Small and mid-sized UK suppliers are increasingly asked for assurance that goes beyond Cyber Essentials but stops short of a full ISO/IEC 27001 programme, and IASME Cyber Assurance is the scheme built for that gap. It is an organisational certification, not a personal one: a business answers a question set covering governance, risk, people, technical controls, resilience, suppliers and data protection, and is either marked by an external assessor (Level One) or audited on site or remotely (Level Two). This guide explains who it suits, how assessment works, the prerequisites, a preparation plan, fees and renewal as published by IASME, and where it fits against Cyber Essentials and ISO 27001. It is for owners, IT managers and security leads at SMEs and for buyers deciding what to ask suppliers for. Facts on fees, validity and process were checked on IASME's own pages on 8 November 2026.
Key takeaways
- Two levels, same controls. Level One is a verified self-assessment signed by a board member and marked by an independent assessor; Level Two is an audit of the same controls by an IASME-assured assessor, verifying them in practice.
- Cyber Essentials comes first. You need a valid Cyber Essentials certificate with at least one month left, and both scopes must cover the whole organisation. Level One must be passed before Level Two, and Level Two must follow within six months.
- Broader than Cyber Essentials. The standard is organised into 14 themes, including risk management, training, policies, resilience, supplier risk and legal duties such as the Data Protection Act in the UK.
- Annual cycle. Level One certificates expire 12 months after issue; a Level Two audit is valid for three years provided Cyber Essentials and Level One are renewed every year.
- Published fees are modest. Level One costs from £320 plus VAT for a micro organisation to £600 plus VAT for a large one; Level Two is quoted by certification bodies.
Who the certification is for
IASME describes Cyber Assurance as a flexible cyber resilience standard for organisations of all sizes, recognised across sectors as evidence of supply chain cyber risk controls. In practice it suits:
- SME suppliers to larger buyers: firms answering supplier questionnaires who need one certificate that covers governance and data protection, not just technical baselines.
- Public sector suppliers: IASME notes that some sectors accept audited Cyber Assurance in place of ISO 27001 for small companies, citing the Ministry of Justice and the Government of Jersey. Check the specific contract requirement before relying on this.
- Organisations already holding Cyber Essentials: the logical next step when buyers or insurers ask about risk management, incident response and backups.
- Businesses not ready for ISO 27001: IASME positions it as broader and less prescriptive than Cyber Essentials and right-sized for smaller organisations, without a full management system.
| Scheme | Scope | How assessed | Validity | Best fit |
|---|---|---|---|---|
| Cyber Essentials | Five technical controls: firewalls, secure configuration, security update management, user access control, malware protection | Self-assessment, independently marked | Annual renewal | Baseline for every UK organisation; prerequisite for Cyber Assurance |
| Cyber Essentials Plus | Same five controls | Independent technical testing | Annual renewal | Higher assurance on the technical baseline |
| IASME Cyber Assurance Level One | 14 themes across governance, people, technical controls, resilience, suppliers, legal | Verified self-assessment, board sign-off, assessor marking | 12 months | SMEs needing broad supply chain assurance at low cost |
| IASME Cyber Assurance Level Two | Same controls as Level One | Audit: documents, interviews, observation, moderated by IASME | Three years, with annual Cyber Essentials and Level One | Suppliers whose buyers require audited assurance |
| ISO/IEC 27001 | Information security management system with Annex A controls | Certification body audit | Three-year cycle with surveillance audits | Larger or international organisations; see the ISO 27001 Certification Guide |
Exam format and domains
There is no exam for individuals. The "exam" is the organisation's assessment against the IASME Cyber Assurance question set. IASME publishes the self-assessment questions for free download for information; the version published for applications from 25 July 2022 is Version 12 (Hartnell), which replaced IASME Governance v11d and keeps mappings to external standards such as ISO 27001. Check the download page for the current version before you start.
Level One format: answers are entered on a secure online platform, a senior board member or equivalent e-signs to confirm accuracy, and an independent external assessor marks the submission. IASME says a prepared organisation may complete it in about an hour, assessors usually return results within three days, and failed applicants get feedback on each non-compliant area.
Level Two format: an IASME-assured assessor reviews documentation, interviews key staff and observes activities, in person or remotely, then writes an audit report that goes through IASME moderation.
Domains: the standard has 14 themes. IASME's summary groups them as follows; the table adds the evidence an assessor or auditor will look for.
| Area (IASME summary) | What to have ready | Where identity fits |
|---|---|---|
| Risk assessment and risk management | A risk register with owners, review dates and treatment decisions | Include risks from shared admin accounts, API keys and third-party integrations |
| Technical controls against cyber threats | Cyber Essentials evidence plus configuration, access and monitoring records | Inventory of user, admin and service accounts; MFA coverage; removal of leavers |
| Staff training | Training records and induction content | Phishing and credential handling covered |
| Policies and procedures | Approved, dated policies staff can find | Access control and password or passkey policy covering non-human accounts |
| Resilience: backups, business continuity, incident response | Backup schedule with restore tests, continuity plan, incident response plan | Backup system credentials separated from production admin |
| Third-party supplier risk | Supplier list with risk ratings and contract clauses | Which suppliers hold credentials, remote access or OAuth grants into your systems |
| Legal and regulatory requirements | Data protection records, lawful basis, breach procedure | Access to personal data restricted and logged per identity |
Prerequisites and experience
- Cyber Essentials: a valid certificate with at least one month before expiry; if you lack one, IASME adds it at checkout. It is charged separately.
- Whole-organisation scope: both Cyber Essentials and Cyber Assurance must cover the whole organisation, so you cannot certify one department.
- Board accountability: a senior board member or equivalent must sign the Level One answers as accurate.
- Sequence for Level Two: pass Level One first, then complete Level Two within six months.
- Outside the UK: IASME asks non-UK organisations to contact it about the Cyber Essentials prerequisite; the legal requirements theme then refers to your country's implementation of data protection law.
- No personal experience requirement: no individual qualification is needed, but someone must own each theme and be able to show evidence.
Preparation plan
- Weeks 1 to 2, scope and baseline: confirm Cyber Essentials is current, with at least one month remaining, and covers the whole organisation. Download the question set and assign an owner to each theme. See the Cyber Essentials Readiness Checklist.
- Weeks 2 to 4, gap analysis: answer each question in a working document, mark gaps, and collect evidence (policies, registers, test records).
- Weeks 4 to 8, close gaps: typical gaps are an untested backup restore, no supplier register, no incident response plan and missing training records. Write or update policies and get them approved.
- Identity clean-up: list every account, including admin and service accounts and API keys used by integrations, remove unused ones, enforce MFA for admins and remote access, and document who approves access. See the NHI Inventory Reconciliation.
- Submit Level One: transfer answers to the portal, have the board signatory review them, and submit. Keep a copy of every answer because renewal requires re-entering them.
- If marked down: IASME allows two working days to fix and resubmit at no extra charge; failing again means reapplying and paying again, so have owners on standby.
- Level Two, if required: request quotes (up to three certification bodies respond), run an internal walkthrough of documents and interviews, and book the audit within six months of Level One.
Common reasons organisations struggle: answers that describe intentions rather than practice; policies that exist but were never approved; backups never restored; supplier risk limited to a contract list; and admin rights shared across staff or held by unmanaged service accounts.
Cost, renewal and continuing education
| Item | As published by IASME (8 November 2026) |
|---|---|
| Level One, micro (0 to 9 staff) | £320 plus VAT |
| Level One, small (10 to 49) | £440 plus VAT |
| Level One, medium (50 to 249) | £500 plus VAT |
| Level One, large (over 249) | £600 plus VAT |
| Level Two | Quoted by certification bodies, based on network size and complexity |
| Cyber Essentials | Charged separately, from £320 plus VAT for a micro organisation |
| Assessment window | Six months from purchase before the account expires; fees not refunded |
| Level One validity | 12 months from issue, resubmitted annually |
| Level Two validity | Three years, provided Cyber Essentials and Level One are achieved each year |
IASME also lists US dollar and euro equivalents. There is no continuing education for individuals; the equivalent is the annual resubmission, for which IASME sends a reminder about a month ahead. Keep the evidence pack current through the year so renewal is a review rather than a rebuild.
Where it fits on the career path
Because the certificate belongs to the organisation, its career value is in the skills of the person who leads it. Running a Cyber Assurance programme gives hands-on experience of risk registers, policy writing, supplier assurance, incident planning and audit preparation, which is a practical grounding for governance roles. Practitioners who want a personal credential in the same space can look at the ISC2 CGRC Certification Guide or the ISO 27001 Lead Auditor and Lead Implementer Guide, and the Cybersecurity Certifications Guide compares the wider field.
Organisational path: Cyber Essentials, then Cyber Essentials Plus or Cyber Assurance Level One, then Level Two, then ISO 27001 if international customers or contract size demand it. Mappings that IASME maintains to ISO 27001 make Cyber Assurance evidence reusable on that route.
Measuring whether it is working
- Percentage of accounts (human and service) with a named owner and reviewed in the last quarter.
- Backup restore tests completed against plan, and time to restore.
- Staff training completion rate.
- Share of critical suppliers with a current risk rating.
- Non-compliant areas raised at each annual assessment, trending down.
Practitioner checklist
- Confirm Cyber Essentials is valid with at least one month left and covers the whole organisation.
- Download the current IASME Cyber Assurance question set and assign an owner per theme.
- Build an evidence pack: risk register, approved policies, training records, backup restore tests, incident response plan, supplier register, data protection records.
- Inventory all accounts, including admin and service accounts and integration keys, and remove unused ones.
- Have the board signatory review answers before Level One submission and keep a copy.
- Keep owners available for the two-working-day resubmission window.
- If Level Two is needed, obtain quotes and book the audit within six months of Level One.
- Diary annual renewal of Cyber Essentials and Level One, plus the three-year Level Two cycle.
Standards and references
- IASME: IASME Cyber Assurance
- IASME: IASME Cyber Assurance Frequently Asked Questions
- IASME: Free Download of IASME Cyber Assurance Verified Assessment Questions
- NCSC: Cyber Essentials overview
Related NHI Mgmt Group resources: Cyber Essentials Guide · Cyber Essentials Readiness Checklist · ISO 27001 Certification Guide · Choosing an IT Support Provider or MSP Securely