IASME Cyber Assurance Level 1 vs Level 2: self-assessed or audited?

IASME Cyber Assurance comes in two levels, and the choice between them is the first decision most organisations have to make. Level 1 is a verified self-assessment. Level 2 adds an independent audit. Both cover the same standard; the difference is how much external verification sits behind the certificate. This guide explains what each level involves, who tends to need which, and how to decide.

If you have seen the standard referred to as IASME Governance, that was its previous name. “IASME Governance self-assessed” is what is now called Level 1, and “IASME Governance audited” is Level 2.

What IASME Cyber Assurance covers

IASME Cyber Assurance is a broad information security and governance standard designed for small and medium-sized organisations. It is often described as an affordable alternative to ISO 27001, and it builds on the technical controls of Cyber Essentials, which is a prerequisite. Beyond those controls, it covers:

• Governance, responsibilities and policies
• Risk assessment and management
• Asset management and secure configuration
• People, training and access
• Physical security
• Backup, business continuity and incident response
• Supplier and outsourcing arrangements
• Data protection and UK GDPR

The standard is the same at both levels. What changes is the level of assurance.

Level 1: verified self-assessment

At Level 1 you complete the full Cyber Assurance question set yourself, describing how your organisation meets each requirement. Your answers are then reviewed by an assessor at an IASME certification body, who checks that they are complete, credible and consistent. If they are, you are certified at Level 1.

What Level 1 gives you:

• A credible, externally reviewed statement of your security and governance arrangements, across the whole standard, not just the technical controls.
• A lower cost and shorter timeline than an audited standard, because there is no audit day to schedule and prepare for.
• A structured foundation. Working through the question set forces you to write the policies and put the processes in place that many small organisations have never formalised.

What it does not give you is independent verification that what you wrote is true. An assessor reviews your answers; they do not test them.

Level 2: independently audited

At Level 2 you complete the same self-assessment, and an assessor then audits it, remotely or on site. They look at your policies and records, ask staff how things work in practice, and check that the controls you described are actually in place. Level 2 also includes a dedicated GDPR assessment, in which the assessor examines your data protection arrangements: what personal data you hold, your lawful bases, how you handle individuals’ rights and how you would respond to a breach.

What Level 2 gives you:

• Independent assurance you can offer to customers, commissioners and partners who want more than a self-declaration.
• A combined security and data protection review, which is useful for anyone handling sensitive personal data.
• A stronger answer to supply-chain questionnaires, and a closer equivalent to what ISO 27001 buyers are looking for.

The cost is higher, because you pay for the assessor’s time, and the preparation is more demanding, because your evidence has to stand up to someone checking it.

Side by side

	Level 1	Level 2
Method	Self-assessment, reviewed by an assessor	Self-assessment plus an independent audit
Evidence tested?	No, answers are reviewed for credibility	Yes, policies, records and practice are checked
GDPR assessment	Data protection questions within the standard	Dedicated GDPR assessment by the assessor
Cyber Essentials required	Yes	Yes
Typical effort	Weeks, mostly writing and organising	Weeks of preparation plus the audit itself
Cost	Lower	Higher, reflecting assessor time
Certificate validity	12 months	12 months
Best for	A credible, broad self-declared standard	Externally verified assurance for contracts and sensitive data

How to choose

Ask who is asking for the certificate, and why.

Choose Level 1 when you want to demonstrate a broad, credible standard to clients and partners, nobody is demanding independent verification, and you are building your governance from a modest starting point. Level 1 is also a sensible first step if you plan to go to Level 2 later, because almost all of the work carries forward.

Choose Level 2 when a customer, commissioner, framework or contract specifically wants independent assurance; when you handle significant volumes of sensitive personal data and want your data protection posture examined by someone outside the organisation; or when you are being asked for ISO 27001 and want to offer a proportionate, audited alternative.

If in doubt, read your contracts. Some ask only for “IASME Cyber Assurance”, in which case Level 1 satisfies the letter of the requirement. Others specify “audited” or “Level 2”, or ask for evidence that an independent party has verified your controls. Where the wording is unclear, ask the buyer before you commit to either level.

Moving from Level 1 to Level 2

Many organisations certify at Level 1 first and step up to Level 2 when a contract requires it. Because the standard is identical, the self-assessment, policies and records you built for Level 1 are reused. The additional work is mostly about evidence: making sure that what you wrote can be shown to an assessor, and preparing for the GDPR assessment with a current record of processing activities, documented lawful bases and a working breach process.

Common mistakes at either level

• Starting Cyber Assurance without Cyber Essentials in place. It is a prerequisite, and the technical controls need to be settled first.
• Answering the self-assessment aspirationally, describing controls you intend to have rather than controls you have. At Level 2 the assessor will find the gap; at Level 1 you will have a certificate that does not reflect reality.
• Underestimating the data protection section, especially the Level 2 GDPR assessment.
• Scoping loosely, so it is unclear which sites, systems and people are covered.

How we can help

We help you decide which level your contracts actually need, rather than defaulting to the more expensive option. We then work through the full self-assessment with you, put the missing policies and processes in place, and, for Level 2, prepare you and your evidence for the audit and the GDPR assessment. Explore our IASME Cyber Assurance service, read how it compares with ISO 27001, or get in touch for a free, no-obligation conversation about which level fits.