ISO/IEC 27001 by region
ISO 27001 certification in the UK: UKAS accreditation, Cyber Essentials, UK GDPR and the NIS Regulations
Clause by clause: ISO/IEC 27001:2022 requirements: every clause explained →
What is different about ISO/IEC 27001 in the United Kingdom: how UKAS accredits certification bodies, how to check a certificate, why public contracts also ask for Cyber Essentials, and how UK GDPR and the NIS Regulations interact with an ISMS.
Key points
- In the United Kingdom, certification bodies are accredited by UKAS, the national accreditation body appointed by government. UKAS accredits the bodies; it does not certify organisations, and its free CertCheck database lets buyers verify UKAS accredited management system certificates.
- Central government, its agencies and NHS bodies ask suppliers for Cyber Essentials under PPN 014, and the guidance says an ISO/IEC 27001 certificate does not automatically meet it. Most UK suppliers to the public sector need both, or proof of equivalent controls.
- UK GDPR requires security appropriate to the risk, and the ICO names Cyber Essentials as a starting point. An ISMS gives you the risk assessment that decides what "appropriate" means for you.
- Operators under the NIS Regulations are usually assessed against the NCSC Cyber Assessment Framework. The Cyber Security and Resilience (Network and Information Systems) Bill is still before Parliament and has not received Royal Assent.
Why UK organisations pursue ISO/IEC 27001
For most UK companies the request arrives in a supplier questionnaire. Banks, insurers, law firms and software buyers ask whether you hold an accredited ISO/IEC 27001 certificate before they share client data or connect you to their systems, and a certificate replaces pages of questions with one check. Scale-ups selling to enterprise customers in London, Manchester or Edinburgh meet the same question at due diligence.
Public-sector work adds a second layer. Suppliers to central government and the NHS are asked for Cyber Essentials, and Ministry of Defence suppliers meet it through Defence Standard 05-138. Neither replaces the other: Cyber Essentials proves five technical controls at a point in time, while ISO/IEC 27001 proves a managed, risk-based system across people, suppliers and processes. What the standard requires is covered in the requirements guide.
The local landscape: UKAS, accreditation and checking a certificate
UKAS describes itself as the national accreditation body for the United Kingdom, appointed by government to assess organisations that provide certification, testing, inspection and calibration. It is a signatory to the European co-operation for Accreditation arrangement and states that it is a member of the Global ACI arrangement, which from 1 January 2026 replaced the IAF and ILAC arrangements as the route to international recognition.
A certification body auditing you in the UK does not have to be UKAS accredited; accreditation is voluntary, and UKAS says it cannot comment on unaccredited bodies. What your customer needs is a certificate from a body accredited by an internationally recognised accreditation body, for information security and for the scope you actually deliver. Many UK buyers simply ask for a UKAS accredited certificate, so check the questionnaire before you choose.
To check a certificate, use UKAS CertCheck, and IAF CertSearch for bodies accredited elsewhere, remembering that uploads to CertSearch are voluntary, so a missing entry is a question, not a verdict. The verification guide covers the full check.
Local practice that changes the project
Cyber Essentials alongside the ISMS
PPN 014 applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. Evidence of Cyber Essentials, or equivalent, is essential when data is to be passed to the supplier and must be renewed annually for the contract. Build the five technical controls into the Annex A controls you already operate, so one set of evidence serves both. The Cyber Essentials hub explains the scheme.
UK GDPR and the ICO
Article 32 of UK GDPR requires technical and organisational measures appropriate to the risk. The ISMS risk assessment and Statement of Applicability become the record that shows how you decided. Include personal data processing, processors and breach handling in scope. The GDPR hub covers the privacy side.
NIS Regulations and the CAF
The Network and Information Systems Regulations 2018 apply to operators of essential services and relevant digital service providers. Most competent authorities use the NCSC Cyber Assessment Framework, and the NCSC states it is not a regulator. An ISO/IEC 27001 system supplies much of the governance and evidence a CAF assessment samples; the NCSC CAF page maps the relationship.
Group entities and the certificate
UK entities often sit inside a group with a parent abroad. Decide early whether the UK company holds its own certificate or sits under a group certificate, because Cyber Essentials is applied to the legal entity providing the service.
Local items to check, and where
| Local item | What it means for your project | Where to verify it |
|---|---|---|
| UKAS accreditation of the certification body | Confirms the body is accredited for information security certification and your scope | The UKAS directory of accredited organisations |
| Your certificate after issue | Customers check it online during onboarding | UKAS CertCheck and the certification body's register |
| Cyber Essentials or Cyber Essentials Plus | Needed for in-scope public contracts in addition to ISO/IEC 27001 | PPN 014 on GOV.UK and the NCSC certificate search |
| UK GDPR security duties | Shapes risk criteria, processor controls and breach handling | The ICO's guide to data security |
| NIS Regulations status | Decides whether a regulator will assess you against the CAF | The NIS Regulations guidance on GOV.UK and your competent authority |
| Cyber Security and Resilience Bill | Watch for changes in scope once enacted; plan on current law | The bill's page on the UK Parliament website |
How Sterling works in the United Kingdom
Sterling supports ISO/IEC 27001 certification in London and across the UK from its London office, on site and remotely, as part of an international practice of 8,100+ client engagements in 60+ countries since 2003. Sterling does not certify: an independent, accredited certification body audits you and decides, and we help you choose one whose accreditation your customers accept.
How Sterling supports UK organisations
One ISMS for your certificate, your tenders and your regulator
We begin with a gap analysis against the 2022 edition, build the ISMS around how your teams already work, align it with Cyber Essentials and UK GDPR, run it in Effivity, train your people and internal auditors, and stay with you through Stage 1 and Stage 2 with the body you select. We ensure successful certification for our clients.
Book a free discovery callISO/IEC 27001 in the UK: questions buyers ask
Does ISO 27001 replace Cyber Essentials for UK government contracts?
No. PPN 014 states that ISO/IEC 27001 does not automatically meet Cyber Essentials, so most suppliers hold both or demonstrate equivalent controls through an independent third party.
Must our ISO 27001 certificate be UKAS accredited?
Not by law, but many UK buyers ask for it. A certificate from a body accredited by another internationally recognised accreditation body may be accepted, so check the questionnaire or tender first.
Does ISO 27001 make us compliant with UK GDPR?
No, but it helps. It evidences the security measures Article 32 requires; lawful basis, rights and transparency sit outside it.
Will the Cyber Security and Resilience Bill require ISO 27001?
That cannot be said yet: the bill was at report stage in the House of Lords in September 2026, without Royal Assent. Plan on the NIS Regulations and your regulator's guidance, and treat a working ISMS as preparation rather than a guarantee.
ISO/IEC 27001 by region
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- ISO/IEC 27001 certification in Australia
- ISO/IEC 27001 certification in India
- ISO/IEC 27001 certification in the Netherlands and Europe
- ISO/IEC 27001 certification in Singapore and South East Asia
- ISO/IEC 27001 for telecommunications and data centres
- ISO/IEC 27001 certification in the Philippines
- ISO/IEC 27001 certification in the UAE and GCC
- ISO/IEC 27001 certification in the United Kingdom
- ISO/IEC 27001 timeline
- ISO/IEC 27001 training
- How to verify an ISO/IEC 27001 certificate, and how to spot a fake or a misleading one
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan your ISO/IEC 27001 certification in the United Kingdom with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice