IASME Cyber Baseline Explained: What It Covered and What to Use Now

IASME Cyber Baseline is a cyber hygiene certification that IASME launched in October 2023 for organisations outside the UK. It checked basic security across 8 themes through a verified questionnaire, marked by an independent assessor and renewed every year, and IASME presented it as a first step towards its wider standard, IASME Cyber Assurance. Its status has since changed: when we checked in October 2026, IASME’s Cyber Baseline page said it was no longer available and pointed visitors to IASME Cyber Assurance for current certification options.

This guide explains what the scheme covered, what that change means for you and which certificate to ask for instead. Sovereign Secure is an IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance. For the organisation behind the scheme, see our guide to who IASME is and what it runs.

Is IASME Cyber Baseline still available?

Not as a current scheme, as far as IASME’s own website shows. When we checked in October 2026:

• the Cyber Baseline scheme page said the page was no longer available and directed visitors to IASME Cyber Assurance;
• Cyber Baseline no longer appeared in IASME’s list of schemes or as a scheme in its Network Directory;
• IASME’s Cyber Assurance pages asked organisations outside the UK to contact IASME to discuss which prerequisite certification applies to them.

On the pages we reviewed, IASME had not published a closure date or said what happens to certificates already issued. Until IASME says otherwise, plan around that uncertainty.

What is IASME Cyber Baseline?

It is IASME’s own certification, not a government scheme. Cyber Essentials belongs to the National Cyber Security Centre (NCSC) and is delivered by IASME, whereas IASME designed and owned Cyber Baseline.

IASME announced the scheme on 9 October 2023 as a cyber hygiene certification for organisations outside the UK, aimed at global supply chains. “Cyber hygiene” means the basic controls that stop most common attacks: knowing what you own, controlling who can reach it, configuring and protecting it, backing it up and knowing what to do when something goes wrong. IASME’s launch announcement says the scheme mapped to international cyber hygiene standards and best practices, naming COBIT and the CIS Controls v8, many of which have no certification route of their own. Cyber Baseline gave a supplier a certificate a customer could check.

What did IASME Cyber Baseline cover?

It was built around 8 themes, which IASME lists in its article on the 8 themes of IASME Cyber Baseline. The theme names are IASME’s; the descriptions summarise IASME’s guidance on each theme.

At launch, IASME described these 8 themes as a starting point that organisations could build on towards the full set of themes in IASME Cyber Assurance (13 at the time; IASME now organises Cyber Assurance into 14). Compared with the five technical controls in Cyber Essentials, Baseline reached further into suppliers, people, backup and recovery.

Who was IASME Cyber Baseline for?

IASME made it available to organisations outside the UK, of every size and in every sector. It suited overseas suppliers in international supply chains whose customers wanted independent evidence of basic controls, and overseas organisations working towards IASME Cyber Assurance, for which IASME described Baseline as one prerequisite.

It was not the usual choice for UK organisations. In the UK, Cyber Essentials is the government-backed baseline that public sector buyers ask for, and IASME asks UK applicants for Cyber Assurance to hold a valid Cyber Essentials certificate first.

How did the Cyber Baseline assessment work?

Applicants answered a verified assessment questionnaire on IASME’s online platform. A senior board member or equivalent e-signed a declaration that the answers were true, and a qualified external assessor marked them. The certificate was renewed every year. IASME delivered the scheme through an international network of cyber security companies and assessors that it trained and licensed.

At launch, IASME priced it on a sliding scale by organisation size, from £300 + VAT for micro organisations to a maximum of £500 + VAT, or US$390 to US$650. As IASME no longer lists the scheme, there is no current fee to check.

Is IASME Cyber Baseline the same as Cyber Essentials?

No. They are separate schemes with different owners, audiences and scope. Cyber Essentials concentrates on five technical controls that block common internet-based attacks; Cyber Baseline covered a wider set of themes at a basic level.

What should you use instead of IASME Cyber Baseline?

Choose the certificate your customers will accept. Cyber Essentials is not limited to UK-registered organisations, so an overseas supplier selling into the UK can certify to it, and it is the certificate UK buyers recognise.

If a contract simply says “IASME certified”, ask which scheme and which level the customer means before you buy anything. For a wider comparison with ISO 27001, PCI DSS and SOC 2, see our guide to UK cyber security certifications.

Is it the same as Cyber Exercise Baseline, IoT Cyber or Maritime Cyber Baseline?

No. IASME runs several schemes with “Baseline” in the name, and they certify different things. The status column shows what IASME’s website said in October 2026.

If you were looking for incident exercising, our guide to running a cyber tabletop exercise covers scenarios, roles and the evidence an exercise produces.

Why Sovereign Secure

• IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance, the scheme IASME now points Cyber Baseline visitors to. We will tell you plainly which certificate a requirement points to.
• Published prices. Cyber Essentials packages start at £320 + VAT; see our Cyber Essentials cost page for every size band.
• International presence. Headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
• Wider assurance. Sovereign Secure is ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company, and provides ISO 27001 consultancy for organisations that outgrow baseline schemes.

Next step

Has a customer asked for Cyber Baseline, or are you replacing a Cyber Baseline certificate? Send us the requirement through the form below, choosing “First time Cyber Essentials (CE)”, or “IASME Cyber Assurance” if your customer wants wider governance assurance, and we will tell you which certificate it points to. You can also call +44 161 523 5276.