IASME Cyber Assurance, assessed directly by an IASME certification body
IASME Cyber Assurance is the UK information security certification for organisations that hold Cyber Essentials and need to show more than the five technical controls: governance, risk management, people, physical security, backup, resilience and compliance with UK GDPR. It has two levels, a verified self-assessment and an independent audit, and the audited level is accepted by a growing number of sectors as an alternative to ISO 27001 for smaller organisations. Incursion Cyber Security is an IASME-licensed Cyber Assurance certification body and holds both levels ourselves.
What IASME Cyber Assurance is
Cyber Assurance is IASME’s governance standard, the successor to IASME Governance, organised into fourteen themes. Where Cyber Essentials asks whether five technical controls are in place, Cyber Assurance asks whether the organisation is actually managing information security: who is accountable, what the risks are, what the policies say, whether staff know and follow them, how data is protected in law and in practice, and what happens when something goes wrong.
The themes cover planning and governance; how the organisation is structured for security; asset management; the legal and regulatory landscape, including UK GDPR and the Data Protection Act 2018; assessing and treating risk; physical and environmental protection; people; putting policy into practice; managing access; technical intrusion prevention; backup and restore; secure business operations (monitoring, review and change management); and resilience (business continuity, incident management and disaster recovery).
The standard is deliberately proportionate. It sets the outcome each theme needs and lets you evidence it in a way that fits your size, which is why it works for organisations that cannot justify a full ISO 27001 management system.
The two levels
Level 1: verified self-assessment
You complete the question set online. A senior board member signs the declaration and a named assessor from our team reviews and marks it. Results are usually returned within three working days; if you fall short you have two working days to close the gaps and resubmit. Level 1 is valid for twelve months and is renewed annually. It is the right level when a customer or framework wants evidence of governance beyond Cyber Essentials but has not asked for an audit, and it is the required first step to Level 2.
Level 2: audited
An independent audit of the same standard. Our assessor reviews your documentation, interviews staff and observes your processes and controls in operation, remotely or on site, and the assessor’s report is moderated by IASME before the certificate is issued. Level 2 must be completed within six months of achieving Level 1. The certificate is valid for three years, provided you keep Cyber Essentials and Level 1 current each year in between.
| Level 1 | Level 2 | |
|---|---|---|
| Method | Online self-assessment, verified by our assessor | Independent audit: documents, interviews, observation |
| Prerequisite | Current Cyber Essentials | Current Cyber Essentials and Level 1 (within six months) |
| Result | Usually within three working days | After IASME moderation of the audit report |
| Validity | 12 months | 3 years, with annual Level 1 and Cyber Essentials |
| Pricing | Set nationally by IASME, banded by organisation size | Quoted after scoping |
The prerequisite
You cannot start a Cyber Assurance application without a current Cyber Essentials certificate. We certify Cyber Essentials and Cyber Essentials Plus as well, so if yours has lapsed or you have never held it we plan the two together: Cyber Essentials first, Level 1 as soon as it is issued, and Level 2 booked inside the six-month window if you need it.
How we assess
Scoping. We confirm your organisation size and which level the request you have received actually needs, and agree what is in scope. For Level 2 we also agree the evidence we will need to see, so that audit time is spent confirming what you do rather than hunting for documents.
Level 1. You complete the question set; a named assessor marks it and gives written feedback on anything that falls short.
Level 2. A named assessor conducts the audit, remotely or on site. Where we find a gap we tell you what the standard needs and why, and you have the opportunity to close it before the report goes to IASME for moderation.
Certificate. Issued by us as the certification body and recorded on the IASME register.
Advisory work and certification are kept separate: we will not audit controls we designed.
Who it is for
Most organisations come to Cyber Assurance because of a specific ask: a public sector framework, a procurement questionnaire, a larger customer’s supplier assurance process, or an insurer. It suits organisations from a few people to a few hundred that handle personal or sensitive data and need to evidence governance and data protection without the cost of ISO 27001. If a customer has named ISO 27001 and you are small, it is worth asking whether audited Cyber Assurance is acceptable; increasingly it is.
Cyber Assurance and ISO 27001
ISO 27001 is an international standard for an information security management system: more extensive, more prescriptive about documentation, and with a longer and more expensive certification audit. Cyber Assurance covers the same ground at a depth proportionate to a smaller organisation. IASME reports that a wide range of industry sectors now accept the audited certification as an alternative to ISO 27001 for small companies. Where a customer will accept either, Level 2 is almost always the quicker and cheaper route; where they will only accept ISO 27001, Cyber Assurance is sound preparation because the themes map closely onto the ISO control areas. Our guide to IASME Cyber Assurance Level 1 vs Level 2 goes into the comparison in more detail.
Frequently asked questions
Is Cyber Assurance the same as Cyber Essentials?
No. Cyber Essentials covers five technical controls. Cyber Assurance covers the governance, risk, people, physical, legal and resilience themes around them, and requires Cyber Essentials as a prerequisite.
Does it cover UK GDPR?
Yes. The legal and regulatory theme covers your obligations under UK GDPR and the Data Protection Act 2018. Certification requires you to evidence the policies, processes and controls that compliance depends on.
Can we go straight to Level 2?
No. Level 1 comes first, and the Level 2 audit must be completed within six months of it.
How long does Level 2 last?
Three years, provided Cyber Essentials and Level 1 are renewed each year. If either lapses, the Level 2 certificate does too.
What does it cost?
Level 1 is priced by organisation size at rates set nationally by IASME. Level 2 is quoted after scoping because the audit effort depends on your size and complexity. We confirm both when we scope.
Are you the certification body?
Yes. Incursion Cyber Security is licensed by IASME to assess and certify IASME Cyber Assurance, Cyber Essentials and Cyber Essentials Plus, and we hold Cyber Assurance Level 1 and Level 2 (with the Quality Principles module) ourselves. Our licences and certificates are listed with verification links on the accreditations page.
Ready to get certified?
Book a call. Our sales team will set it up and handle the proposal, and a qualified assessor will review everything before your booking is confirmed.