IASME Cyber Assurance Certification
(Level 1 and Level 2)
IASME Cyber Assurance (ICA) is a UK cyber security and governance certification that builds on Cyber Essentials. It looks beyond your technical controls to assess your organisational, user and management controls too, so you can show customers and partners that your business is genuinely resilient, not just technically protected.
The standard was developed by IASME, the body the UK Government appointed to run the Cyber Essentials scheme. It was designed as an accessible, affordable, UK-developed route to strong information security, and it maps closely to the National Cyber Security Centre's 10 Steps to Cyber Security. For most small and medium organisations it sits in the sweet spot between Cyber Essentials and the international "gold standard", ISO 27001.
Regola offers support and certification for organisations working towards ICA at both Level 1 and Level 2.
You must acquire Cyber Essentials first
To hold IASME Cyber Assurance, you need a valid Cyber Essentials certificate in place throughout your ICA certification period. Cyber Essentials covers the core technical controls; Cyber Assurance builds the wider governance and resilience picture on top of that foundation. If you are not certified to Cyber Essentials yet, that is where we would start you, and we can take you through both from the ground up.
What is IASME Cyber Assurance?
IASME Cyber Assurance (formerly IASME Governance) is a UK information security standard that assesses technical, organisational, user and management controls. It is available at two levels: Level 1, a verified self-assessment, and Level 2, an independent audit. It is often chosen as a more affordable and accessible alternative to ISO 27001.
Verified Self-Assessment
What is Level 1 Cyber Assurance?
​​
Level 1 is the entry point to the standard. You complete a set of questions about your policies, processes and procedures, which is then reviewed and verified by an independent, IASME-certified assessor.
The Level 1 assessment has been updated to be shorter, clearer and more accessible, with questions tailored to the size of your organisation.
Independently Audited
What is Level 2 Cyber Assurance?
​
Level 2 is an in-depth, independent audit of your systems, processes and people. Rather than a self-assessment, it involves a live audit, on-site or remote, where an assessor interviews key staff, reviews your documented evidence and checks that your controls are working in practice as described.
Level 2 demonstrates a high level of cyber resilience and is widely viewed as a cost-effective, more accessible alternative to ISO 27001. You need to hold Level 1 before you can move to Level 2.
What Cyber Assurance covers
Unlike Cyber Essentials, which focuses on technical system security, Cyber Assurance takes a risk-based look across the whole organisation. It covers areas such as:
-
Governance and risk management
-
Security policies and legal requirements, including GDPR and data protection
-
Physical and environmental security
-
People, staff awareness and training
-
Backup, business continuity and incident response
-
Asset and supplier management
Why organisations choose Cyber Assurance
Broader than Cyber Essentials. Covers technical, user and management controls, not just system security.
A UK-developed alternative to ISO 27001. Created by IASME to give SMEs a right-sized, affordable route to demonstrable information security.
Two clear levels. Start with Level 1 (verified self-assessment) and move to Level 2 (audited) when a contract or framework calls for it.
Focused on resilience and governance. Brings in risk management, policies, staff awareness, backups and incident handling.
Recognised where it matters. Aligned with the Government's 10 Steps to Cyber Security and accepted by many procurement frameworks that would previously have specified ISO 27001.
Practical and manageable for SMEs. Designed specifically for smaller organisations, Cyber Assurance avoids the overhead and complexity of heavyweight frameworks.
The Process
Level 1: Self-Assessment
-
Purchase ICA Level 1 through a certification body such as Regola.
-
Complete the online questionnaire, covering governance, risk assessment, policies, legal requirements including GDPR, backups and incident response.
-
Your answers are reviewed and verified. If successful, Level 1 certification is awarded.
Level 2 — Audited Certification
-
Hold a valid Level 1 certification, as Level 2 builds directly on it.
-
Book an audit with a certification body. The same question set is used, but this time it is independently verified.
-
The auditor reviews evidence, interviews staff and confirms your controls are implemented in practice.
-
Certification is granted once the audit confirms compliance.
​Cyber Assurance or ISO 27001?
(Equivalent to Level 3)
Both are respected information security standards, and Cyber Assurance is often the more proportionate choice for a small or medium business.
Cyber Assurance is UK-developed, risk-based and flexible, and it is certified through IASME. ISO 27001 is the international standard, awarded by an international certification body, and tends to suit larger organisations or those with a specific contractual requirement for it.
If you go all the way to Cyber Assurance Level 2, ISO 27001 is only a small hill to climb from there. Regola has the expertise and partners to help you take that next step when the time is right.
Why choose Regola for Cyber Assurance
We are South Devon's first Cyber Essentials Certification Body, and we now support organisations right across the UK. We have assessed nearly 150 organisations for Cyber Essentials, and as an IASME certification body we can guide you through Cyber Assurance at both levels.
We are a small, experienced and hands-on team. Whether you are just starting out or already know exactly which level you need, we will be with you at every step, and we can help with any corrections needed to pass.
Where We Work
We're based in Torquay and operate across the UK, with many clients both in and outside Devon, including:
North Devon
Exeter
Taunton
Barnstaple
Cullompton
Mid Devon
Plymouth
Honiton
Torquay
Crediton
South Devon
Newton Abbot