UK training guide
Cyber Essentials, CAF and UK GDPR: which course builds the skills your role needs?
A Cyber Essentials certificate, a CAF assessment and a UK GDPR obligation are three different things, and the people who work on them need different skills. This Mindset Cyber guide matches those jobs to the PECB courses we sell in the UK: ISO/IEC 27001 Lead Implementer and Lead Auditor for security management and audit, and ISO/IEC 27701 Lead Implementer for privacy management.
Last reviewed 8 November 2026
UK customers pay 20% VAT, added at checkout.
Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level.
Three references, three different purposes
Before choosing a course, be clear which of the three you work on, because each asks a different thing of you.
Cyber Essentials
Cyber Essentials is the UK government-backed scheme that certifies an organisation has five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus covers the same five controls and adds independent technical testing. Certification follows the scheme's own assessment route, and a personal credential of any kind is not a substitute for it. The job behind it is keeping those controls in place all year, not only in the weeks before renewal. The NCSC's Cyber Essentials overview is the starting point.
The Cyber Assessment Framework
The NCSC Cyber Assessment Framework is an outcomes-based framework for assessing and improving the cyber resilience of organisations, used where a regulator or customer asks for it. It is not a certification scheme: the NCSC says an assessment should state its version, the profile used, its scope and its limitations. The job is owning the outcomes, the evidence behind them and the improvement plan, or, on the other side of the table, assessing whether they are met.
The UK GDPR
The UK GDPR is data protection law, and it is about personal data rather than information security alone. Article 24 requires a controller to implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Regulation, and to review and update those measures where necessary. Security training does not discharge that duty. The job is deciding which measures are appropriate for your processing, running them and keeping the evidence of the decisions. Establish your legal obligations with your adviser; the text of Article 24 is on legislation.gov.uk.
Which course fits your role?
Start from the work you do most weeks. The two ISO/IEC 27001 Lead courses cover the same standard from opposite sides: one builds and runs the management system, the other checks it. The ISO/IEC 27701 course extends the system to privacy.
| Your role | The work | The course | Why |
|---|---|---|---|
| IT manager or security lead | Getting the business through Cyber Essentials or Cyber Essentials Plus, and keeping the five controls in place between certifications | ISO/IEC 27001 Lead Implementer | Scoping, risk treatment, choosing and justifying controls and measuring whether they work: the structure that keeps the five controls maintained rather than re-fixed each year. |
| Security lead at an operator or supplier assessed against the CAF | Owning the outcomes, the evidence behind them and the improvement plan | ISO/IEC 27001 Lead Implementer | The CAF is outcomes-based. An information security management system gives those outcomes an owner, a risk rationale and a documented trail. |
| Internal auditor or assurance reviewer | Checking whether controls or CAF outcomes are achieved, and reporting findings | ISO/IEC 27001 Lead Auditor | Audit planning, sampling, evidence, findings and follow-up: the difference between a control that exists and one that works. |
| Consultant or supplier security reviewer | Reviewing other organisations' security and advising on the gaps | ISO/IEC 27001 Lead Auditor, then Lead Implementer | Auditor first for evidence-based assessment, then implementer knowledge to advise on what to change. |
| Data protection officer or privacy manager | Owning the technical and organisational measures Article 24 of the UK GDPR requires, and the evidence that they are reviewed | ISO/IEC 27701 Lead Implementer | A privacy information management system is a structured way to run and evidence those measures. It is not legal advice and does not prove compliance. |
| New to security or GRC | Joining a team that works on any of these | ISO/IEC 27001 Foundation | The vocabulary and structure of an ISMS, with an exam that needs no experience. |
The split is simple. If you have to make it work, take the Lead Implementer. If you have to show whether it works, take the Lead Auditor. If personal data is the centre of your role, the ISO/IEC 27701 Lead Implementer sits on top of the ISMS.
What transfers from ISO 27001, and what does not
An honest map matters more than a flattering one. These are ISO courses, and none of them claims an official equivalence with Cyber Essentials, the CAF or the UK GDPR. What they give you is the working method behind all three.
What transfers
- Scope and risk treatment. Deciding what is in scope, which risks matter and which controls answer them. Cyber Essentials starts with scope, and the CAF starts with the systems that support essential functions.
- Choosing and documenting controls. An ISMS records why each control is in or out. The same record is what an assessor asks for when you say an outcome is achieved.
- Evidence and effectiveness. The CAF asks whether outcomes are achieved, not whether a policy exists. Internal audit and measurement are how an ISMS answers the same question.
- Review and improvement. Article 24 asks for measures that are reviewed and updated. Management review and continual improvement are that cycle, applied to privacy through ISO/IEC 27701.
What does not
- The certificate or the assessment. Cyber Essentials certification comes from the scheme, and a CAF assessment comes from whoever is assessing you. A PECB credential is a personal certification and does not stand in for either.
- The five controls' technical detail. The courses teach a management system, not the configuration of firewalls or patching. The scheme's own documents set the technical bar.
- Legal compliance. A privacy information management system evidences your measures; whether they are appropriate for your processing is a legal judgement for your organisation and its advisers.
The three courses
All three are PECB eLearning: Pre-recorded video lessons by PECB Certified Trainers, with quizzes and the official course materials on myPECB. Each is designed for about 30 to 40 hours of study, the content of a five-day course, and carries 31 CPD credits. Each exam is 3 hours, 80 multiple-choice questions, open book with the standard, booked into one of PECB's online sessions in myPECB.
ISO/IEC 27001 Lead Implementer
For the people who build and run the information security management system: context and scope, risk assessment and treatment, the Statement of Applicability, implementing controls, measuring them, internal audit, management review and improvement. It leads to the PECB Certified ISO/IEC 27001 Lead Implementer credential. A pass with no experience earns the Provisional level; the full credential asks for five years of experience, two in information security management, and 300 hours of project work. £449 + VAT.
ISO/IEC 27001 Lead Auditor
For the people who check it: audit principles, planning an audit, collecting and evaluating evidence, writing findings, reporting and follow-up, for internal audits and for audits on behalf of a certification body. It leads to the PECB Certified ISO/IEC 27001 Lead Auditor credential, with the same Provisional level and a full level that asks for 300 hours of audit work. £449 + VAT.
ISO/IEC 27701 Lead Implementer
For the people who own privacy: designing, implementing and maintaining a privacy information management system that extends an ISMS, with privacy risk treatment, documentation and monitoring. It leads to the PECB Certified ISO/IEC 27701 Lead Implementer credential, with a Provisional level for a pass without experience. £449 + VAT.
Each course includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community.
UK customers pay 20% VAT, added at checkout.
How to choose: five questions
- Do you make the controls work, or check whether they do? Making them work points to the Lead Implementer; checking points to the Lead Auditor.
- Which reference drives your work? Cyber Essentials, the CAF and Article 24 all run on scope, risk treatment and evidence, so the Lead Implementer serves all three on the implementation side.
- Is personal data the centre of it? Then add the ISO/IEC 27701 Lead Implementer, which extends the ISMS to privacy.
- Do you review other people's systems? Assurance, second-line and consulting roles get more from the Lead Auditor first.
- Are you starting out? Take the ISO/IEC 27001 Foundation first, or go straight to a Lead course and sit the exam for the Provisional level.
Frequently asked questions
Does an ISO 27001 course cover Cyber Essentials?
No. The PECB ISO/IEC 27001 Lead Implementer and Lead Auditor courses teach the ISO/IEC 27001 management system. Cyber Essentials is a separate government-backed scheme of five technical controls with its own assessment, and a PECB credential is not a Cyber Essentials certificate. The method transfers: scoping, treating risk, keeping evidence and checking that controls work.
Is the Cyber Assessment Framework a certification?
No. The NCSC describes the CAF as an outcomes-based framework for assessing and improving cyber resilience, not a certification scheme. An assessment should state its version, the profile used, its scope and its limitations. A PECB credential is a personal certification in ISO/IEC 27001 implementation or auditing, which is a different thing.
Does ISO 27701 make my organisation UK GDPR compliant?
No course or management system does that by itself. Article 24 of the UK GDPR requires a controller to implement appropriate technical and organisational measures, to be able to demonstrate compliance, and to review and update those measures where necessary. A privacy information management system under ISO/IEC 27701 is a structured way to run and evidence those measures. Whether they are sufficient for your processing is a legal question.
Lead Implementer or Lead Auditor for Cyber Essentials and CAF work?
Lead Implementer if you have to make the controls or outcomes work: scoping, risk treatment, selecting controls, measuring effectiveness and management review. Lead Auditor if you have to show whether they work: planning audits, collecting evidence, writing findings and following them up.
Which course suits a data protection officer?
The ISO/IEC 27701 Lead Implementer. It covers designing, implementing and maintaining a privacy information management system that extends an ISO/IEC 27001 ISMS: privacy risk treatment, documentation and monitoring. Mindset Cyber sells it in the UK as PECB eLearning for £449 + VAT.
What do the courses include, and what do they cost in the UK?
The ISO/IEC 27001 Lead Implementer and Lead Auditor are £449 + VAT each and the ISO/IEC 27701 Lead Implementer is £449 + VAT. Each includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. UK customers pay 20% VAT, added at checkout.
Do I need experience before I enrol?
No. You can take any of these courses and sit the exam with no experience. A pass with no experience earns the Provisional level of the credential, and you upgrade once you have the experience the full level asks for. If you are new to information security, the ISO/IEC 27001 Foundation course is the entry point.
Next steps
Every course is priced in pounds and includes the PECB exam voucher, two exam attempts and the certification fee.
PECB Certified ISO/IEC 27001 Lead Implementer
£449 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 31 CPD credits.
View course → Official PECB eLearningPECB Certified ISO/IEC 27001 Lead Auditor
£449 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 31 CPD credits.
View course → Official PECB eLearningPECB Certified ISO/IEC 27701 Lead Implementer
£449 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 31 CPD credits.
View course →Sources
Every source was read on 8 November 2026. Quotations keep their original spelling.
- NCSC, Cyber Essentials overview: https://www.ncsc.gov.uk/cyberessentials/overview
- NCSC, Cyber Assessment Framework collection: https://www.ncsc.gov.uk/collection/cyber-assessment-framework
- UK GDPR, Article 24, Responsibility of the controller (legislation.gov.uk, latest available revised text): https://www.legislation.gov.uk/eur/2016/679/article/24
- PECB, Candidate Handbooks, ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor and ISO/IEC 27701 Lead Implementer: https://pecb.com/