In short. IASME Cyber Assurance is the UK information security standard for organisations that already hold Cyber Essentials and need to show governance, risk management, people, physical security, backup, resilience and legal compliance. Level 1 is a verified self-assessment renewed every year; Level 2 is an independent audit valid for three years, increasingly accepted as an alternative to ISO 27001 for smaller organisations.
IASME Cyber Assurance is a UK information security standard for organisations that already hold Cyber Essentials and need to show more than the five technical controls: governance, risk management, people, physical security, backup, resilience and legal compliance including UK GDPR. It has two levels. Level 1 is a verified self-assessment, marked by an external assessor and renewed every year. Level 2 is an independent audit of the same standard, valid for three years provided Level 1 and Cyber Essentials are kept current. A growing number of sectors accept the audited Level 2 as an alternative to ISO 27001 for smaller organisations.
Incursion Cyber Security is an IASME-licensed certification body for Cyber Assurance and holds Level 1 and Level 2 (with the Quality Principles module) ourselves, so this guide is written from both sides of the assessment.
What IASME Cyber Assurance covers
Cyber Assurance is the current name for what IASME used to call IASME Governance. The controls are the same; the standard has been reorganised into fourteen themes. Where Cyber Essentials asks whether five technical controls are in place, Cyber Assurance asks whether the organisation is actually managing information security: who is responsible, what the risks are, what the policies say, whether staff know them, and what happens when something goes wrong.
The themes cover planning and governance; how the organisation is structured for security; asset management; the legal and regulatory landscape, including your obligations under UK GDPR and the Data Protection Act 2018; assessing and treating risk; physical and environmental protection; people; putting policy into practice; managing access; technical intrusion prevention; backup and restore; secure business operations, meaning monitoring, review and change management; and resilience, meaning business continuity, incident management and disaster recovery.
The standard is deliberately less prescriptive than ISO 27001. It tells you what outcome each theme needs and lets you evidence it in a way that fits the size of your organisation. That is the point of it: a ten-person firm should not need a full information security management system to prove it takes data protection seriously.
The prerequisite: Cyber Essentials
You cannot start a Cyber Assurance application until you hold a current Cyber Essentials certificate. IASME treats Cyber Essentials as the government-approved minimum, and Cyber Assurance builds on it rather than repeating it. If your Cyber Essentials has lapsed, that is the first job. We certify both, and you can read what the assessment involves on our Cyber Essentials and Cyber Essentials Plus pages.
Level 1: verified self-assessment
Level 1 is completed online. Once you have applied you get access to an assessment portal with the question set, and six months to complete it. A senior board member signs off the answers, and an external assessor from a certification body reviews and marks them. If you have prepared in advance, IASME’s own estimate is that the questionnaire itself takes about an hour; the preparation is where the time goes. Most assessors return a result within three working days. If you fall short, you get two working days to fix the gaps and resubmit, and the remark takes no more than three days.
Level 1 is valid for twelve months and must be renewed every year. It is the right level when a customer or framework asks you to demonstrate governance beyond Cyber Essentials but does not require an audited certificate, and it is the mandatory first step towards Level 2.
Level 2: audited
Level 2 is an audit of the same standard by an independent IASME-assured assessor. The assessor reviews your documentation, interviews staff and observes your processes and controls in operation. It can be done on site or remotely. The assessor’s report is then moderated by IASME before the certificate is issued.
You must already hold Level 1, and the Level 2 audit must be completed within six months of it. The Level 2 certificate is valid for three years, but only if you maintain Cyber Essentials and re-certify to Level 1 every year in between. Because the audit is scoped to each organisation it is quoted individually rather than priced by band.
Level 1 vs Level 2 at a glance
| Level 1 | Level 2 | |
|---|---|---|
| Method | Online self-assessment, verified by an external assessor | Independent audit: documents, interviews, observation |
| Prerequisite | Current Cyber Essentials | Current Cyber Essentials and Level 1 (within six months) |
| Board involvement | Senior board member signs the declaration | Board-level policies and ownership evidenced to the assessor |
| Typical effort | Preparation, then about an hour to complete the questionnaire | Preparation, then an audit day or days depending on size |
| Result | Usually within three working days | After IASME moderation of the assessor’s report |
| Validity | 12 months | 3 years, with annual Level 1 and Cyber Essentials |
| Pricing | Fixed bands by organisation size | Quoted individually |
Which level do you need?
Choose Level 1 when you need to evidence governance and data protection to a customer, insurer or framework that has not asked for an audit, or when you want a structured route to Level 2. Choose Level 2 when a contract, tender or regulator wants independent verification, when you are being asked for ISO 27001 and cannot justify the cost, or when your clients are large enough that a self-declaration will not satisfy their supplier assurance process.
In practice most organisations that come to us for Level 2 are responding to a specific ask: a procurement questionnaire, a public sector framework, or a larger customer’s supplier review. If that is your situation, read the wording of the ask carefully. Some accept Level 1; some name Level 2; a few still name ISO 27001 and will accept audited Cyber Assurance for small suppliers if you ask.
How Cyber Assurance compares with ISO 27001
ISO 27001 is an international standard for an information security management system. It is more extensive, more prescriptive about documentation, and the certification audit is correspondingly longer and more expensive. Cyber Assurance covers the same ground at a level of detail proportionate to a smaller organisation. IASME states that a wide range of industry sectors now accept the audited certification as an alternative to ISO 27001 for small companies. If a customer will accept either, Cyber Assurance Level 2 is almost always the quicker and cheaper route to the same assurance. If a customer will only accept ISO 27001, Cyber Assurance is still useful preparation, because the themes map closely onto the ISO control areas.
How we assess
As a certification body we mark Level 1 assessments and conduct Level 2 audits. The assessor you deal with is a named member of our team, not a portal. Before a Level 2 audit we agree the scope and the evidence we will need to see, so that the audit day is spent confirming what you do rather than hunting for documents. Where we find a gap we tell you what the standard needs and why, and you have the opportunity to close it. Advisory work and certification are kept separate: we will not audit controls we designed.
Frequently asked questions
Is IASME Cyber Assurance the same as Cyber Essentials?
No. Cyber Essentials covers five technical controls. Cyber Assurance covers the governance, risk, people, physical, legal and resilience themes around them. Cyber Essentials is a prerequisite for Cyber Assurance.
Does Cyber Assurance cover UK GDPR?
Yes. The legal and regulatory theme covers your obligations under the UK implementation of GDPR, the Data Protection Act 2018. Certification does not make you compliant on its own, but it does require you to evidence the policies, processes and controls that compliance depends on.
How long does Level 2 last?
Three years, provided you maintain Cyber Essentials and re-certify to Level 1 each year. If either lapses, the Level 2 certificate does too.
Can we go straight to Level 2?
No. Level 1 is required first, and the Level 2 audit must be completed within six months of achieving it.
Is Cyber Assurance accepted instead of ISO 27001?
Often, for smaller organisations. IASME reports that a wide range of sectors now accept the audited Level 2 certification as an ISO 27001 alternative for small companies. Check the wording of the specific contract or framework, and ask if it is not explicit.
Who can certify us?
Any IASME-licensed Cyber Assurance certification body. Incursion Cyber Security is one; our licence is listed with a verification link on our accreditations page. To talk through which level fits the ask you have received, contact us.