Your IASME Cyber Assurance certification cost depends on the assessment level, your organisation’s size and the preparation your business needs. For your 2026 budget, separate the certification fee from the work needed to meet the requirements. Ask for a written, itemised quote that also explains prerequisite certification, reassessment and renewal charges.
How much does IASME Cyber Assurance certification cost?
Budget for the assessment and the work behind it, not just the certificate. A certification quote and a complete implementation budget answer different questions.
Start by checking the level your customer or tender requires. Then use the IASME Cyber Assurance preparation guide to identify the work you need to complete before assessment.
Use the following breakdown when requesting a 2026 quote. Ask the provider to mark each item as included, separately chargeable or not applicable.
| Budget item | What you need to establish | What to keep separate |
|---|---|---|
| Certification assessment | The level, organisation size and scope covered | Preparation and consultancy |
| Cyber Essentials | How you will satisfy the scheme’s prerequisite | Any separate certification work |
| Preparation | Policy updates, risk reviews and evidence gathering | The assessor’s assessment work |
| Remediation | Changes needed to meet the requirements | Routine IT work already budgeted |
| Reassessment | What happens if your submission needs further work | Initial assessment charges |
| Ongoing maintenance | Ownership, reviews and future certification activity | Your initial project budget |
Do not add every line automatically. Existing contracts, current certificates and completed work affect what you actually need to buy.
Why this matters
A low assessment quote does not establish a low total project cost. Your team still needs to implement the requirements and explain how your business meets them.
You also need to compare equivalent outcomes. A verified self-assessment and an independently audited assessment are different purchases, even when both carry the IASME Cyber Assurance name.
Get the required level confirmed before you approve spending. If a buyer specifies an audited assessment, a different level does not satisfy that request simply because it covers related subjects.
Level 1: verified self-assessment
IASME Cyber Assurance Level 1 uses a verified self-assessment. Your organisation answers the assessment questions, and an assessor reviews the submission.
Best for: organisations whose customer requirements accept verified self-assessment. Confirm that acceptance in writing before choosing this route.
The advantage is the assessment format: you explain how your organisation meets the requirements through the submission. The limitation is that verified self-assessment is not the same as an independent audit of implementation.
Before accepting a Level 1 quote, ask:
- Which organisation and activities does the quote cover?
- Which organisation-size category applies?
- What support is included before submission?
- How are assessor questions and corrections handled?
- Which prerequisite certification must be in place?
- What are the terms for completing the assessment?
Do not treat self-assessment as permission to submit unsupported answers. Your answers should describe current practice, not policies you intend to introduce later.
Level 2: independent audit
IASME Cyber Assurance Level 2 adds an independent audit. It examines how your organisation puts the requirements into practice, rather than relying only on the verified self-assessment.
Best for: organisations whose buyers require audited assurance. Establish the requirement before commissioning audit preparation.
The advantage is the additional examination of implementation. The trade-off is the additional audit preparation, staff participation and evidence you need to organise.
Ask the certification body to explain the route from Level 1 to Level 2. Get the assessment stages, audit arrangements and treatment of any existing certification recorded in the proposal.
| Assessment option | Best for | Main advantage | Main limitation |
|---|---|---|---|
| Level 1 | Buyers accepting verified self-assessment | Assessor-reviewed submission | Does not provide the Level 2 independent audit |
| Level 2 | Buyers requiring audited assurance | Independent examination of implementation | Requires additional audit preparation and participation |
There are 2 assessment levels to distinguish in your purchasing decision. Do not compare proposals until they identify the same level and organisational scope.
Why IASME Cyber Assurance costs vary
The assessment fee is only part of the decision. Use these factors to identify what belongs in your budget and what needs clarification.
- Assessment level. Verified self-assessment and independent audit involve different assessment activities. Require the proposal to name the level.
- Organisation size. Confirm the size category used in the quote. Ask how the provider treats your organisational structure.
- Existing readiness. Identify missing policies, incomplete records and security changes before deciding how much preparation support to buy.
- Cyber Essentials status. IASME Cyber Assurance requires Cyber Essentials. Confirm how your existing certificate fits the application and what separate work is needed.
- Support included. Separate assessment from advice, document preparation and implementation support. Do not assume a certification fee includes consultancy.
- Reassessment and maintenance. Ask how further assessment work and future certification activity are handled. Record the terms before you commit.
For 2026 planning, give each factor an owner. Your finance lead needs the commercial terms; your technical and operational owners need to confirm the work behind them.
Build your budget in 3 separate lines
Use 3 budget lines: certification, preparation and maintenance. This keeps external fees separate from the effort needed inside your business.
Certification
Record the assessment route and everything the certification provider includes. Keep prerequisite certification and any separately quoted audit work visible.
Ask whether the proposal includes VAT or excludes it. Also check its validity period, payment terms and the circumstances that trigger additional charges.
Preparation
Record the work needed before you submit. Include internal staff time alongside any external support you choose to commission.
Assign responsibility for policy approval, risk decisions, technical changes and evidence collection. A task without an owner is not a finished budget assumption.
Maintenance
Build a 12-month planning budget for keeping policies, records and controls current. This is a budgeting recommendation, not a statement about certificate validity.
Include future reviews and certification activity according to the scheme’s current requirements. Keep recurring software or advisory commitments distinct from the initial project.
Separate assessment charges from preparation work and ongoing maintenance.
Your budget is ready for approval when each line has a defined scope, an owner and a documented basis. Avoid filling gaps with an assumed percentage or an unsupported contingency figure.
Compare quotes against the same brief
Send each provider the same description of your organisation and the same required outcome. Otherwise, different assumptions make the totals difficult to compare.
Use this sequence before you choose a provider:
- Confirm the buyer requirement. Record the certification name, required level and any contractual deadline.
- Describe the organisation. Explain which legal entity, activities, locations and systems you want assessed.
- State your starting point. Identify your existing Cyber Essentials certification and the policies or records already in use.
- Request an itemised proposal. Separate assessment, preparation, audit activity and optional support.
- Check the terms. Clarify corrections, reassessment, cancellation and future certification arrangements.
- Assign internal work. Confirm who will supply evidence, approve documents and complete technical changes.
For your 2026 comparison, record the proposal date beside every quote. That prevents an older proposal from becoming the basis of a new purchasing decision without confirmation.
Choose the proposal that meets your stated requirement with clear responsibilities. Do not choose solely on the headline assessment charge.
How do you reduce preparation work without cutting corners?
Start with evidence your business already uses. Review your policies, asset records, risk decisions and incident procedures before commissioning replacement documents.
Check whether each document matches actual practice. A policy that describes controls you do not operate creates more work, not useful evidence.
Use a short preparation list:
- Name the person responsible for each requirement.
- Record the evidence that supports each answer.
- Mark gaps as actions rather than describing them as completed controls.
- Approve policies through your normal management process.
- Check that records describe the organisation being assessed.
- Resolve conflicting answers before submission.
Avoid buying technical testing or advisory work simply because it appears in a general security package. Ask the provider to explain which requirement or identified risk each proposed activity addresses.
Reusing current records is sensible. Reusing inaccurate answers is not.
Where does compliance automation fit?
OneClickComply is best for growing businesses that want to automate security controls, policy generation and risk management. Its stated platform scope includes ISO 27001, Cyber Essentials and SOC 2.
For IASME Cyber Assurance, check framework coverage before you select any compliance automation platform. Ask which assessment requirements it supports and which tasks remain with your team or certification body.
OneClickComply’s stated functions address broader compliance work. Do not treat platform access as proof that an IASME assessment, audit or certification fee is included.
The benefit of automation is in the work it handles. The limitation is that your business still needs accountable owners who approve policies, make risk decisions and ensure assessment answers are accurate.
Keep the software decision separate from the certification decision. Buy support for a defined workload, not an assumed route to a certificate.
Is Cyber Essentials included in IASME Cyber Assurance?
Cyber Essentials is a prerequisite for IASME Cyber Assurance, but you should not assume a proposal includes obtaining or renewing it. Ask the provider to identify the relevant certificate and any separate work.
If you already hold Cyber Essentials, confirm that its scope and status fit your application. Do that before approving duplicate preparation work.
Can you prepare for IASME Cyber Assurance without a consultant?
You can manage preparation internally if your team can interpret the requirements, implement the controls and produce accurate answers. External consultancy is a separate support decision, not a substitute for operating the controls.
Assign a named internal owner even when you buy advice. Your organisation still needs to approve the documents and decisions submitted on its behalf.
Does a software subscription include IASME certification?
A software subscription does not establish that certification is included. Check the contract for the named framework, assessment level, certification body and included assessment activity.
For your 2026 purchasing decision, require those details in writing. A platform demonstration does not replace the commercial scope.
Frequently asked questions
One last thing
Ask the buyer to confirm the required level before you ask providers to quote. A precisely scoped request is more useful than a budget built around the wrong assessment.
Then separate the certificate from the work needed to earn it. Seriously Simple Cyber Compliance starts with a clear requirement and a clear plan.