Skip to main content
IASME Cyber Assurance

IASME Cyber Assurance support, the step after Cyber Essentials

A buyer wants more than Cyber Essentials, or asks a small supplier for ISO 27001. We find the gaps, help you put the right policies in place and get you certified.

An IASME-licensed Certification Body assesses your business and issues your official certificate.

  • Fixed written quoteWithin two working days of your call
  • Free 20-minute callWe tell you if you do not need it
  • Reply within 2 hoursDuring business hours
  • Last checked: Against IASME’s own pages
Two colleagues reviewing a policy document in a ring binder at an office table
14
themes make up the standard, grouped under four headings.
IASME Cyber Assurance help and resources.
20
requirements apply to a sole trader or a two-person partnership.
IASME, updates and milestones in 2025. Published 17 December 2025.
65
requirements apply to an organisation of 50 or more people.
IASME, updates and milestones in 2025. Published 17 December 2025.
3
years is how long a Level Two audit lasts, as long as you renew Cyber Essentials and Level One every year.
IASME Cyber Assurance FAQ.
Sound familiar?

When Cyber Essentials is no longer enough

A buyer wants proof that you manage risk, people and data, not only your devices. These are the usual triggers.

A tender asks for more

IASME says a wide range of industry sectors recognise the certificate as showing that a supplier has put appropriate controls in place to reduce cyber risk.

IASME Cyber Assurance.

A buyer asked for ISO 27001

IASME says a wide range of sectors accept the audited level from small companies as an alternative to ISO 27001. It names the Ministry of Justice and the Government of Jersey.

IASME Cyber Assurance FAQ.

Your policies live in people’s heads

The standard expects written policies, registers and plans that fit your size. IASME publishes free templates for many of them, and we help you fill the gaps.

IASME Cyber Assurance FAQ.

How we help

We get you certified, start to finish

  • A gap list against the requirements for your size, before anything goes to the assessor
  • Your policies and records checked against the standard, starting from IASME’s free templates where they exist
  • Help working through the questions, and with the assessor’s comments if any come back
  • A clear route to an official certificate, and to Level Two if a buyer wants the audit
Best for
UK businesses that hold Cyber Essentials, or are getting it, and now need to show how they manage risk, people and data.
Usually starts when
A tender or customer asks for more than Cyber Essentials, or asks a small supplier for ISO 27001.
What it covers

What it adds to Cyber Essentials

Cyber Essentials covers five technical controls. IASME Cyber Assurance adds how you run security day to day, from risk and policies to backups and recovery. It is the updated version of the IASME Governance standard.

Identify and classify

Know what you hold, what the law asks of you and where your risks are.

  • Planning information security
  • Organisation
  • Assets
  • Legal and regulatory landscape
  • Assessing and treating risks

Protect

Put sensible controls on your premises, people, policies, access and systems.

  • Physical and environmental protection
  • Training people
  • Policies and procedures
  • Managing access
  • Technical intrusion
  • Change management

Detect and deter

Watch your systems so problems are spotted and dealt with early.

  • Monitoring

Respond and recover

Keep backups you have tested, and a plan to keep working through an incident.

  • Backup and restore
  • Resilience

Your size decides which requirements apply. IASME publishes the standard in four versions, for 1 to 2 people, 3 to 9, 10 to 49, and 50 or more. All four are free to download.

We show you where the standard asks about legal duties, such as UK data protection law. You decide which apply. We are not lawyers and do not give legal advice.

Sources: IASME Cyber Assurance help and resources, for the four headings and the four versions. IASME’s articles on the fourteen themes, 11 March to 19 June 2026, for the theme names. The IASME Cyber Assurance FAQ, for IASME Governance and data protection.

Not sure how far you are from the standard? We look at what you already have on the free call and tell you where the gaps are likely to be.

Choosing a level

Level One or Level Two?

Both levels use the same requirements. Level Two adds an audit that checks they are in place and working, not only answered.

Swipe sideways to see every column.

Level One Level Two
Method A verified self-assessment on the online assessment portal. A senior board member or equivalent e-signs that the answers are accurate. An audit of your processes, procedures and controls, in person or sometimes by video call.
Who checks it A qualified external assessor reviews and marks your answers. An IASME-assured assessor reviews documents, interviews key staff and watches how you work. IASME moderates the audit report.
Before you start A valid Cyber Essentials certificate with at least one month left. Both must cover your whole organisation. A Level One pass. The audit must happen while your Level One certificate is valid.
How long it lasts One year. You resubmit every year and keep Cyber Essentials current. Three years, as long as you renew Cyber Essentials and Level One every year.
Fees A set assessment fee by organisation size. Your quote says whether it is included. Quoted for each business, by the size and complexity of your network. IASME says it costs more than Level One.

Not every buyer accepts the same level. Ask whoever sent the request which level they want before you pay for either.

Sources: IASME Cyber Assurance and its FAQ.

Not sure which level you were asked for? Send us the wording from the tender or questionnaire and we will tell you.

How we get you certified

Six steps from first call to certificate

You own the policies and the answers. We run the process around you, from the gap review to the assessor’s comments.

1

A free 20-minute call

We check whether you hold Cyber Essentials, which level the buyer wants and what you already have in place. We also explain how delivery works, and that you can buy Level One direct from IASME.

We reply within 2 hours in business hours
2

A written scope and fixed quote

The scope, price and terms in writing, with a short note on how delivery works. Nothing starts until you accept.

Within two working days of your call
3

Gap review

We go through the version of the standard for your size with you. You get a gap list in the order to tackle it.

One or two working sessions
4

Policies and records

You write or update the policies, registers and plans, using IASME’s free templates where they exist. We check each draft against the requirement it answers.

Our estimate: 2 to 6 weeks, depending on what you have
5

The Level One questions

We work through the questions with you on the online assessment portal, and you own the answers. A senior board member or equivalent e-signs that they are accurate, and we never sign.

IASME says it might take about an hour if you have prepared
6

Assessment and certificate

An independent assessor marks your answers, and we help you reply to any comments and resubmit. On a pass you get a digital certificate and a badge others can verify.

IASME says most assessors aim to reply within three days

Session lengths and the time for policies and records are our planning estimates, not promises. The hour and the three days are IASME’s figures (IASME Cyber Assurance FAQ).

Ready to start? The free call is the first step. If you do not need Cyber Assurance, we will say so.

Why Cambria

Help that fits, and where it stops

We help small businesses that want the certificate without working through the standard alone. Here is who we suit, and who we do not.

We are a good fit if…

  • You hold Cyber Essentials, or are getting it, and a buyer now wants more.
  • You have few written policies and want help getting them right for your size.
  • You have a deadline and want someone to run the process with you.

We are not the right fit if…

  • You need ISO 27001 or SOC 2. We do not arrange either.
  • You need legal advice on data protection. We show you where the standard asks about it, but we do not give legal advice.
  • You are happy to work from IASME’s free standard, questions and templates on your own. You can buy the Level One assessment direct from IASME.
Price

A fixed quote for your size and starting point

We price by company size and by how much you already have in place. If you do not hold Cyber Essentials yet, we quote for both.

You get a fixed written quote within two working days of your call. It says whether the Level One assessment fee is included. A Level Two audit is quoted separately.

IASME gives you six months to complete the Level One assessment once you have paid. If the account lapses, the fee is not refunded. You resubmit every year to keep the certificate.

Our IASME Cyber Assurance support is for businesses and organisations. If you are buying for personal use, tell us before you order.

Questions

Common questions

Is your question missing? Ask us on the contact page and we will reply within 2 hours during business hours.

A cyber security standard and certification run by IASME. It builds on Cyber Essentials and adds how you manage risk, people, policies, suppliers, backups and recovery.

It is the updated version of the IASME Governance standard. There are two levels: Level One is a verified self-assessment, and Level Two adds an audit.

Yes. IASME asks for a valid Cyber Essentials certificate with at least one month left before it expires. Both certificates must cover your whole organisation.

You can apply for both at once, but the Cyber Assurance assessment cannot start until you hold Cyber Essentials. The two are charged separately.

If you do not hold it yet, see our Cyber Essentials support.

For some buyers. IASME says a wide range of sectors accept the audited level from small companies as an alternative to ISO 27001. It names the Ministry of Justice and the Government of Jersey.

It is not accepted everywhere, so ask the buyer before you choose. We do not arrange ISO 27001.

In our estimate, the risk assessment, policies and records take most of the time, usually 2 to 6 weeks for a small business. It depends on what you already have.

IASME says the questions might take about an hour if you have prepared your answers, and most assessors aim to return results within three days. IASME gives you six months to finish once you have paid, and does not refund the fee if the account lapses.

An IASME-assured assessor reviews your documents, interviews key staff and watches how you work. This happens in person or sometimes by video call.

IASME lists documents such as the risk assessment, asset registers, security policy, incident tracker and business continuity plan. The assessor’s report then goes through IASME’s moderation before the result.

You get the assessor’s comments on any answer they judged non-compliant. IASME gives you two working days to fix simple issues and update your answers, and the assessor looks again at no extra charge.

If you still fail after that, you reapply and pay again. No one can promise a pass, because the assessor decides the result.

Level One lasts a year, so you resubmit the questions every year and keep Cyber Essentials current. A Level Two audit lasts three years, as long as you renew Cyber Essentials and Level One every year.

You enter all your answers again at each renewal, so keep a copy of what you submit.

An IASME-licensed Certification Body that we work with. Its assessor marks your answers or carries out your audit, and the body issues your certificate. We are not the Certification Body and we do not mark your answers.

We arrange the assessment through that body, and any assessment fee in your quote is part of our price. The order form you sign before you pay names the body, and we will tell you now if you ask.

Checked against the sources

Where these facts come from

Every fact about the scheme on this page comes from IASME’s own pages. We update the page when the standard changes.

Last checked:

Cambria Digital is an independent company. It is not part of IASME and is not endorsed by it. IASME Cyber Assurance is IASME’s own standard.

Related Services

Other services that sit alongside it

Cyber Assurance needs a valid Cyber Essentials certificate first. Website maintenance covers the website side.

Cyber Essentials Website Maintenance

Asked for more than Cyber Essentials?

Send us the wording from the tender or questionnaire. We will tell you which level fits and what to do next, and we reply within 2 hours during business hours.

Or reach us directly: 029 2036 9382 · info@cambriadigital.co.uk