IASME Cyber Assurance: security governance for smaller organisations

Cyber Essentials has become the standard way for UK organisations to show they've got the technical basics right. But it only covers technology: firewalls, updates, access control, malware protection and secure configuration. It doesn't ask how you assess risk, train your staff, respond to an incident or look after personal data.

That's the gap IASME Cyber Assurance fills. If a customer has asked for more than Cyber Essentials, or you've been told you need ISO 27001 and baulked at the cost, it's worth understanding.

What it is

IASME Cyber Assurance is a cyber security and data protection standard run by IASME, the same organisation that runs Cyber Essentials on behalf of the National Cyber Security Centre. Where Cyber Essentials looks at your technology, IASME Cyber Assurance looks at how you run security across the organisation, including:

• risk assessment and management
• policies and how they're kept up to date
• staff awareness and training
• managing your suppliers
• incident response and business continuity
• backup and recovery
• data protection and personal information

It's recognised across a wide range of sectors as evidence that an organisation has appropriate controls in place, and it's increasingly used in supply chain due diligence.

Built to fit your size

One of the scheme's strengths is that it scales. IASME tailors the questions to the size of the organisation, with separate depths for sole traders and two-person partnerships, micro businesses, small businesses and medium or large organisations. A ten-person consultancy isn't asked to prove the same things as a business with several hundred staff.

Level 1 and Level 2

The scheme has two levels, and you have to pass Level 1 before you can go for Level 2.

Level 1: Verified Assessment. You answer the question set on IASME's assessment platform. A board member or equivalent signs to confirm the answers are accurate, and a qualified, independent assessor reviews and marks them. If something falls short, the assessor explains what needs to change.

Level 2: Audited. An independent assessor checks that what you described at Level 1 actually happens. That means looking at your documentation, interviewing key staff and observing how things are done, either on site or remotely.

Level 1 shows you've put the right policies and controls in place. Level 2 shows they work in practice, which is what more demanding customers and regulated sectors tend to want.

What you need first

You need a valid Cyber Essentials certificate before you can apply, with at least a month left before it expires. Both certificates must cover your whole organisation, so a Cyber Essentials scope limited to one office or network won't do.

In practice, most organisations treat the two as a pair: Cyber Essentials for the technical controls, IASME Cyber Assurance for everything around them.

How it compares with ISO 27001

IASME Cyber Assurance draws on many of the same principles as ISO 27001, the international standard for information security management. It isn't a direct equivalent, and it won't satisfy a contract that specifically requires ISO 27001.

What it does offer is a proportionate route to much of the same assurance, at a fraction of the cost and effort, for organisations where ISO 27001 would be more than they need. And because it builds the policies, records and habits that ISO 27001 also expects, it's a sensible stepping stone if you might need ISO 27001 later.

Is it right for you?

It's likely to be a good fit if:

• a customer or tender has asked for assurance beyond Cyber Essentials
• you handle personal or sensitive data on behalf of clients
• you want a recognised framework for running security properly, not just a technical checklist
• ISO 27001 feels disproportionate for the size of your organisation

If you already hold Cyber Essentials, much of the groundwork is done. The extra effort is mostly in writing down what you do, filling the gaps and making sure the right people know their responsibilities.

Getting started

1. Check your Cyber Essentials is current and covers the whole organisation.
2. Download the question set. IASME publishes the questions free of charge, and reading them is the quickest way to see where you stand.
3. Gather what you already have: policies, asset registers, training records, supplier contracts and incident procedures.
4. Fill the gaps before you submit, rather than finding them during assessment.

How CSIQ can help

CSIQ is a licensed IASME Cyber Assurance certification body, and we hold IASME Cyber Assurance Level 2 ourselves, so we know the process from both sides. We can assess you at Level 1 or Level 2.

Visit our Compliance & Governance page, or get in touch to talk through whether it's the right fit.