SECURITY
Readiness, not certification: Cyber Essentials, Essential Eight, NIS2
6 min read
Security frameworks fall into three different categories — certifications awarded by an accredited body, maturity models you assess yourself against, and legal obligations with no certificate at all — and conflating them leads organisations to buy the wrong kind of help.
A procurement questionnaire asks whether you are compliant with four frameworks. A supplier offers to make you compliant with all of them. Both treat the four as the same kind of thing, and they are not.
The distinction is practical rather than pedantic, because it determines who can actually give you what you need, and what you are entitled to claim afterwards.
We should be clear about our own position: RedTreeSupport does readiness work. We help organisations meet the technical requirements these frameworks describe. We are not a certification body and cannot award any of these marks.
Certifications: a body assesses you and issues something
Cyber Essentials in the UK is a certification. There is a self-assessed tier and an audited tier, and both result in a certificate issued through an accredited body after an assessment. You can state that you hold it, and it expires.
ISO 27001 works similarly at a much larger scale: an accredited certification body audits your information security management system and issues a certificate with a defined scope. The scope statement matters as much as the certificate.
For these, a consultancy prepares you. Only the accredited body certifies you, and a supplier who offers to certify you directly is either misdescribing their role or is the certification body.
Maturity models: you assess against levels
The Australian Signals Directorate's Essential Eight is a maturity model. It describes eight mitigation strategies at maturity levels zero to three. There is no certificate and no issuing body in the usual sense.
You assess your maturity, or an assessor does it for you, and you report a level. Being at maturity level two in the Essential Eight is a statement about your controls, not a credential someone awarded you.
The NIST Cybersecurity Framework is similar in kind: a structure for organising and describing a security programme, not something you pass.
- Certification — Cyber Essentials, ISO 27001: assessed by an accredited body, certificate issued, expires
- Maturity model — Essential Eight, NIST CSF: self or third-party assessed against defined levels, no certificate
- Legal obligation — NIS2, GDPR, PDPA: compliance is a legal state, with regulators rather than certifiers
Legal obligations: no certificate exists
NIS2 is European law. GDPR is European law. Singapore's PDPA is Singaporean law. You cannot be certified compliant with any of them, because there is no certifying body — there are regulators, and regulators assess after the fact, usually following an incident.
Suppliers do sell "NIS2 certification". What they are selling is an assessment against their reading of the directive and its national transpositions, which can be genuinely useful and is not a certificate of compliance. The distinction matters in a procurement response, where overclaiming is its own risk.
What this means when you are buying
If you need Cyber Essentials for a contract, you need a readiness partner and an accredited certification body, and they may or may not be the same organisation.
If a customer asks about Essential Eight, they want your maturity level and evidence for it, not a certificate.
If a regulator or a customer raises NIS2, they want to see that you have assessed your obligations and have controls and incident processes in place. A supplier's assessment report supports that; it does not discharge it.
The useful overlap
The reason all of this is manageable is that the underlying technical work overlaps heavily. Multifactor authentication, patching within defined windows, administrative privilege control, application allowlisting, backups that have been tested, logging and incident response appear across all of them.
So the sensible sequence is to do that work once, properly, and then map it to whichever frameworks your market asks about. Running three separate framework projects against the same controls is a common and expensive mistake.
Questions we get asked
Can a consultancy certify us against Cyber Essentials or ISO 27001?
No, unless they are themselves an accredited certification body for that scheme. A consultancy prepares you for assessment, and an accredited body assesses and issues. It is worth confirming which role a supplier is offering before signing.
Is there such a thing as NIS2 certification?
Not in the sense of a certificate of compliance, because NIS2 is law rather than a certification scheme. Suppliers offer assessments against the directive and its national implementations, which is useful preparation but is not a credential you can present as compliance.
Which framework should we start with?
Usually the one your customers or regulator actually ask about, since that determines what you need to be able to evidence. If nobody is asking yet, the common technical core — multifactor, patching, privilege control, tested backups, logging — is required by all of them and is never wasted work.