Manufacturers and engineering firms are increasingly asked about information security by their customers. Sometimes the question is a questionnaire; sometimes it is a requirement for Cyber Essentials or ISO 27001 before a contract is awarded or renewed. The two are often mentioned together, but they do quite different jobs.
Cyber Essentials in brief
Cyber Essentials is a UK government-backed scheme that covers five core technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Basic certification is a self-assessment verified by a certification body; Cyber Essentials Plus adds a hands-on technical audit.
It is focused, relatively quick to achieve and well recognised in UK public-sector and supply-chain contracts.
ISO 27001 in brief
ISO/IEC 27001 is an international standard for an Information Security Management System (ISMS). Rather than a fixed checklist, it requires you to assess your own information risks, decide how to treat them, and run a management system that keeps doing so, including internal audits and management reviews.
It is broader and takes longer, but it is recognised worldwide and demonstrates that information security is managed as part of how the business runs.
The key differences
- Scope: Cyber Essentials covers core technical controls. ISO 27001 covers people, processes, suppliers and governance as well as technology.
- Approach: Cyber Essentials sets fixed requirements. ISO 27001 is risk-based and tailored to your business.
- Effort: Cyber Essentials can often be achieved in weeks. ISO 27001 usually takes several months.
- Recognition: Cyber Essentials is a UK scheme. ISO 27001 is international, which matters if you supply overseas customers.
Which should a manufacturer do first?
If a customer has asked for one specifically, start there. Otherwise, many manufacturers find that Cyber Essentials is the sensible first step: it fixes the basics quickly and satisfies many supply-chain requirements. ISO 27001 becomes the next step when larger or international customers ask for it, or when you want a structured way to manage information risk across the business.
Neither covers everything. Production downtime, payment fraud and business continuity need attention whichever route you choose.
This article is general guidance, not advice for your specific circumstances. If you'd like to talk about your business, get in touch.