IASME Cyber Assurance Certification

IASME Cyber Assurance certification shows customers that you manage cyber security and data protection as a whole, not only the five technical controls of Cyber Essentials. Sovereign Secure is listed on IASME’s Network Directory as a certification body for IASME Cyber Assurance (checked 13 October 2026), so we assess and certify it at both levels: Level One Verified Assessment and Level Two Audited. We are also an IASME-licensed certification body for Cyber Essentials, the certificate you must hold first, so the prerequisite and the standard can come from one team.

If a customer asks for Cyber Essentials, you need Cyber Essentials. If it wants wider governance assurance without the weight of ISO 27001, Cyber Assurance may be the answer. If a customer names IASME Cyber Baseline, IASME’s international hygiene scheme, note that IASME’s page for it now points to Cyber Assurance instead. For the organisation behind both schemes, see our guide to IASME.

What is IASME Cyber Assurance?

It is a risk-based standard and certification scheme, owned and run by IASME, that shows an organisation has put a range of cyber security and data protection controls in place. It was previously called IASME Governance. IASME says the key controls are unchanged but reorganised into 14 themes, grouped under four headings: Identify and Classify, Protect, Detect and Deter, and Respond and Recover.

According to IASME’s Cyber Assurance FAQ, the standard covers:

• assessing and managing risk;
• technical controls against cyber threats;
• training people;
• practical policies and procedures;
• backups, business continuity planning and incident response;
• risks from third-party suppliers and service providers;
• legal and regulatory requirements, which in the UK means UK GDPR and the Data Protection Act 2018.

The standard is tailored to size. Sole traders and two-person partnerships, micro businesses (3 to 9 people), small businesses (10 to 49) and medium or large organisations (50 or more) each get a version containing only the themes and requirements relevant to them. A five-person firm is not asked for the same depth as a 500-person one.

What are Level One (Level 1) and Level Two (Level 2)?

IASME Cyber Assurance has two levels, which IASME calls Level One Verified Assessment and Level Two Audited, often written as IASME Cyber Assurance Level 1 and Level 2. The requirements are the same at both; what changes is how they are checked. You must pass Level One before you apply for Level Two.

Level One includes no technical test or vulnerability scan, so the signed declaration carries real weight. At Level Two, IASME lists the documents an assessor will review, including an administrator access tracker, business continuity plan, information asset register, physical asset register, risk assessment, security improvement plan, security incident tracker and security policy. IASME publishes free templates for many of them on its Cyber Assurance help and resources page.

Do you need Cyber Essentials first?

Yes. UK organisations need a valid Cyber Essentials certificate with at least one month left before expiry when they buy Cyber Assurance, and both certificates must cover the whole organisation. You can buy both at once, but the Cyber Assurance assessment cannot start until Cyber Essentials is achieved. Organisations outside the UK agree their prerequisite with IASME directly.

Because we certify both schemes, we can take you through them in order: Cyber Essentials certification first, then Level One, then a Level Two audit if your customer asks for it. If you already hold Cyber Essentials Plus, that meets the prerequisite too, provided its scope is the whole organisation.

How does IASME Cyber Assurance certification work with us?

1. Scoping call. We confirm which level your customer or tender asks for, check that your Cyber Essentials scope covers the whole organisation and agree a timetable.
2. Cyber Essentials, if needed. If you don’t hold a current certificate with at least a month left, we certify Cyber Essentials first.
3. Prepare. IASME publishes the standard and question set free, in versions for each organisation size. Draft your answers and gather your policies and registers before you start.
4. Level One. You answer the verified self-assessment in IASME’s online platform within six months of buying, a board member e-signs it and our assessor marks it. If you fail, IASME’s terms allow two working days to fix simple issues and resubmit at no extra charge; after that, you reapply and pay again.
5. Level Two, if you need it. Our IASME-assured assessor audits your documents, interviews key staff and observes how controls work in practice, within six months of Level One. The audit report then goes through IASME’s moderation.
6. Certificate and renewal. You receive a digital certificate and a verifiable digital badge for your website or email footer. Resubmit Level One and renew Cyber Essentials every year; you re-enter every answer each time, so keep a copy of what you submitted.

Our IASME portal guide explains how IASME’s online assessment platform works. Once you are certified, buyers can check your certificate on IASME’s certificate search; see how to verify a certificate we issued.

How much does IASME Cyber Assurance cost?

IASME publishes the Level One price by organisation size (checked October 2026). Cyber Essentials is charged separately, so budget for both if you don’t hold it yet.

Level Two has no published price. It depends on the size and complexity of your organisation and the number of sites, people and documents the assessor needs to review, so certification bodies quote for it individually. We confirm the cost of each stage in writing after the scoping call. Note that IASME uses two size definitions: the purchase bands above follow the UK government’s employee counts, while the depth of the question set follows the four scheme sizes described earlier.

Is IASME Cyber Assurance better than Cyber Essentials?

Neither is better; they do different jobs, and Cyber Assurance sits on top of Cyber Essentials rather than replacing it. Which you need depends on who is asking.

• Choose Cyber Essentials when a contract or customer names it. It is required in many UK central government contracts and is the base for everything else.
• Add Cyber Assurance when a customer wants evidence of risk management, policies, incident response and data protection, and ISO 27001 would be more than your organisation needs.
• Look at ISO 27001 when customers ask for it by name or you sell internationally. Our Cyber Essentials vs ISO 27001 comparison shows where each scheme fits.

Who asks for IASME Cyber Assurance?

Mainly customers and public bodies buying from smaller suppliers. IASME says a range of sectors accept the audited level as an alternative to ISO 27001 for small companies, and names the Ministry of Justice and the Government of Jersey as examples. Before you buy, check the exact wording of the requirement: some buyers want Level Two specifically, and older documents may still say “IASME Governance”.

Defence suppliers are usually asked for something different: MOD contracts use the Defence Cyber Certification levels under DEFCON 658, which we also certify at Levels 0 and 1.

Why certify with Sovereign Secure?

• Licensed for the whole route. We are an IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance, so one team handles the prerequisite and both levels.
• Wider assurance work. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified and is a PCI SSC Qualified Security Assessor (QSA) company.
• A route to ISO 27001 if you outgrow it. If a customer later asks for ISO 27001, we provide consultancy, with certification audits by our partner certification body, MQA International.

Next step

Tell us which level you need, your organisation’s size and whether you already hold Cyber Essentials. Use the form below, where “IASME Cyber Assurance” is already selected, or call +44 161 523 5276. If you need the prerequisite first, compare our Cyber Essentials packages and prices.