IASME Cyber Assurance
IASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls. It adds risk assessment, policies, people, data protection, backup and incident management to the Cyber Essentials baseline. Level 1 is a verified self-assessment and Level 2 is audited. Cyber Essentials comes first.
- Term
- IASME Cyber Assurance
- Also known as
- Cyber Assurance, Cyber Assurance Level 1, Cyber Assurance Level 2
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term IASME Cyber Assurance mean in Cyber Essentials?
IASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
How does IASME Cyber Assurance apply to Cyber Essentials?
In plain terms
Cyber Essentials checks the locks. Cyber Assurance also asks who holds the keys, what happens if one goes missing, whether staff know the rules and how you would recover from a break-in. It suits organisations that need to show they manage security, not only configure it.
How it relates to Cyber Essentials
It is a separate IASME scheme, not part of the NCSC's Cyber Essentials. It inherits the Cyber Essentials technical baseline and wraps governance topics around it. Level 1 is a verified self-assessment. Level 2 adds an assessor audit of the governance system, rather than the five Cyber Essentials Plus test cases. Both require a current Cyber Essentials certificate. IASME's FAQ says Level 1 is resubmitted every year, while a Level 2 audit is valid for three years as long as Cyber Essentials and Level 1 are renewed annually. Backup is one of the clearest differences: the NCSC requirements v3.3 recommend backups but state that backing up "is not a technical requirement of Cyber Essentials", while Cyber Assurance assesses it.
Common mistakes
Treating Level 2 as the same thing as Cyber Essentials Plus. Plus audits the technical controls on a sample of devices. Cyber Assurance Level 2 audits the governance system. A buyer asking for one will not usually accept the other, so check the tender wording.
See Cyber Essentials vs IASME Cyber Assurance, IASME and ISO 27001.
Related terms
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- ISO 27001ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
- NCSC (National Cyber Security Centre)The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
- Organisational dataOrganisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
Frequently asked questions
IASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.