IASME Cyber Assurance Newcastle upon Tyne
IASME Cyber Assurance for Newcastle upon Tyne organisations: a practical, independently audited information security standard, and a realistic alternative to ISO 27001.
IASME Cyber Assurance for Newcastle upon Tyne organisations: a practical, independently audited information security standard, and a realistic alternative to ISO 27001.
Cyber Essentials covers five technical controls. Cyber Assurance covers the rest of an information security management system: governance, risk, people, physical security, business continuity, incident management and supplier assurance. It is the standard to reach for when a customer wants more than Cyber Essentials and ISO 27001 is disproportionate to the size of the contract.
Level 1 and Level 2
Level 1 is a verified self-assessment. You answer the question set, an assessor reviews the evidence, and the certificate is issued on that basis. It is the quicker and cheaper route, and for many organisations it is sufficient for what has been asked.
Level 2 is the same standard with an on-site or remote audit by an assessor, who samples evidence rather than accepting the answers. Level 2 carries considerably more weight with a procurement team and is the version to choose when the certificate has to survive scrutiny rather than tick a box.
When it beats ISO 27001, and when it does not
Cyber Assurance is aligned to ISO 27001 but reaches certification in a fraction of the time and at a fraction of the cost, which is why it suits organisations of thirty people far better than a standard designed for multinationals.
It is the better choice when a customer has asked for evidence of an information security management system without specifying ISO 27001 by name, when you are competing for contracts where the ISO requirement is a proxy for maturity, or when ISO is the eventual destination and you need something credible in the meantime.
It is not the better choice when a contract specifically names ISO 27001 and the customer will accept no equivalent. That happens, particularly with international customers and in some regulated sectors, and we will say so rather than sell you a certificate that will not answer the question. Where there is room to propose an alternative, Cyber Assurance is increasingly accepted, and we can help you make that case.
Who asks for it across the North East
Three groups, mostly. Suppliers to the region’s large health, local authority and higher education organisations, where supplier assurance has tightened. Software companies selling into enterprise customers whose security questionnaires assume a management system exists. And organisations whose insurers or clients have started asking about governance rather than only about technical controls.
There is a fourth group worth mentioning: organisations that do not need it at all but have been told they do by somebody working from a template. Send us the requirement before you commit to anything. A meaningful proportion of the briefs we see are satisfied by Cyber Essentials.
What the assessment looks at
Rather more than technology. Whether risk is assessed and by whom. Whether somebody owns security at a level with authority to act. What happens when a member of staff joins or leaves. How incidents are recognised, recorded and learned from. Whether backups have ever been restored rather than merely configured. What is asked of suppliers who hold your data.
For most organisations the gap is documentation rather than practice. Sensible things are being done, consistently, by people who have never written them down. The assessment is frequently less painful than expected once that becomes clear, and the written record turns out to be useful well beyond the certificate.
Cyber Assurance for Newcastle organisations
Solusec holds the IASME Cyber Assurance Certification Body licence and holds its own Level 2 certification, which means the standard has been applied to us as well as by us. Assessment and certification are done by us rather than passed on.
Delivery is remote, which makes the two hundred miles between Albrighton and Tyneside irrelevant to the work. For a Level 2 audit we can attend where it genuinely helps, with travel quoted as a separate line, although in practice the audit runs perfectly well over screen shares and most clients prefer it that way.
We do not hold ISO 27001 ourselves. We position our own audited IASME Cyber Assurance as a proportionate standard for a specialist practice of our size, which is exactly the argument we would help you make.
Talk to us
We are based in Albrighton and work with organisations across Tyneside and the North East, remotely as standard and on site where it genuinely helps. Tell us what you are dealing with and we will tell you honestly what you need, including if that is less than you expected.
Common questions
Is IASME Cyber Assurance really accepted instead of ISO 27001?
Increasingly, but not universally. It is aligned to ISO 27001 and independently audited at Level 2, and a growing number of procurement exercises accept it. Where a contract names ISO 27001 specifically and the customer will accept no equivalent, it will not substitute, and we will tell you that rather than sell you a certificate that does not answer the question.
Should we take Level 1 or Level 2?
Level 1 is a verified self-assessment and is quicker and cheaper. Level 2 adds an independent audit and carries considerably more weight with a procurement team. If the certificate exists to satisfy a demanding customer, Level 2. If it exists to demonstrate progress, Level 1 is usually enough.
Do we need Cyber Essentials first?
Cyber Essentials is included within the Cyber Assurance standard, so the technical controls are covered either way. Many organisations certify to Cyber Essentials first because it is quick and immediately useful, then step up. If you are going to need both, say so at scoping so the sequence is planned rather than accidental.
How long does it take?
Weeks rather than the many months an ISO 27001 implementation typically takes, and the elapsed time depends almost entirely on how much of what you already do is written down. Organisations with sensible practices and no documentation move faster than they expect.
Does the audit have to happen on site?
No. Level 2 audits run remotely as standard and work well that way. We can attend in Newcastle where it genuinely helps, with travel quoted as a separate line rather than built into the fee.
We are thirty people. Is this proportionate?
That is close to the size the standard was designed for. ISO 27001 was built for large organisations and shows it. Cyber Assurance asks the same questions at a scale that a thirty-person organisation can actually answer and maintain.
Related
Free, no obligation
Understand your exposure
An attacker’s first move is not an attack, it is a look. So we look first, and send you what we find, worst first.
- Services and ports you did not know were open
- Security misconfigurations on anything public facing
- Known vulnerabilities already indexed by engines like Shodan
- Company credentials sitting in known breach data
The only question is: do you know where and how to look?
We reply within one business day. Prefer to talk first? 01902 288763 or info@solusec.co.uk.
Nothing is touched on your systems. It is all public and already indexed, just scattered. We pull it together, which is what an attacker does first.
IASME Cyber Assurance in Newcastle upon Tyne.
The ISO 27001 alternative, audited and issued by an appointed Certification Body, at a scale an organisation your size can maintain.