// Service Brief
IASME Cyber Assurance Level 1 and Level 2 Certification
IASME Cyber Assurance is a recognised UK certification for organisations that need broader information assurance than Cyber Essentials alone. Primelo Cyber assesses and certifies Level 1 and Level 2 directly as an IASME-authorised Certification Body.
// 01 — What Cyber Assurance Is
A UK Information Assurance Standard Aligned with ISO 27001 Principles
Cyber Assurance (previously known as IASME Governance) is administered by IASME and recognised by the UK National Cyber Security Centre as a route to demonstrate broad information security and data protection capability. It covers the technical controls required by Cyber Essentials and extends into governance, risk management, asset management, incident response, business continuity, data protection, and supplier assurance.
The standard is structured around thirteen themes and maps directly to UK GDPR and to the core principles of ISO/IEC 27001, making it an effective stepping stone for small and mid-sized organisations that need credible assurance without the full weight of ISO certification.
Scope Covered by the Cyber Assurance Standard
- Planning and organisation: leadership accountability, information assurance policy, and risk appetite.
- Asset, people, and physical controls: information asset inventory, access rights, physical security, and staff awareness.
- Legal, regulatory, and data protection: UK GDPR alignment, records of processing, and rights handling.
- Risk assessment and management: documented methodology, risk register, and treatment plans.
- Technical controls: the five Cyber Essentials controls plus extended hardening, monitoring, and patching.
- Incident response and continuity: tested incident playbooks, backup regimes, and recovery plans.
- Supplier management: due diligence, contractual safeguards, and ongoing oversight of third parties.
// 02 — Level 1 vs Level 2
Choosing Between Verified Self-Assessment and Independent Audit
Cyber Assurance is offered at two levels. Both result in a formally recognised certificate issued under the IASME scheme, but they differ in assessment depth, evidence expectations, and the weight of assurance provided to customers, regulators, and insurers.
LEVEL 01
Verified Self-Assessment
The organisation completes the IASME Cyber Assurance question set and submits supporting evidence references through the IASME portal. Primelo Cyber reviews the responses as the authorised Certification Body and issues the certificate when the submission meets the standard.
- Remote, questionnaire-based assessment.
- Valid Cyber Essentials certificate required as a prerequisite.
- Shorter preparation window, lower assessment fee.
- Suitable for smaller organisations and supply-chain assurance needs.
LEVEL 02
Independently Audited
Includes everything in Level 1, plus an independent audit conducted on-site or remotely by an IASME-certified assessor. The auditor tests documentation, interviews control owners, and samples evidence to verify that controls are designed and operating effectively.
- Full document review plus on-site or remote audit.
- Higher assurance level recognised by regulated buyers and insurers.
- Stronger foundation for a future ISO/IEC 27001 certification programme.
- Suitable for organisations handling sensitive data or regulated services.
Level 1 is typically the right starting point for organisations up to around 50 staff that want verified assurance beyond Cyber Essentials. Level 2 is appropriate where buyers, insurers, or regulators require independent audit evidence or where the organisation is preparing for ISO 27001 certification over a longer horizon.
// 03 — Primelo Cyber Cyber Assurance Services
How Primelo Cyber Helps Prepare for Level 1 and Level 2 Certification
As an IASME-authorised Certification Body, Primelo Cyber assesses and certifies organisations at Cyber Assurance Level 1 and Level 2. Our structured programme also gets controls, documentation, and evidence ready for assessment, with fixed-fee milestones and clear actions through to certification.
SERVICE 01
Readiness Gap Analysis
Structured review against the thirteen Cyber Assurance themes. We map current posture, flag gaps, and produce a prioritised remediation plan aligned with the target level and your in-house capacity.
SERVICE 02
Level 1 Self-Assessment Support
Hands-on support to draft policies, complete the IASME question set, and build the evidence references required for a clean verified self-assessment submission first time.
SERVICE 03
Level 2 Audit Preparation
Deeper documentation, operational evidence, control testing, and a pre-audit dry run so the IASME auditor finds mature controls, complete records, and confident control owners on the day.
SERVICE 04
Full Lifecycle Support
End-to-end delivery from prerequisite Cyber Essentials certification, through Level 1 or Level 2, and on to annual renewal, supplier assurance, and readiness for future ISO 27001 certification.
- Clear pathway from Cyber Essentials baseline to Level 1 and Level 2 Cyber Assurance.
- Practical policies and evidence packs designed for the IASME question set and audit sampling.
- Control ownership and training so the programme is sustainable after certification.
- Direct assessment and certificate issue through Primelo Cyber as the IASME-authorised Certification Body.
Cyber Assurance vs ISO 27001 — which do you need?
Cyber Assurance offers a proportionate, UK-focused route to independently verified governance, resilience, data protection, and technical controls. ISO 27001 is usually the better fit where customers or regulators require an internationally recognised information security management system and formal certification by an ISO certification body. Some organisations use Cyber Assurance first, then progress to ISO 27001 as their assurance needs grow.
Cyber Assurance sits alongside the other frameworks Primelo Cyber supports. Teams targeting a deeper information security management system should also review our ISO 27001 certification service, while those with broader personal data obligations should pair this work with our GDPR compliance service. Verification of our issuing bodies and practitioner credentials is available on the accreditations page.
Start Cyber Assurance Assessment