Cyber Essentials vs IASME Cyber Assurance
How Cyber Essentials, the NCSC technical baseline, compares with IASME Cyber Assurance, IASME's own governance-level scheme covering risk, people, data and incident management at Level 1 and Level 2.
Cyber Essentials certifies five technical controls from a self-assessment for a scheme fee of £320 to £600. IASME Cyber Assurance is IASME's broader governance scheme: Level 1 is a verified self-assessment and Level 2 is audited, and it covers risk assessment, policies, people, data protection and incident management as well as the technical controls. Cyber Essentials comes first.
What is the difference in one table?
| Cyber Essentials | IASME Cyber Assurance | |
|---|---|---|
| Scheme owner | NCSC, delivered by IASME | IASME |
| What it covers | Five technical controls: firewalls, secure configuration, security updates, user access control, malware protection | Governance: risk assessment, policies, people, data protection and incident management, on top of the Cyber Essentials technical controls |
| Levels | Cyber Essentials (self-assessed) and Cyber Essentials Plus (audited) | Level 1 (verified assessment) and Level 2 (audited), with Level 1 first |
| Assessment method | Danzell question set marked by a Certification Body; Plus adds five technical test cases | Longer question set covering governance themes; Level 2 adds an assessor audit of the governance system |
| Fixed technical thresholds | Yes, for example 14-day patching and MFA on all cloud services | Relies on a valid Cyber Essentials certificate, which IASME makes a prerequisite |
| Time to certificate | 1 to 2 weeks (Cyber Essentials), 2 to 5 weeks (Plus) | Longer, because policies and risk work must exist and be evidenced |
| Prerequisite | None | A valid Cyber Essentials certificate with at least one month before expiry, covering the whole organisation |
| Scheme fee | £320 to £600 ex VAT by headcount | Set by IASME; not published here |
| Who asks for it | UK public sector, MOD suppliers, insurers, most supply chains | Buyers wanting governance assurance at SME scale; sometimes used as a step towards ISO 27001 |
Which should you choose?
| If this describes you | Choose | Verdict |
|---|---|---|
| A buyer, insurer or contract asks for Cyber Essentials | Cyber Essentials | It is the technical baseline named in most UK supplier clauses. |
| A buyer wants governance assurance at SME scale | IASME Cyber Assurance | It covers risk assessment, policies, people, data protection and incident management as well as the technical controls. |
| You want an independent audit of your governance, not only a self-assessment | IASME Cyber Assurance Level 2 | Level 2 is audited; Level 1 is a verified self-assessment. |
| You are working towards ISO 27001 | Cyber Essentials, then Cyber Assurance | Cyber Essentials comes first, and Cyber Assurance builds the governance evidence an ISMS needs. |
What does Cyber Essentials cover?
Cyber Essentials answers one question: are the technical controls that stop common internet attacks in place on everything in scope? The Requirements for IT Infrastructure v3.3 set the five controls and the thresholds. A firewall on every device with the admin interface protected. Unnecessary accounts and software removed. Supported software with critical or high-risk fixes applied within 14 days. Unique accounts, separate admin accounts, MFA on every cloud service. Anti-malware or application allow-listing on every device.
The assessment is the Danzell question set, and the assessor marks what you describe. It does not ask whether you have a risk register, a data protection policy or an incident response plan, because those are not technical controls.
What does IASME Cyber Assurance cover?
IASME Cyber Assurance is IASME's own governance-level scheme. It takes the Cyber Essentials technical baseline and wraps it in the management topics a small or medium organisation needs to run security as a process rather than a checklist: assessing risk, writing and maintaining policies, managing people and training, protecting data including personal data, and detecting and responding to incidents.
Level 1 is a verified self-assessment: you answer the question set and an assessor reviews it. Level 2 is audited: an assessor examines the evidence behind the governance system. Think of it as an SME-scale relative of ISO 27001. IASME's Cyber Assurance pages set out the current question set and levels.
The technical controls in Cyber Assurance are the Cyber Essentials controls. The value Cyber Assurance adds is in the governance themes, so if you already hold Cyber Essentials, the extra work is policies, risk assessment, data handling and incident planning, not new technical fixes.
Which one do you need?
Check what the buyer named. PPN 014 under the Procurement Act 2023 applies to central government, agencies, non-departmental public bodies and NHS bodies for procurements from 24 February 2025 and it asks for Cyber Essentials. Insurers and most prime contractors also name Cyber Essentials. Question A1.10 on the self-assessment asks why you are applying, and the answer is nearly always a contract or a customer.
Choose Cyber Assurance when a customer wants evidence that you manage security, not just that you have configured it. That usually shows up as questionnaire items about risk assessment, staff training, data protection and incident response. It also suits organisations that want a structured path towards ISO 27001 without committing to a full management system yet.
Organisations that plan both at once usually find the Cyber Essentials work, especially MFA on cloud services and unsupported software, takes longer than expected, and IASME will not sell Cyber Assurance without a valid Cyber Essentials certificate that has at least a month left to run. Get the technical baseline certified first, then write the policies and risk assessment while the evidence is fresh.
Can you hold both?
Yes. The normal sequence is Cyber Essentials, then Cyber Essentials Plus if a buyer wants independent technical evidence, then Cyber Assurance if a buyer wants governance evidence. Cyber Essentials expires after 12 months, so align the two renewals and run the technical baseline and the governance review together.
| At a glance | Detail |
|---|---|
| Cyber Essentials | Technical baseline, 5 controls, self-assessed, 12 months |
| Cyber Essentials Plus | Same controls, independently tested, within 3 months of the self-assessment |
| Cyber Assurance Level 1 | Verified self-assessment of governance plus the technical baseline |
| Cyber Assurance Level 2 | Audited governance system |
How do the costs compare?
Cyber Essentials has a fixed IASME scheme fee of £320 to £600 ex VAT by headcount. Assessor-supported certification with Precursor starts from £1,500 + VAT with the fee included, and Cyber Essentials Plus from £3,000 + VAT with Cyber Essentials included.
IASME sets the scheme fee for Cyber Assurance and the Certification Body prices the assessment and any audit. We do not publish those figures here because they vary with level and organisation size. Budget for the internal time to write policies and complete a risk assessment as well as the fee: that is where most of the effort in Cyber Assurance sits.
A charity chooses Cyber Assurance Level 1 because a funder mentioned "IASME certification", without checking which scheme was meant. The funder's clause named Cyber Essentials. The organisation has spent weeks on policies and still needs the technical certificate. Read the clause and confirm the scheme name before you start.
Frequently asked questions
No. Cyber Essentials Plus is the audited version of the Cyber Essentials technical controls. IASME Cyber Assurance is a separate scheme that adds governance topics such as risk assessment, policies, staff training, data protection and incident response. Level 2 of Cyber Assurance is audited, but it audits the governance system, not the five Cyber Essentials tests.
Yes. IASME makes a valid Cyber Essentials certificate a prerequisite: when you buy Cyber Assurance it must have at least one month left before expiry, and both must cover the whole organisation. You must pass Level 1 before applying for Level 2. Without a current certificate, IASME adds Cyber Essentials to the same order.
Cyber Essentials, unless a customer specifically asks for more. It is faster, cheaper and addresses the attacks small organisations actually face. Cyber Assurance is worth considering when you handle sensitive personal data at scale or when a buyer wants an ISO 27001-style answer at a smaller scale.
Not on its own. PPN 014 and most UK public sector clauses name Cyber Essentials. Holding Cyber Assurance without a current Cyber Essentials certificate will not meet those clauses.
IASME sets the scheme fee for Cyber Assurance and Certification Bodies price the assessment work. We do not publish those figures here; the Cyber Essentials scheme fee is £320 to £600 ex VAT by headcount and assessor-supported certification starts from £1,500 + VAT.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
Other comparisons
- Cyber Essentials vs Cyber Essentials PlusWhat separates the self-assessed Cyber Essentials certificate from the audited Cyber Essentials Plus: who marks it, what is tested, how long it takes, what it costs and which one a contract is likely to ask for.
- Cyber Essentials vs ISO 27001How the UK Cyber Essentials baseline compares with an ISO 27001 information security management system: scope, evidence, audit, timescales and which one a buyer is really asking for.
- Cyber Essentials self-assessment vs using an assessorAn honest comparison of completing the Cyber Essentials self-assessment yourself for the £320 to £600 IASME scheme fee against paying an assessor for a fixed-price, supported certification: when each route makes sense and what you are paying for.