What Is IASME? The Cyber Essentials Delivery Partner Explained

IASME is the company that delivers the UK government’s Cyber Essentials scheme for the National Cyber Security Centre (NCSC). The name stands for Information Assurance for Small and Medium-sized Enterprises. The organisation behind it, The IASME Consortium Ltd, is a cyber security certification company based in the Malvern Hills, with offices in Belfast and near Edinburgh. It licenses the certification bodies that assess organisations, runs the platform that applicants use to answer the questions and operates several certification schemes of its own.

This page is about the organisation. If you want to get certified, our Cyber Essentials certification page explains the scheme, the process and the prices. Sovereign Secure is an IASME-licensed certification body for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, so we work within IASME’s rules every day.

What does IASME stand for?

IASME stands for Information Assurance for Small and Medium-sized Enterprises. The name comes from a project funded by the Technology Strategy Board (now Innovate UK) to create an information security standard that small businesses could realistically meet, because ISO/IEC 27001 was seen as too demanding for many of them. The resulting standard was launched in 2011.

The IASME Consortium was incorporated as a company in January 2012 to take that work forward. Its own standard, first known as IASME Governance, is now called IASME Cyber Assurance. The SME focus explains the name, but IASME’s schemes now cover organisations of every size, and some of them certify connected devices and ships rather than organisations.

What does IASME do?

IASME runs cyber security certification schemes and the network of companies that deliver them. It does not normally assess you itself; a certification body it licenses does. In practice, IASME:

• licenses and oversees certification bodies and the assessors who work for them;
• publishes the question sets and runs the online assessment platform that applicants use;
• issues certificates and digital badges, and runs the public certificate search;
• delivers schemes for government: Cyber Essentials and Cyber Advisor for the NCSC, Defence Cyber Certification with the MOD and ASSURE for the Civil Aviation Authority;
• writes and runs its own standards, such as IASME Cyber Assurance and its IoT and maritime schemes.

Is IASME the same as Cyber Essentials?

No. Cyber Essentials is the NCSC’s scheme, and IASME is the company the NCSC appoints to deliver it. The NCSC owns the scheme and sets the technical requirements. IASME publishes the question set, licenses the certification bodies and runs the assessment platform and certificate search. A certification body assesses you. Our page on how the Cyber Essentials scheme works explains that split in full.

IASME has been part of the scheme since it launched in 2014, when it was one of several accreditation bodies. In late 2019 the NCSC chose it to replace the arrangement under which five organisations delivered the scheme, and IASME has been the sole delivery partner since April 2020. There is no separate IASME version of the certificate: what people call “IASME Cyber Essentials” is the standard NCSC Cyber Essentials certificate, issued through IASME’s platform by a licensed certification body.

What schemes does IASME run?

Cyber Essentials is the best known, but it is one of a family of schemes. IASME is the NCSC’s sole delivery partner for Cyber Essentials and Cyber Advisor and one of its two delivery partners for Cyber Incident Response and Cyber Incident Exercising. Defence Cyber Certification was developed with the Ministry of Defence (MOD), ASSURE is delivered for the Civil Aviation Authority (CAA) and the other schemes are IASME’s own. This table summarises IASME’s list of schemes, checked on 13 October 2026, and also notes Cyber Baseline, which is no longer available.

Sovereign Secure is listed on IASME’s Network Directory (checked 13 October 2026) for Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1. For any other scheme, or for Defence Cyber Certification at Levels 2 and 3, the Network Directory (below) shows which organisations are licensed or assured to deliver it.

What is IASME DCC?

IASME DCC is Defence Cyber Certification, the certification scheme for UK defence suppliers that the MOD developed with IASME. IASME acts as the scheme’s Certification Authority and delivers it through assured certification bodies. Its four levels, 0 to 3, match the Cyber Risk Profiles that MOD contracts set under DEFCON 658: every level needs Cyber Essentials, and Levels 2 and 3 also need Cyber Essentials Plus. The MOD has asked all industry partners to reach Level 0 by 31 December 2026.

We certify Levels 0 and 1. Our page on DEFCON 658 and Defence Cyber Certification explains the levels, the controls behind each one and how certification works.

What is the IASME portal?

It is IASME’s online assessment platform, where you answer the Cyber Essentials questions, save your progress and submit your answers for marking. You get your login once you have bought an assessment, either directly from IASME or through a certification body, and you then have up to six months to complete it. A senior person in your organisation confirms the answers are accurate before you submit.

After you pass, IASME issues your certificate and a digital badge for your website. Our IASME portal guide walks through account set-up, answering, submitting and finding your certificate, and our guide to the Cyber Essentials logo and badge explains how to display it.

How do I check a certification body is IASME-licensed?

Search for it in IASME’s Network Directory, the official list of IASME-licensed certification bodies and NCSC-assured service providers. Each listing shows the certifications the company can deliver and its office location.

1. Read the certifications line. The directory shows “NCSC Cyber Essentials” and “NCSC Cyber Essentials Plus” as separate entries. Not every certification body is qualified to carry out Plus audits, so if you need Plus, check that it appears in the listing. The same applies to IASME Cyber Assurance and to each Defence Cyber Certification level.
2. Don’t confuse advisers with certification bodies. The directory also lists NCSC-assured Cyber Advisors and incident response providers. A company listed only for “NCSC Cyber Advisor” can help you prepare but cannot certify you.
3. Match the legal name. Listings usually show a trading name, so compare it with the company’s registered name and number at Companies House.
4. Check the certificate later. Your certificate names the certification body that issued it, and anyone can check a Cyber Essentials certificate on IASME’s free certificate search.

A licence is the minimum. When you compare certification bodies, also look at turnaround times, whether Plus audits are available on site and remotely, and whether prices are published. Our guide to choosing a Cyber Essentials assessor covers those points.

What does “IASME certification” mean?

It usually means one of three things, so check which one you are being asked for:

• A Cyber Essentials or Cyber Essentials Plus certificate, issued under the scheme IASME delivers for the NCSC. This is what most UK tenders and supply-chain questionnaires mean.
• IASME Cyber Assurance, IASME’s own standard, which goes further than Cyber Essentials into governance, risk management and data protection. UK organisations must hold a valid Cyber Essentials certificate before they can be assessed for it. We certify both, and our IASME Cyber Assurance certification page compares them.
• Defence Cyber Certification, for suppliers to the MOD, at the level their contract sets. We certify DCC Levels 0 and 1.

If a customer or contract simply says “IASME certified”, ask which scheme and which level they need before you buy anything.

Why Sovereign Secure

• IASME-licensed certification body. We assess and certify Cyber Essentials and Cyber Essentials Plus, IASME Cyber Assurance at both levels and Defence Cyber Certification at Levels 0 and 1. The Cyber Essentials certificates we issue appear on IASME’s public certificate search.
• Published prices. Cyber Essentials costs from £320 + VAT (Bronze, 0 to 9 employees) to £750 + VAT (Gold, 250+ employees), with a pre-assessment check and a support call of up to an hour included.
• Wider assurance. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified, is a PCI SSC Qualified Security Assessor (QSA) company and sits on the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.

Next step

Ready to certify? See our Cyber Essentials certification packages, from £320 + VAT, or send us your company size through the form below and choose “First time Cyber Essentials (CE)”. For IASME Cyber Assurance or Defence Cyber Certification, choose that scheme in the same list and tell us the level you need. You can also call +44 161 523 5276.