Certified and accredited
See our trust centre
Fourteen themes, in four groups.
Cyber Essentials covers your technical controls. Cyber Assurance adds how you plan, run and recover, across these themes.
Identify and classify
Know what you hold, the law that applies to it and where the risks are.
- Planning
- Organisation
- Assets
- Legal landscape
- Risk assessment
Protect
Control who gets in, on site and online, and keep people and changes in line.
- Physical protection
- Training people
- Policies and procedures
- Managing access
- Technical intrusion
- Change management
Detect and deter
Watch for attacks and act on what you see.
- Monitoring
Respond and recover
Get your data and services back after an incident.
- Backup and restore
- Resilience
The two levels, side by side.
The controls are the same at both levels. Level 2 adds an audit, and you pass Level 1 first.
| Level 1, verified assessment | Level 2, audited | |
|---|---|---|
| How it's checked | A verified self-assessment in IASME's portal | An audit of your processes, procedures and controls |
| What's examined | Your answers, signed off by a board member | Your documents, interviews with key staff and activities observed |
| Where | Online | On site, or sometimes by video call |
| Before you start | A current Cyber Essentials certificate covering your whole organisation | A current Level 1 certificate |
| After the check | We mark each answer, with comments on anything that falls short | Our audit report goes through IASME's moderation before the certificate is issued |
| How long it lasts | One year | Three years, with Level 1 and Cyber Essentials renewed each year |
Scaled to your size.
IASME sets how deep each theme goes by how many people you have, so a small firm answers the questions that fit it.
1 to 2
Sole traders and two-person partnerships
3 to 9
Micro organisations
10 to 49
Small organisations
50+
Medium and large organisations
What a Level 2 auditor asks to see.
These are the documents IASME lists as examples. It publishes free templates for each of them.
Risk assessment
The risks to your information and systems, and what you're doing about each one.
Information asset register
The information you hold, where it's kept and who's responsible for it.
Physical asset register
Your devices and equipment, and who has each one.
Administrator access tracker
Who has admin rights, to which systems, and when that was last checked.
Security policy
The rules your staff work to, approved by your leadership.
Business continuity plan
How you keep working, and recover, when a system or site fails.
Security incident tracker
Each incident, what you did about it and what changed afterwards.
Security improvement plan
The gaps you've found and when you'll close each one.
Cyber Assurance or ISO 27001?
IASME says a wide range of sectors accept the audited level in place of ISO 27001 for small companies, the Ministry of Justice among them. The full audit comes round every three years, with Level 1 checks in between, which IASME says keeps the cost down.
If a customer asks for ISO 27001 as well, we map your controls to it.
IASME's Cyber Assurance FAQHow it works.
Scope
We confirm your Cyber Essentials covers the whole organisation, which both levels need.
Prepare
You work through IASME's question set, and our consultants help close any gaps if you want them to.
Submit
A board member signs off your answers in the IASME portal, and we mark each one.
Certify
We issue your Level 1 certificate, then audit you for Level 2 if you need it.
Get a Cyber Assurance quote.
Tell us what you need and we'll show you what happens next. The price depends on your size and the level, so we send it within one working day.
Answer the 3 questions to see what happens next.
We reply within one working day with a price.
IASME Cyber Assurance questions.
Are you an IASME Cyber Assurance certification body?
Yes. IASME accredits us to assess and certify Cyber Assurance at Level 1 and Level 2, separately from our Cyber Essentials accreditation.
Do we need Cyber Essentials first?
Yes. You need a valid Cyber Essentials certificate covering your whole organisation, and we certify that too.
What's the difference between Level 1 and Level 2?
The controls are the same. Level 1 is a verified self-assessment, and Level 2 adds an audit of how you apply them.
Is IASME Cyber Assurance an alternative to ISO 27001?
For many small organisations, yes. IASME says a wide range of sectors accept the audited level in place of ISO 27001, including the Ministry of Justice.
What happens if we fail?
You get our comments on every answer that falls short, and two working days to fix simple issues and resubmit at no extra cost.
How long does it take?
Most of the time goes on getting ready. You have six months from paying for the assessment to submit your answers.
Do you work with organisations outside Norwich?
Yes, across the UK. Level 1 runs through the IASME portal, and we carry out Level 2 audits on site or by video call.
Other services.
Get your Cyber Assurance certificate.
Tell us how many people you have, whether you hold Cyber Essentials and which level you need, and we'll send a quote.