or a licensed CPA firm.
The same core technical controls. Access control and multi-factor authentication, timely patching, secure configuration, malware protection and network boundary protection appear in all of them.
A defined scope. Each one covers a stated part of the organisation, and customers increasingly check that the scope matches the service they are buying.
A recurring cycle. None of them is a one-off. Cyber Essentials is renewed every year, ISO/IEC 27001 has annual surveillance audits, and SOC 2 reports are refreshed annually.
The same commercial purpose. All five are used to win contracts, pass supplier due diligence and answer security questionnaires faster.

This overlap is good news. Work done for one framework is rarely wasted when you move to the next. An organisation with Cyber Essentials Plus has already built much of the technical baseline that ISO and SOC 2 auditors expect, and a working ISO/IEC 27001 ISMS usually covers most of the SOC 2 security criteria.

Where they differ

The real differences lie in what each option is designed to prove, and to whom. Cyber Essentials proves that a fixed set of basic controls is in place. ISO/IEC 27001 proves that the organisation runs a system for managing information security risk. SOC 2 gives the customer an auditor's detailed opinion on specific controls.

Here is how the five options compare in practice:

Cyber Essentials is a self-assessment questionnaire verified by an assessor. It results in a certificate valid for 12 months, usually takes one to four weeks, and starts at £320 plus VAT for the smallest organisations. It suits small UK suppliers taking their first step.
Cyber Essentials Plus covers the same controls but adds hands-on technical testing of a sample of devices. It also results in a 12-month certificate, typically within one to three months, and is often required by the UK public sector and larger UK buyers.
ISO/IEC 27001 is a two-stage audit of the whole information security management system by an accredited certification body. The certificate is valid for three years with annual surveillance audits, and first certification usually takes four to twelve months. It suits organisations with international customers and those that want security built into how the business is run.
SOC 2 Type 1 is a CPA examination of how controls are designed on a single date. The result is a report shared under NDA, usually within two to four months. It suits companies that need to show US customers credible evidence quickly.
SOC 2 Type 2 is a CPA examination of how controls operated over a period, usually three to twelve months. The report is renewed for each new period, and the first one typically takes six to fifteen months. It is what most US enterprise customers expect from a mature SaaS or technology provider.

Cyber Essentials or Cyber Essentials Plus

Both levels use the same five controls. The difference is evidence. At the basic level, the organisation answers the question set and an assessor reviews the answers. At the Plus level, an assessor also tests a sample of devices, scans for vulnerabilities and checks that malware protection and multi-factor authentication actually work. Plus must be completed within three months of the basic certificate, and since the 2026 update failures caused by missing patches lead to wider retesting. Buyers who ask for Plus are asking for proof, not a declaration.

SOC 2 Type 1 or Type 2

A Type 1 report confirms that controls are suitably designed and in place on a given date. It is faster and is often used as a first step to unblock a sale. A Type 2 report shows that the same controls worked consistently over a period, with the auditor testing samples across that time and reporting any exceptions. Most large US customers expect Type 2 in the end, so a sensible plan is Type 1 first, followed by a Type 2 period that starts immediately afterwards.

Certificate or report

Cyber Essentials and ISO/IEC 27001 end in a certificate: a clear pass that can be published and verified. SOC 2 ends in a report that the customer's security team reads in detail, including the system description and any exceptions. A certificate is a yes or no; a report is a conversation with your customer.

Choosing the right fit

There is no single best framework. The right choice depends on four things: where your customers are, what they ask for, what you want to achieve, and how mature your organisation is today.

Your Market

If you sell mainly in the UK, and especially to the public sector or large UK companies, Cyber Essentials is often the entry ticket. Many government contracts that handle personal data or deliver certain ICT services require it. If you sell internationally, ISO/IEC 27001 is the most widely recognised security certificate across Europe, the Middle East and Asia. If your growth depends on North American customers, particularly in software and cloud services, SOC 2 is usually what their procurement and security teams expect.

Your customers' requirements

The most reliable guide is what customers already ask for. Look at your last ten tenders, security questionnaires and contract clauses. If they keep naming one framework, that is your answer, whatever the theory says. If they ask for "an equivalent", check with the customer before assuming that one framework will be accepted in place of another.

Your business objectives

If the goal is to close a specific deal quickly, choose the framework that deal requires. If the goal is to reduce real risk and build security into how the business is run, ISO/IEC 27001 offers the strongest structure because it covers governance, people, suppliers and continuity as well as technology. If the goal is to shorten long security reviews with enterprise customers, a SOC 2 Type 2 report can answer many questionnaire items in a single document.

Your stage of development

For a small or early-stage organisation, Cyber Essentials is a sensible first step. It is affordable, quick, and fixes the basic weaknesses that most attacks exploit. As the organisation grows and starts handling larger customers or more sensitive data, ISO/IEC 27001 or SOC 2 becomes the natural next step. Organisations with a mixed UK, European and US customer base often end up with all three, and that is not unusual.

A practical roadmap

For organisations that are unsure where to begin, the following sequence works well in most cases:

Get the basics right with Cyber Essentials, then Cyber Essentials Plus. This gives you a quick, recognised result and a stable technical baseline.
Build an ISMS around that baseline. Define scope, assess risks, write the policies you actually need, and assign owners. This is the core of ISO/IEC 27001 and the foundation for SOC 2.
Certify to ISO/IEC 27001 if your customers are mainly in the UK, Europe or other international markets.
Add SOC 2 when US customers start asking for it. Map your existing controls to the Trust Services Criteria first; most of the work will already be done.
Run one programme, not three. Keep a single control set, a single risk register and a single evidence library, and map each control to every framework it supports.

The last point matters most. Organisations that treat each framework as a separate project tend to duplicate effort and end up with policies that contradict each other. Those that build one well-run security programme find that each additional framework is mostly a matter of mapping and audit.

How BALTUM helps

BALTUM works with organisations that need to show their security maturity to customers, regulators and partners, and want to do it once rather than three times. Our approach is to build one security programme and map it to every framework your market requires.

Framework selection. A short review of your customers, tenders and growth plans to decide which route to take first, and which to add later.
Gap assessment across all three. One assessment against Cyber Essentials, ISO/IEC 27001 and the SOC 2 Trust Services Criteria, so you see the full picture before you invest.
Cyber Essentials and Cyber Essentials Plus readiness. Practical help with scoping, device configuration, patching and multi-factor authentication, so the assessment passes first time.
ISO/IEC 27001 implementation. Risk assessment, policies, Statement of Applicability, internal audit and management review, prepared for certification audit by an independent accredited body.
SOC 2 Type 1 and Type 2. Readiness, control design and evidence collection, with the examination carried out by our licensed US CPA partners.
Training. ISO/IEC 27001 courses for teams who will run the system after we leave.

If you are deciding where to start, BALTUM can help you choose the route that fits your market and stage of growth. Visit baltum.io to arrange an initial conversation with our team.

Cyber Essentials, ISO/IEC 27001 and SOC 2 are not competitors. They answer different questions for different audiences. Cyber Essentials shows that the basics are in place. ISO/IEC 27001 shows that security is managed as part of the business. SOC 2 shows a customer, in detail, how your controls work. Cyber Essentials Plus and SOC 2 Type 2 add the proof that the controls work in practice. Start with what your customers need now, build one security programme, and let each new framework add to what you already have rather than start again.

About the author

Kyrylo Proskurnya is the CEO of BALTUM, an audit and consulting firm and a member of the UK Cyber Security Council. BALTUM helps organisations in the UK, Europe and beyond prepare for ISO/IEC 27001, SOC 2 (delivered with licensed US CPA partners) and other security and privacy frameworks. Kyrylo holds the CISA, CIPP/E, CIPP/US and AIGP certifications.

ℹ️ Please note: this blog post is an insight from one of our corporate members, sharing their activities and ideas. It is not an direct endorsement from the UK Cyber Security Council of specific products or services.