Last updated: 9 November 2026
IASME Cyber Assurance is a government-backed, risk-based standard. Level 1 is a self-assessment, while Level 2 involves an independent third-party audit by an IASME-accredited assessor. It goes beyond Cyber Essentials by also covering data protection (GDPR), operational security and business continuity.
Level 1 and Level 2 compared
| Question | Level 1 | Level 2 |
|---|---|---|
| How it is assessed | Self-assessment | Independent third-party audit |
| Who checks | You | An IASME-accredited assessor |
| Level of assurance | Lower | Much higher verification and assurance |
What the Level 2 audit involves
Review
The assessor reviews your cybersecurity policies, procedures and controls.
Interviews
Key staff are interviewed to check best practices are actually followed.
Evaluation
Your ability to protect against cyber threats is evaluated.
Verification
The assessor verifies that your security measures have been implemented effectively.
How it goes beyond Cyber Essentials
IASME Cyber Assurance goes beyond Cyber Essentials, covering data protection (GDPR), operational security and business continuity. The assessment checks that risk management, security monitoring and incident response are aligned with current industry best practice. For help with the Cyber Essentials basics, read Why do businesses fail Cyber Essentials?
The thirteen themes
| Area | Themes |
|---|---|
| Management | Governance, risk management, asset management, people management |
| Data and access | Access management, data protection, backup and restore |
| Technical controls | Secure configuration, malware protection, security update management |
| Detect and respond | Monitoring, incident management, continuity planning |
What it means for clients
ABCOM has achieved IASME Cyber Assurance Level 2, so our own internal security has been independently audited. For clients that means stronger cyber protection aligned with industry standards, third-party assurance that our IT processes are tested, enhanced risk management and confidence in your supply chain, as many businesses now require supply chain security validation.
How ABCOM helps
ABCOM has also achieved accreditation for the IASME Quality Principles framework, which is tailored for smaller organisations and shows adherence to evolving data protection and privacy regulations. We share what we learn with clients as part of our managed IT services. For the full story, read Achieving IASME Cyber Assurance Level 2 and IASME Quality Principles.
Quick answers
What is the main difference between Level 1 and Level 2?
Level 1 is a self-assessment. Level 2 involves an independent third-party audit by an IASME-accredited assessor, which gives much higher verification and assurance.
Does Level 2 replace Cyber Essentials?
No. It goes beyond Cyber Essentials by covering data protection (GDPR), operational security and business continuity.
Want independent assurance for your own business? Talk to us about the right standard.
Related answers and guides
- Achieving IASME Cyber Assurance Level 2
- IASME Quality Principles
- Why do businesses fail Cyber Essentials?
- What is ISO 27001, and can a small business get certified with Vanta?
- ABCOM managed IT services
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about Cyber Essentials certification. Free, friendly and no obligation.