--- title: "Risk vs Rules: Understanding the Difference." description: Gain insights into cybersecurity standards ISO 27001-2013 and Cyber Essentials Plus. Understand the difference between rule-based and risk-based approaches image: https://www.aabyss.uk/hubfs/Robert%20Gibbons%20ISOCYBER.png --- [![Aabyss Logo](https://www.aabyss.uk/hs-fs/hubfs/Untitled%20design-1.png?width=218&height=61&name=Untitled%20design-1.png "Aabyss Logo")](https://www.aabyss.uk/) ### 0151 733 3223 - [**](https://www.facebook.com/aabysstech/) - [**](https://twitter.com/aabysstech) - [**](https://www.linkedin.com/company/aabysstech/) - [**](mailto:hello@aabyss.uk) ![Aabyss Blog Heading Background](https://www.aabyss.uk/hubfs/48.jpg "Aabyss Blog Heading Background") ## News & Opinion #### Gain the edge on the world of business technology and cyber security # Risk vs Rules: Understanding the Difference. Posted by [Robert Gibbons](https://www.aabyss.uk/news/author/robert-gibbons) | 25-Jul-2024 12:34:29 - [Tweet](https://twitter.com/share) ![Aabyss Chief Revenue Officer, Robert Gibbons Article. ](https://www.aabyss.uk/hubfs/Robert%20Gibbons%20ISOCYBER.png) Understanding ISO 27001-2013 and Cyber Essentials Plus: A Comparative Study  Two cybersecurity standards often come to the forefront: ISO 27001-2013 and Cyber Essentials Plus. Both are designed to fortify an organisation's cybersecurity measures, but their focus and scope differ. This article aims to elucidate these differences, particularly in risk and rules.    #### Cyber Essentials Plus: The Rule-Based Approach  Cyber Essentials Plus is a UK Government-backed scheme managed by the National Cyber Security Centre (NCSC) in partnership with the Information Assurance for Small to Medium Enterprise (IASME) Consortium. It promotes a standard set of IT Security requirements designed to help minimise the likelihood and impact of commonly known cyber-attacks.  The scheme is centred on five technical controls for fundamental cybersecurity:  1. Firewalls 2. Secure Configuration 3. User Access Control 4. Malware Protection 5. Security Update Management   These controls form the rules that organisations must follow to achieve certification. The scheme consists of two levels of certification: Cyber Essentials (self-assessment) and Cyber Essentials Plus. The latter involves physically testing the scope's devices, applications, and services. This level of certification affords a higher level of assurance that the correct controls are implemented and working as expected.    #### ISO 27001-2013: The Risk-Based Approach  ISO 27001-2013, on the other hand, is an international standard developed to handle information security. Unlike Cyber Essentials Plus, which is limited to IT, ISO 27001 offers a more comprehensive framework, covering all information, whether online or offline.  ISO 27001 is very pragmatic—it's easy to tailor to your requirements. It incorporates critical risk assessment and mitigation controls, allowing organisations to identify and address potential vulnerabilities based on their unique risk profiles. This risk-based approach provides flexibility, enabling organisations to implement controls most relevant to their operations.  #### Risk vs Rules: The Key Difference  The primary difference between Cyber Essentials Plus and ISO 27001-2013 lies in their approach to cybersecurity: one is rule-based, and the other is risk-based².  Cyber Essentials Plus provides a set of specific rules that organisations must follow to protect against common cyber threats. It's a more prescriptive approach with precise pass-or-fail criteria. This makes it a very accessible starting point for smaller and medium-sized organisations looking to establish a secure baseline for their current security controls.  ISO 27001-2013, in contrast, adopts a risk-based approach. It allows organisations to assess their specific risk environment and implement controls accordingly. This flexibility makes ISO 27001-2013 suitable for organisations of all sizes and types, providing a comprehensive framework for managing information security.  #### In conclusion:   Cyber Essentials Plus and ISO 27001-2013 are crucial in fortifying an organisation's cybersecurity measures. While Cyber Essentials Plus provides a rule-based framework for fundamental cybersecurity, ISO 27001-2013 offers a risk-based comprehensive information security management approach. The choice between the two will depend on an organisation's specific needs and objectives.  Additional Cyber Security Information/Stats:  Phishing is the most common breach or attack on a business, accounting for 84% for companies and 83% for charities. Another area of growth is the impersonation of a company, which now accounts for 35% (and 37% for charities).   Only 22% of businesses have a formal incident response plan (19% for charities).   Businesses with Cyber Essentials are 92% less likely to claim Cyber Insurance.     Source of information:   Gov UK: Cyber Security Breach Survey 2024 [[read more](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024/cyber-security-breaches-survey-2024)]  National Cyber Security Centre: Cyber Essentials [[read more](https://www.ncsc.gov.uk/cyberessentials/overview)]  Citation (QMS): ISO 27001 Certification Information Security Management [[read more](https://www.qmsuk.com/iso-standards/iso-27001)]  Certified Information Systems Security Professional – Chris Blunt [[LinkedIn](https://www.linkedin.com/in/chrisblunt/)]   Topics: [Insider](https://www.aabyss.uk/news/topic/insider), [Aabyss News](https://www.aabyss.uk/news/topic/aabyss-news), [IT News](https://www.aabyss.uk/news/topic/it-news), [Strategy](https://www.aabyss.uk/news/topic/strategy), [Productivity](https://www.aabyss.uk/news/topic/productivity) #### Written by [Robert Gibbons](https://www.aabyss.uk/news/author/robert-gibbons) "I am the Chief Revenue Officer for Aabyss, with over two decades of experience in the Managed Service Provider sector for Technology. Over this period, I’ve seen a lot of changes in the technological world. Keeping my finger on the pulse, I like to share my knowledge so that others can benefit. Advances in the digital world should be embraced rather than ignored. Outside of work, I like walking and hiking to help recharge my inner batteries." [LinkedIn](https://www.linkedin.com/in/robertgibbons) ## Leave a Comment ### Recent Posts ### Topics - [Aabyss News (45)](https://www.aabyss.uk/news/topic/aabyss-news) - [AI (3)](https://www.aabyss.uk/news/topic/ai) - [Artificial Intelligence (3)](https://www.aabyss.uk/news/topic/artificial-intelligence) - [Attack (12)](https://www.aabyss.uk/news/topic/attack) - [Backup (4)](https://www.aabyss.uk/news/topic/backup) - [BYOD (1)](https://www.aabyss.uk/news/topic/byod) - [Cloud (12)](https://www.aabyss.uk/news/topic/cloud) - [Connectivity (7)](https://www.aabyss.uk/news/topic/connectivity) - [Customer (2)](https://www.aabyss.uk/news/topic/customer) - [Cyber (18)](https://www.aabyss.uk/news/topic/cyber) - [Cyber Insurance (2)](https://www.aabyss.uk/news/topic/cyber-insurance) - [Cybersecurity (53)](https://www.aabyss.uk/news/topic/cybersecurity) - [Data Management (5)](https://www.aabyss.uk/news/topic/data-management) - [Disaster Recovery (6)](https://www.aabyss.uk/news/topic/disaster-recovery) - [Emerging (3)](https://www.aabyss.uk/news/topic/emerging) - [Hospitality (2)](https://www.aabyss.uk/news/topic/hospitality) - [Insider (2)](https://www.aabyss.uk/news/topic/insider) - [IT News (36)](https://www.aabyss.uk/news/topic/it-news) - [IT Support (24)](https://www.aabyss.uk/news/topic/it-support) - [Managed Service (35)](https://www.aabyss.uk/news/topic/managed-service) - [Management (13)](https://www.aabyss.uk/news/topic/management) - [Outsourced IT (2)](https://www.aabyss.uk/news/topic/outsourced-it) - [Password (7)](https://www.aabyss.uk/news/topic/password) - [Productivity (36)](https://www.aabyss.uk/news/topic/productivity) - [Ransomware (4)](https://www.aabyss.uk/news/topic/ransomware) - [Security (51)](https://www.aabyss.uk/news/topic/security) - [Social Media Threats (2)](https://www.aabyss.uk/news/topic/social-media-threats) - [Strategy (24)](https://www.aabyss.uk/news/topic/strategy) - [Technologies (6)](https://www.aabyss.uk/news/topic/technologies) - [Technology (29)](https://www.aabyss.uk/news/topic/technology) - [Technology Budgeting (1)](https://www.aabyss.uk/news/topic/technology-budgeting) - [Tips & Tricks (16)](https://www.aabyss.uk/news/topic/tips-tricks) - [WiFi (1)](https://www.aabyss.uk/news/topic/wifi) - [Work-from-home (1)](https://www.aabyss.uk/news/topic/work-from-home) [see all](https://www.aabyss.uk/news/risk-vs-rules-understanding-the-difference#) #### ABOUT AABYSS We are commercially focused technology strategists who help clients outperform their competitors through proven leadership, management and support. We make informed IT decisions to simplify your technology needs and support your growing business. ### Subscribe for Cyber Security Updates #### LIVERPOOL OFFICE 19 Meridian Business Village Hansby Drive Liverpool L24 9LG [///cocktail.audible.bulbs](https://what3words.com/cocktail.audible.bulbs) T: 0151 733 3223 E: [hello@aabyss.uk](mailto:hello@aabyss.uk?subject=Website%20Enquiry) #### SHEFFIELD OFFICE 3 Newton Business Centre Thorncliffe Park Estate  Newton Chambers Road Sheffield S35 2PH [///countries.winded.winter](https://what3words.com/countries.winded.winter) T: 0114 361 0062 E: [hello@aabyss.uk](mailto:hello@aabyss.uk?subject=Website%20Enquiry)   #### COMPANY POLICY [Service Level Standards](https://www.aabyss.uk/service-level) [Cookie Policy](https://www.aabyss.uk/cookie-policy) [Privacy Policy](https://www.aabyss.uk/privacy-policy) [Complaints](https://www.aabyss.uk/complaints-policy) [Modern Slavery](https://www.aabyss.uk/hubfs/Downloads/Modern%20Slavery%20Statement.pdf) [Report Abuse](https://www.aabyss.uk/abuse) Company Registered in England & Wales, Company No. 04726959 - [**](https://www.facebook.com/aabysstech/) - [**](https://twitter.com/aabysstech) - [**](https://www.linkedin.com/company/aabysstech/) ©2025 Aabyss Ltd. ** ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Robert Gibbons", "url" : "https://www.aabyss.uk/news/author/robert-gibbons" }, "dateModified" : "2024-07-25T11:34:29.815Z", "datePublished" : "2024-07-25T11:34:29.000Z", "headline" : "Risk vs Rules: Understanding the Difference.", "image" : [ "https://www.aabyss.uk/hubfs/Robert%20Gibbons%20ISOCYBER.png" ], "mainEntityOfPage" : { "@id" : "https://www.aabyss.uk/news/risk-vs-rules-understanding-the-difference", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.aabyss.uk/hubfs/Untitled%20design-1.png" }, "name" : "Aabyss Ltd" } } ```