All services Every engagement has a fixed, published price. Book a strategy call
What IASME Cyber Assurance covers, how Level One and Level Two work, the official fees by organisation size, and when it beats Cyber Essentials alone or ISO 27001 for UK organisations.
IASME Cyber Assurance is the least understood of the three certifications UK organisations are usually choosing between, sitting between Cyber Essentials and ISO 27001 in both depth and cost. This guide explains what the standard covers, how its two levels work, what it costs at official prices, and when it is the right choice rather than either of its better known neighbours.
The short answer. IASME Cyber Assurance is a UK governance and resilience standard for organisations of every size, run by IASME, the company that also delivers Cyber Essentials for the UK Government. It comes in two levels: Level One, a verified self-assessment marked by an independent assessor, priced by organisation size from £320 to £600 + VAT, and Level Two, an independent audit, quoted individually. A valid Cyber Essentials certificate covering the whole organisation is a prerequisite.
Where Cyber Essentials tests five technical controls, IASME Cyber Assurance assesses the way the organisation is run: fourteen themes that take in risk management, policy, people, legal and data protection duties, backup, incident response and business resilience. It is the difference between proving your firewall is configured and proving your organisation would survive a bad week. The standard is tailored by organisation size, from sole traders through to large enterprises, so the compliance burden matches the organisation rather than a template, and the full question set is published free on the IASME website, which means you can read exactly what you will be assessed against before spending anything.
Level One is a verified assessment. You complete the assessment questions on IASME’s platform, a senior board member signs to confirm the answers are accurate, and a qualified external assessor reviews and marks them. It is self-assessment with teeth: the signature makes the answers a board commitment, and the marking makes optimism visible.
Level Two is an audit. An IASME assured assessor examines documentation, interviews key staff and observes how things run, in person or remotely. You must pass Level One before applying for Level Two, and the audited level is what carries weight where a customer or partner wants more than a signed declaration.
Level One is priced by organisation size at official IASME rates:
| Organisation size | Level One fee |
|---|---|
| Micro (0 to 9 employees) | £320 + VAT |
| Small (10 to 49 employees) | £440 + VAT |
| Medium (50 to 249 employees) | £500 + VAT |
| Large (250+ employees) | £600 + VAT |
Level Two is quoted individually by certification bodies, priced by the size and complexity of the organisation. Two conditions shape the real cost. First, a valid Cyber Essentials certificate with at least one month remaining is a prerequisite, and if you do not hold one it is added at checkout, priced by the same size bands from £320 + VAT. Second, the scope must cover the whole organisation: there is no certifying a convenient corner of the business.
The larger cost, as with any governance standard, is the work of meeting it: policies that exist, backups that run, incident plans that have been exercised. Organisations starting from a working Cyber Essentials baseline are much of the way there, which is the sensible order to take them in.
| Cyber Essentials | IASME Cyber Assurance | ISO 27001 | |
|---|---|---|---|
| What it tests | Five technical controls | Governance, risk, people, data protection and resilience across fourteen themes | A full information security management system |
| Recognition | UK Government scheme. Required in many public sector contracts | Growing UK supply chain recognition | International. The standard enterprise procurement asks for |
| Certification cost | £320 to £600 + VAT by size | Level One £320 to £600 + VAT by size. Level Two by quote | Certification body fees typically £4,000 to £12,000 over three years, plus preparation |
| Effort | Days to weeks | Weeks | Months |
The positioning is practical. Cyber Essentials is the baseline nearly every UK organisation should hold. IASME Cyber Assurance adds governance and resilience for a certification fee under a thousand pounds, which makes it the strongest value rung on the ladder for small and mid-size organisations whose customers want more than the baseline. ISO 27001 is the answer when enterprise customers or international markets demand it, at a different order of cost: our ISO 27001 cost guide sets that out honestly, and our three-way comparison covers the decision in full.
Three situations make it the right answer. A supply chain is asking for more than Cyber Essentials but has not named ISO 27001: the audited Level Two answers most such requests at a fraction of the cost. The organisation handles personal data at scale for its size: the standard’s data protection themes give a board evidence of alignment with its legal duties, which insurers increasingly ask about. The board wants a roadmap rather than a badge: the fourteen themes function as a maturity plan for a small organisation, and the free question set makes the gap analysis costless to start.
Start with Cyber Essentials, because it is the prerequisite and the technical baseline. Download the free question set from IASME and read it against your organisation honestly: the themes where you have nothing written down are the work. Fix the gaps that matter first, working documents over shelf policies, then take Level One, and step up to the audited Level Two when a customer or your own confidence justifies it. Where nobody in-house has time to own the process, our vSCARO runs certification calendars and evidence as a monthly service, and the wider practice is described under cyber assurance.
A UK governance and resilience certification run by IASME, assessing fourteen themes across risk, policy, people, data protection, backup, incident response and resilience. It is available as a verified self-assessment (Level One) or an independent audit (Level Two).
Level One is priced by organisation size at official rates: £320 + VAT for micro organisations, £440 for small, £500 for medium and £600 for large. Level Two is quoted individually by certification bodies. A valid Cyber Essentials certificate, priced by the same size bands, is a prerequisite.
Yes. A valid Cyber Essentials certificate with at least one month remaining before expiry is required, and both certifications must cover the whole organisation.
No, and it does not claim to be. ISO 27001 is the international management system standard that enterprise procurement recognises, at materially higher cost. IASME Cyber Assurance covers much of the same governance ground in a form sized for small and mid-size organisations, and is often the right rung before ISO 27001 rather than instead of it forever.
Level One is a verified self-assessment: your answers, signed by a board member, marked by an independent assessor. Level Two is an audit: an assessor examines documentation, interviews staff and observes practice. Level One must be passed first.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
