IASME Cyber Assurance vs ISO 27001

What each one is

• IASME Cyber Assurance is a UK-developed standard covering 13 themes, mapped to ISO 27001 and the Government's 10 Steps to Cyber Security. Level 1 is a verified self-assessment; Level 2 adds an independent audit and a GDPR assessment, and is internationally recognised. It's designed to give SMEs credible assurance without ISO's overhead.
• ISO 27001 is the international standard for an information-security management system — comprehensive, UKAS-accredited certification, with a full ISMS, risk treatment and ongoing surveillance audits. It's the gold standard, and priced and resourced accordingly.

The practical difference

Cyber Assurance gets you evidence of a managed security system in weeks, at a fraction of ISO's cost, with paperwork proportionate to an SME. ISO 27001 is a bigger, longer programme — typically many months and a standing commitment to maintain the ISMS. For most small and mid-sized suppliers, Cyber Assurance answers what buyers are actually asking for.

When Cyber Assurance is enough

If a buyer wants to see ‘more than Cyber Essentials’ — real governance, data protection, an ISMS in spirit — Cyber Assurance Level 2 usually satisfies it, because it's independently audited and internationally recognised. Many tenders that say ‘ISO 27001 or equivalent’ accept it.

When you genuinely need ISO 27001

If a contract strictly mandates ISO 27001 by name, or a global enterprise customer's procurement won't accept an equivalent, you'll need ISO itself. The good news: Cyber Assurance is a clean stepping stone — the work you do for it carries directly toward ISO if you pursue it later. And remember Cyber Assurance requires a valid Cyber Essentials certificate underneath.

Common questions