TRY MATPROOF FREE FOR 14 DAYS. €0 TODAY, CANCEL IN ONE CLICK

UK SMEs · ISO 27001 and Cyber Essentials · 2026

Best ISO 27001 and Cyber Essentials software for UK SMEs

There is no single best tool. For a small UK company, PICMS publishes GBP prices (ISO plans from £149 a month) and says customer data sits in AWS London.[19] Conformio is the cheapest published ISO 27001-only software at US $169 a month, with a 14-day trial and no card.[1] CyberSmart fits if you only need Cyber Essentials: it says every quote includes the certification fee.[3] ISMS.online, Vanta, Drata, Scytale and SureCloud publish no price. All values as of 9 November 2026, from the vendor pages.

We compared 11 tools. The table is alphabetical, with no ranking, and Matproof sits in it on the same terms. Where a vendor page says nothing, the cell says “not stated”.

· 29 sources

Comparison table

11 tools: company, frameworks, hosting, price, trial

Every value comes from the vendor's own page, read on 9 November 2026. We did not use review sites. “Not stated” means we found nothing on the pages listed in the sources, not that the feature does not exist. Ask the vendor before you buy.

Matproof is highlighted because this page is published by Matproof. That is not a recommendation. Hicomply's pricing page shows two different GBP figures for Professional, so we give the USD figure.
ToolCompany and location (as stated)ISO 27001Cyber EssentialsData hosting (as stated)Published priceFree trialSource
Conformio (Advisera)Advisera Expert Solutions Ltd; offices in Zagreb, Croatia and New York, USAYes (ISO 27001 only today)not stated“Secure cloud platform”; provider and region not statedStarter US $169/month or $1,399/year (€145/month); Professional $289/month; Advanced $349/month14 days, no card[1]
CyberSmartCyberSmart Ltd, London; registered in England and WalesReporting aligned to ISO 27001 in the Cyber Essentials Plus and Vulnerability Manager plansYes, Cyber Essentials and Cyber Essentials Plus; certification fees included in every quotenot statedCustom quote, no figureOn request (contact them)[2][3][4]
DrataDrata Inc.; offices include San Francisco and London (no HQ named)YesYes, listed as a frameworkAWS and Google Cloud; region not statednot stated (plan tiers, no figures)not stated[5][6][7][8]
HicomplyGlobal HQ in North Shields, UK; also Manchester and Denver, USAYesnot statednot statedFrom £5,300 / $6,995 a year; Professional $13,995 a year; Enterprise on applicationnot stated[9][10]
High Table (toolkit)The High Table Global Limited, Leeds, UKYes, as document templates and checklists, not softwarenot statedNot applicable to the templatesTemplates Pack £97; guided pack £490; consultant toolkit £497. A separate ISO 27001 platform is listed “from £3,500”not stated[11][12]
ISMS.onlineNile House, Brighton, EnglandYesYes, Cyber Essentials requirements v3.1 and the Plus test specification are listednot statednot stated (“bespoke to you”)A trial is offered in the FAQ; free or paid not stated[13][14]
MatproofVantarGroup LLC, Sheridan, USAYes, with NIS2, DORA, GDPR, SOC 2 and the EU AI ActYes, from the same control library as ISO 27001; evidence mapped to the five controls. Matproof is not a certification bodyPersistent customer data stored in the EUSee pricing page14 days; card required, nothing charged today[15][16][17][18]
PICMSPICMS Ltd, Southsea, EnglandYes, with ISO 9001, 14001, 45001, 42001 and othersYes, Cyber Essentials Starter pack and Plus featuresAWS eu-west-2 (London). Some AI features, indexing, email and payments use US providersISO plans £149, £449 or £899 a month; Cyber and Privacy Starter £89 a month14 days; card at sign-up, nothing charged in the 14 days[19]
ScytaleScytale AI, Inc.; offices in New York, Tel Aviv and four other cities (no HQ named)Yesnot stated (a Cyber Essentials Plus checklist resource only)not statednot stated (plan tiers, no figures)not stated[20][21][22]
SureCloudUS HQ in Plano, Texas; London officeYesnot stated (resources only)not statednot stated (“priced on your requirements”)not stated[23][24]
VantaVanta Inc., San Francisco, USAYesYes, listed as a frameworknot statednot stated (“personalized pricing” after a demo)not stated[25][26][27][28]

How to choose

Which tool fits which situation

You only need Cyber Essentials. CyberSmart is built for it and says every quote includes the certification fee.[3] A full ISO 27001 platform is more than you need.

You want UK data hosting and a monthly GBP price. PICMS names AWS London and publishes its plans on its own page.[19]

You want ISO 27001 only, at the lowest published software price. Conformio starts at US $169 a month and lets you test 14 days without a card.[1]

You will write the ISMS yourself and have almost no budget. High Table sells ISO 27001 document templates from £97. These are documents, not software.[12]

You want a UK vendor that lists both ISO 27001 and Cyber Essentials. ISMS.online, with a Brighton address, lists both on its frameworks page. The price is on request.[14]

Your customers are in the US and ask for SOC 2 as well. Vanta and Drata both list ISO 27001 and Cyber Essentials. Neither publishes a price.[25][5]

You also need NIS2, DORA or the EU AI Act next to ISO 27001. Matproof runs these in one tool and stores persistent customer data in the EU.[17]

Cyber Essentials

Do you need software for Cyber Essentials?

Not always. Cyber Essentials covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.[29] The basic level is a self-assessment marked by an assessor. Cyber Essentials Plus adds independent technical testing of your systems.[29]

IASME is the NCSC's Cyber Essentials delivery partner, and certification goes through IASME or its licensed certification bodies.[29] No software vendor in this table replaces that step, except where it sells the certification as part of its quote, as CyberSmart says it does.[3]

Where Matproof fits

Matproof fits a UK SME that wants ISO 27001 and Cyber Essentials in one tool, and may also need NIS2, DORA, GDPR, SOC 2 or the EU AI Act, with persistent customer data stored in the EU.[17][16] If you need data hosted in the UK, or only Cyber Essentials with the certificate in one quote, another tool in the table fits better. Matproof is software, not an auditor or a certification body.

14 days free. Card required, €0 today. Cancel in one click.

FAQ

Frequently asked questions

What is the best ISO 27001 software for a small UK company?

There is no single best. As of 9 November 2026, PICMS publishes GBP prices from £149 a month for ISO plans and names AWS London for customer data. Conformio is ISO 27001-only software from US $169 a month with a 14-day trial and no card. ISMS.online, with a Brighton address, lists ISO 27001 and Cyber Essentials but gives the price on request. High Table sells document templates from £97 if you want to write the ISMS yourself.

Which compliance software covers both ISO 27001 and Cyber Essentials?

On their own pages, ISMS.online, PICMS, Vanta, Drata and Matproof name both. CyberSmart names Cyber Essentials and Cyber Essentials Plus, and offers ISO 27001-aligned reporting in its Plus plans. Conformio, Hicomply, Scytale, SureCloud and High Table do not state Cyber Essentials support on the pages we read.

How much does ISO 27001 software cost in the UK?

Most vendors do not publish a price. Published figures as of 9 November 2026: PICMS £149, £449 or £899 a month for ISO plans; Conformio US $169 to $349 a month; Hicomply from £5,300 or $6,995 a year; High Table templates from £97. ISMS.online, Vanta, Drata, Scytale, SureCloud and CyberSmart give prices on request. Matproof lists its prices on its pricing page.

Which ISO 27001 software hosts data in the UK?

Of the 11 tools compared, only PICMS names a UK hosting location on its own page: AWS eu-west-2 in London. Matproof stores persistent customer data in the EU. Drata names AWS and Google Cloud with no region. The others do not state a location on the pages we read. Ask for the subprocessor list before you sign.

Do I need software to get Cyber Essentials?

No. Cyber Essentials covers five technical controls and the basic level is a self-assessment marked by an assessor. Software helps when you need to keep evidence current across many devices, or when you go for Cyber Essentials Plus, which adds independent technical testing. Certification goes through IASME or its licensed certification bodies.

Why does the table say “not stated” so often?

Because we only print what a vendor shows on its own site. If a pricing page has no figure, there is no figure here. We do not guess and we do not take values from review sites. “Not stated” does not mean the feature is missing. Ask the vendor.

Is Matproof an auditor or a certification body?

No. Matproof is compliance software. It does not audit or certify anyone. ISO 27001 certification comes from an accredited certification body, and Cyber Essentials certification goes through IASME or its licensed certification bodies.

Sources

Every source was read on 9 November 2026.

  1. Advisera, Conformio (product page with pricing, trial and company details)https://advisera.com/conformio/
  2. CyberSmart, home page (frameworks)https://cybersmart.co.uk/
  3. CyberSmart, Planshttps://cybersmart.co.uk/plans/
  4. CyberSmart, Contacthttps://cybersmart.co.uk/contact
  5. Drata, Frameworkshttps://drata.com/frameworks
  6. Drata, Planshttps://drata.com/plans
  7. Drata, Abouthttps://drata.com/about
  8. Drata, Securityhttps://drata.com/security
  9. Hicomply, Pricinghttps://www.hicomply.com/pricing
  10. Hicomply, home page (frameworks)https://www.hicomply.com/
  11. High Table, home page (company details)https://hightable.io/
  12. High Table, ISO 27001 toolkit pricinghttps://hightable.io/iso-27001-toolkit-pricing/
  13. ISMS.online, Pricinghttps://www.isms.online/pricing/
  14. ISMS.online, Frameworkshttps://www.isms.online/frameworks/
  15. Matproof, Pricinghttps://matproof.com/pricing
  16. Matproof, Cyber Essentialshttps://matproof.com/cyber-essentials
  17. Matproof, Subprocessors (hosting)https://app.matproof.com/subprocessors
  18. Matproof, Imprinthttps://matproof.com/impressum
  19. PICMS, home page (pricing, trial, hosting, company details)https://picms.com/
  20. Scytale, Pricinghttps://scytale.ai/pricing/
  21. Scytale, About ushttps://scytale.ai/about-us/
  22. Scytale, Privacy policyhttps://scytale.ai/privacy-policy/
  23. SureCloud, Pricinghttps://www.surecloud.com/pricing
  24. SureCloud, home pagehttps://www.surecloud.com/
  25. Vanta, Additional frameworkshttps://www.vanta.com/products/additional-frameworks
  26. Vanta, Pricinghttps://www.vanta.com/pricing
  27. Vanta, Privacy notice (company address)https://www.vanta.com/legal/privacy
  28. Vanta, Securityhttps://www.vanta.com/security
  29. NCSC, Cyber Essentials overviewhttps://www.ncsc.gov.uk/cyberessentials/overview

Related

ISO 27001 and Cyber Essentials in one tool.

Start the 14-day trial and see the controls and evidence for your company.

Start free trial