In short: IASME Cyber Assurance is a cyber security governance standard from IASME, known as IASME Governance until 2022. It builds on Cyber Essentials, which you must hold, and comes in two levels: Level 1, a verified self-assessment, and Level 2, which adds an independent audit. It suits smaller organisations wanting governance assurance without a full ISO 27001 programme.
What IASME Cyber Assurance is
IASME is the NCSC's Cyber Essentials Delivery Partner: it delivers the Cyber Essentials scheme and licenses the Certification Bodies that assess it. Alongside Cyber Essentials, IASME runs its own standard, IASME Cyber Assurance, which was called IASME Governance until it was renamed in July 2022.
Where Cyber Essentials checks five technical controls, IASME Cyber Assurance looks at how security is managed: who is responsible, how risks are assessed, what policies and processes exist and how the organisation would cope with an incident. It was designed with smaller organisations in mind and covers many of the same themes as ISO/IEC 27001, in a more proportionate form.
For the current question set, scope and terms, go to IASME's own website; details such as assessment fees and renewal arrangements are set by IASME and can change.
Level 1 and Level 2
| Level 1 | Level 2 | |
|---|---|---|
| How it is assessed | Verified self-assessment: you answer the question set and an assessor reviews your answers | Independent audit that checks your answers and evidence |
| Assurance given | That the organisation says it has the governance measures in place, reviewed by an assessor | That the measures have been independently verified |
| Prerequisite | A valid Cyber Essentials certificate | A valid Cyber Essentials certificate |
| Typical reason to choose it | A first governance standard, or a buyer asking for more than Cyber Essentials | A buyer or sector wanting audited governance assurance |
The pattern mirrors Cyber Essentials and Cyber Essentials Plus: a self-assessed level marked by an assessor, then a higher level with independent checking.
Why it requires Cyber Essentials first
IASME Cyber Assurance assumes the technical basics are already sound. Requiring a valid Cyber Essentials certificate means the governance assessment can focus on management and process, rather than re-checking firewalls and patching.
For you, it means the order of work is clear:
- Get the five controls right and achieve Cyber Essentials.
- Consider Cyber Essentials Plus if buyers want tested assurance.
- Put the governance in place: ownership, risk assessment, policies, supplier checks and incident planning.
- Choose IASME Cyber Assurance Level 1 or Level 2, depending on the level of assurance your customers need.
Keep the Cyber Essentials certificate current: it expires after 12 months, so plan renewal alongside your IASME Cyber Assurance cycle.
IASME Cyber Assurance vs Cyber Essentials vs ISO 27001
| Cyber Essentials | IASME Cyber Assurance | ISO/IEC 27001 | |
|---|---|---|---|
| Focus | Five technical controls | Governance and management, on top of Cyber Essentials | A full information security management system |
| Designed for | Any organisation | Mainly small and medium-sized organisations | Any organisation; often larger or international ones |
| Assessment | Verified self-assessment (Plus adds testing) | Level 1 verified self-assessment; Level 2 audit | Audits by an accredited certification body |
| Prerequisite | None | Valid Cyber Essentials certificate | None |
| Effort | Lowest | Moderate | Highest |
If your customers specifically ask for ISO 27001, IASME Cyber Assurance is not a substitute. But if they ask for "something more than Cyber Essentials" or a recognised governance standard, it can be a proportionate answer. Our Cyber Essentials vs ISO 27001 page goes into the trade-offs.
Who it suits
- Small and medium-sized firms that already hold Cyber Essentials and want to show their customers a step up in maturity.
- Suppliers whose buyers ask about policies, risk management and incident planning, not just technical controls.
- Organisations that want to start building good governance habits before deciding whether ISO 27001 is worth the investment.
- Boards looking for structured evidence under the Cyber Governance Code of Practice.
How Forever Systems helps
We focus on the foundation IASME Cyber Assurance depends on: preparing you for Cyber Essentials and Cyber Essentials Plus, fixing technical gaps and supporting you through assessment alongside an IASME-licensed Certification Body. We can also help with the technical evidence behind governance answers, such as asset lists, access reviews, backup arrangements and staff training records. We do not issue certificates for any scheme. Contact us to plan your route.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is IASME Cyber Assurance?
A cyber security governance standard run by IASME that sits on top of Cyber Essentials. It covers how security is managed, such as responsibility, risk, policies and incident planning, and has a self-assessed Level 1 and an audited Level 2.
Is IASME Cyber Assurance the same as IASME Governance?
Yes. IASME Governance was renamed IASME Cyber Assurance in July 2022.
Do I need Cyber Essentials for IASME Cyber Assurance?
Yes. A valid Cyber Essentials certificate is a prerequisite for both levels.
What is the difference between Level 1 and Level 2?
Level 1 is a verified self-assessment reviewed by an assessor. Level 2 adds an independent audit that checks your answers and evidence.
Is IASME Cyber Assurance equivalent to ISO 27001?
No. It covers similar governance themes in a form designed for smaller organisations, but it is a different standard. If a customer specifically requires ISO 27001, you will need ISO 27001.