A customer wants a security standard. CyFun, ISO 27001 or Cyber Essentials?

No Irish law in force on 15 October 2026 requires an ordinary small business to hold CyFun, ISO 27001 or Cyber Essentials. The security duty that does apply to any business handling personal data is in the GDPR. It asks for appropriate technical and organisational measures, giving a level of security suited to the risk (Article 32). It mentions measures such as encryption, the ability to restore data after an incident, and regular testing of whether the measures work. It names no standard. Following an approved code of conduct, or holding an approved GDPR certification, can count as one part of showing you comply (Article 32(3)). On 15 October 2026 none of the three was in the European Data Protection Board's register of approved certification mechanisms.

NIS2 is the EU directive that lists the cyber security measures the organisations it covers must take. It is not Irish law yet. The National Cyber Security Centre (NCSC) says Ireland missed the 17 October 2024 deadline for making it Irish law (transposition). It also says the older rules NIS2 replaces still apply in full to the most critical operators in the State. On 8 July 2026 the European Commission referred Ireland to the Court of Justice for failing to notify it that NIS2 had been made Irish law. On 7 October 2026 the Law Society Gazette reported that a draft Bill was still being prepared. Once NIS2 is Irish law, it will apply to medium-sized and larger organisations in the sectors listed in its annexes (Article 2(1)). Some organisations are covered whatever their size (Articles 2(2) to 2(4)), among them trust service providers, DNS service providers, domain name registration services and critical entities. Where NIS2 stands in Ireland has the detail.

Where there is a requirement, it comes from somebody else. A contract can name a standard. A public tender's documents can ask for one. A bank, insurer or other financial firm may only use technology suppliers (ICT service providers) that meet appropriate information security standards. That rule is Article 28(5) of the Digital Operational Resilience Act (DORA), which has applied since 17 January 2025. It names no standard. UK central government and NHS bodies require Cyber Essentials, or equivalent controls, from suppliers on certain contracts, under a procurement policy note covered below. If none of those applies to you, holding any of the three is a choice.

The detail behind each row is in the sections that follow.

CyberFundamentals, shortened to CyFun, is a framework owned by the Centre for Cybersecurity Belgium (CCB). Ireland's NCSC has joined it as a scheme co-owner, and the NCSC's FAQ says Ireland will adopt CyFun as its national assessment and certification scheme.

The NCSC's own CyFun page makes three points worth remembering. Certification or self-assessment under CyFun is optional. CyFun is one recognised way to organise your security controls and show evidence of them, but the law does not assume you comply because you use it. And whether an organisation complies with NIS2 will be decided by the regulator that Irish law names (the competent authority). The FAQ adds that the CyFun tool does not prove an organisation meets its NIS2 obligations.

The NCSC page is out of date on versions. On 15 October 2026 it still said version 1 is available now and the second version is due in September 2025. The CCB launched CyFun 2025 in October 2025. It is built on version 2.0 of the NIST Cybersecurity Framework. The CCB says CyFun 2023 and CyFun 2025 run side by side until 18 April 2027, and organisations can use either until then.

The CCB sets three assurance levels: Basic, Important and Essential. Before them comes an entry level called Small, for very small organisations or those with limited technical knowledge. Small is a first assessment only. It is not one of the three assurance levels, and the CCB's scheme for independent checks (its conformity assessment scheme) does not cover it. Basic holds what the CCB calls the standard information security measures for all enterprises. Important is designed to resist targeted attacks by attackers with common skills and resources. Essential is designed to resist advanced attacks by attackers with extensive skills and resources.

Beyond self-assessment, the CCB's scheme uses an independent assessor (a conformity assessment body, accredited under Regulation (EC) No 765/2008). Basic and Important are verified by an assessor working to ISO/IEC 17029. Essential is certified by an assessor working to ISO/IEC 17021-1. The CCB's FAQ describes how a Belgian organisation goes from a verification to a CyFun label.

Ireland has no equivalent yet. The NCSC's FAQ, last updated on 23 June 2025, says certification is expected to be available by 2027. The National Cyber Security Strategy 2030, published on 7 October 2026, sets later targets. By Q3 2027, CyFun is to be formally approved (sanctioned) as a national voluntary certification scheme, the step that lets certification bodies be accredited. By Q4 2029, there are to be two accredited certification bodies. Neither of the NCSC's CyFun pages names an Irish body that verifies or certifies CyFun today. On 15 October 2026, INAB's two directories (one of certification bodies, one of validation and verification bodies) listed no body with CyFun in its scope. What an Irish business can do now is the self-assessment. The CCB says CyFun is free, and you can download its self-assessment tool from the CCB's site.

The first step is the CCB's selection tool, a risk assessment that points to the assurance level to use. The NCSC says it weighs the organisation's size, sector, risk exposure and the potential impact of an incident.

CyFun 2025 Basic has 34 requirements in 17 categories, grouped under the six functions of the NIST framework: govern, identify, protect, detect, respond and recover. Among them are a written policy for managing cyber security risk, inventories of hardware, software and data, awareness training, safe disposal of equipment, an incident response plan and a recovery process.

The CCB's Excel tool asks for two scores from 1 to 5 against every requirement: one for how well your written policies and procedures cover it, one for how mature the practice is. It averages them into each category and then into a total. The CCB's Basic workbook sets a target of 2.5 out of 5 for the total and for each key measure. On the implementation scale, level 2 is a process that exists informally, and level 3 is a formal process that is implemented, with evidence for most activities. On the documentation scale, level 2 is formally approved documentation that has not been reviewed in the previous two years, and level 3 is approved documentation whose exceptions are documented and approved.

Thirteen of the 34 are key measures. The CCB chose them with common types of attack in mind, and its booklet says they must be addressed at this level. Here they are in plain words, with the CCB's reference for each:

ISO/IEC 27001 is published jointly by ISO and the IEC. The current edition, the third, was published in October 2022, and one amendment, on climate action, followed in 2024. ISO describes it as the standard that defines the requirements an information security management system must meet: a system for identifying and managing information security risks, maintained and improved over time.

Its Annex A lists 93 controls in the 2022 edition, in four groups: organisational, people, physical and technological. A certificate is tied to a Statement of Applicability, which the CCB says includes a list of the security measures an organisation has implemented or is implementing. The NCSC's CyFun FAQ, using the definition in ISO/IEC 27006-1, says that statement has to be backed up: there must be evidence that a control is in place and works.

Certification is voluntary, and ISO's own guidance says so: a business can implement the standard without certifying. Certificates come from certification bodies, after their own audit. In Ireland the Irish National Accreditation Board (INAB) accredits those bodies, and ISO notes that a certificate from an accredited body comes with an accreditation body's independent confirmation that the certifier is competent. On 15 October 2026 INAB's directory listed three certification bodies accredited by INAB with ISO/IEC 27001 in their scope: Amtivo (Ireland), NSAI and West Assured Solutions.

The one Irish cost figure found is a certification body's own. Amtivo, which is INAB-accredited and sells ISO 27001 certification, published a guide on 26 November 2024 saying a business with fewer than 10 staff on one site might expect to pay between €4,500 and €7,000 for initial certification. The guide does not say whether that includes VAT. After that comes a three-year cycle with an audit each year, and a recertification audit every three years.

That figure covers the certification only. Amtivo's guide says the stage before the certification audit, writing the documentation and auditing yourself internally, may cost the most in money, time and resources. It says an external consultant is optional, and puts consultants' day rates at around €450 to €1,200 where one is used. No Irish certification body's page read for this guide gives an overall timeline, so none is given here.

Cyber Essentials is the UK NCSC's scheme, and the NCSC describes it as the minimum standard of cyber security the UK Government recommends for organisations of all sizes. IASME is the NCSC's delivery partner. The scheme certifies five technical controls:

Cyber Essentials is a self-assessment questionnaire, signed off by a board member or equivalent and marked by an assessor. A certificate is valid for 12 months and is renewed each year. Cyber Essentials Plus covers the same five controls and adds independent technical testing of whether they work. IASME requires the Cyber Essentials self-assessment before it. The NCSC's page prices Cyber Essentials from £320 plus VAT, depending on the size of the organisation, and says Plus is quoted by the size and complexity of the network.

An Irish business can be certified. IASME, which runs the scheme for the NCSC, requires its certification bodies to be based in the UK or the Crown Dependencies, with at least 70% of their Cyber Essentials certifications going to UK-based organisations. Amtivo's Irish site sells Cyber Essentials from €370 plus VAT, depending on headcount, through a sister company. For organisations outside the UK, IASME also runs a separate scheme, IASME Cyber Baseline, and says Cyber Essentials is the recommended minimum for organisations based in the UK.

According to the NCSC's page, the free cyber liability insurance that comes with certification is for UK organisations with a turnover under £20 million, where the certification covers the whole organisation. The page says nothing about businesses outside the UK.

The requirement that matters is UK public procurement. The Cabinet Office published Procurement Policy Note 014 (PPN 014) on 17 February 2025, applying from 24 February 2025. It covers UK central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. Some contracts have the supplier handle citizens' or government employees' personal information, or ICT systems holding data at the OFFICIAL classification, among other features. For those, buyers set Cyber Essentials or Cyber Essentials Plus as the technical requirement. A supplier without it must show equivalent controls by other means. PPN 014 says a technically competent, independent third party should normally check that equivalence, and must always check it where Cyber Essentials Plus is the requirement.

You must show the certificate, or evidence of equivalent controls, before the contract is awarded. Only in exceptional cases, where a certificate has expired and is being renewed, may a buyer let the contract start without it. Even then, the supplier must have it by the time data is passed over. A certificate must be renewed each year for the life of the contract. The note tells buyers not to apply the scheme to every contract as a matter of course, and not to deter small businesses from bidding.

PPN 014 also answers the ISO 27001 question for these contracts. An ISO 27001 certificate does not automatically meet Cyber Essentials, because an ISO 27001 certificate does not usually cover all five controls, and its audit is unlikely to test them. A holder will usually need Cyber Essentials as well, or evidence of equivalent controls.

Outside UK government and the NHS, it comes up when a UK customer asks for it, on its own terms. The NCSC's page says a growing number of organisations require suppliers to be certified to bid for work. A customer in Ireland asking for Cyber Essentials is asking for a UK scheme. It is reasonable to ask whether it would accept ISO 27001 instead, or a CyFun Basic self-assessment, which is as far as CyFun goes in Ireland today.

Article 21(2) of NIS2 lists the minimum measures an organisation it covers has to take: policies on risk analysis and information system security; incident handling; business continuity, such as backups and disaster recovery, and crisis management; supply chain security; security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure; assessing whether the measures work; basic cyber hygiene and training; cryptography and, where appropriate, encryption; human resources security, access control and asset management; and multi-factor or continuous authentication and secured communications, where appropriate. Under Article 21(3), the organisation must also take account of its direct suppliers' cyber security practices. That is how the question reaches a supplier with no NIS2 duties of its own. What an in-scope customer asks a supplier covers that side.

The Directive requires none of the three, and its Articles name none of them. Article 21(1) says the measures must take account of relevant European and international standards where they apply. Article 25 has Member States encourage the use of standards without imposing or favouring a particular type of technology. The recitals (the explanatory text before the Articles) name a few standards as examples. Only one of the three appears there, and only indirectly: recital 79 gives the ISO/IEC 27000 series, which ISO/IEC 27001 belongs to, as an example for the physical and environmental security of systems.

CyFun is the one its owner has aligned with NIS2. The CCB says CyFun 2025 was created to match standards such as NIST CSF 2.0 and legislation such as the NIS2 Directive, and it publishes a mapping that relates each CyFun 2025 requirement to clauses of ISO/IEC 27001:2022, controls of ISO/IEC 27002:2022 and points of Article 21. The CCB calls the mapping helpful guidance, not an authoritative source or a compliance guarantee. In Belgium, where NIS2 is law, the CCB's FAQ says CyFun sets out how the minimum measures in the Belgian NIS2 law are assessed in practice. An essential entity there can use a CyFun verification or certification for its regular conformity assessment. In Ireland the NCSC recommends CyFun as the preferred way to show you meet its draft risk management measures, and says it is not the only route.

ISO 27001 is one of the other routes the NCSC names. It says it will continue to recognise internationally accepted standards such as ISO 27001, and that organisations can use frameworks such as ISO 27001, COBIT, NIST or their own information security management system to meet its draft measures. In Belgium an ISO 27001 certificate can be used if its Statement of Applicability is shown to be equivalent to the right CyFun level, which the CCB says takes additional work and interpretation.

Cyber Essentials has no formal NIS2 role. Neither the Directive nor the NCSC's or the CCB's pages read for this guide mention it. Its five controls are all technical, so Article 21's incident handling, business continuity and supply chain security are outside them.

In order of who is asking.