IASME Cyber Assurance certification proves your business runs proper cyber governance beyond the technical baseline of Cyber Essentials — this guide walks through the exact steps to get audit-ready in 2026.
Why this matters
IASME Cyber Assurance is the certification behind the scenes of the Cyber Essentials scheme — IASME itself is the body that licenses assessors and runs the framework used for public sector and NHS supplier accreditation. Buyers increasingly ask for it alongside Cyber Essentials Plus because it covers governance and risk topics that Cyber Essentials Plus doesn't touch: senior management involvement, third-party risk, and incident response maturity.
Miss the deadline on a tender and you lose the contract, not just the certificate. In 2026, more UK public sector frameworks are naming IASME Cyber Assurance directly in supplier requirements, which means preparation time matters as much as the certification itself.
What you'll need
- A named owner for the certification — usually a founder, ops lead, or IT manager
- An up-to-date asset register (devices, cloud services, SaaS tools in use)
- Your existing Cyber Essentials or Cyber Essentials Plus certificate, if you have one
- Access to HR onboarding/offboarding records
- A risk register, even a basic spreadsheet, covering your top 10 risks
- Evidence of backups, patching cadence, and access control policies
- 4-8 weeks of calendar time before your target submission date
If you haven't picked a framework yet, work through how to choose the right compliance framework for your business before committing resource to IASME Cyber Assurance specifically.
The steps
1. Confirm your certification level
IASME Cyber Assurance has two routes: Level 1 is self-assessed with no external verification, Level 2 requires a Certification Body assessor to review your answers and evidence. Most procurement requirements in 2026 specify Level 2 because it carries independent verification. Confirm which level your contracts or tenders actually require before you start — Level 1 work doesn't carry over to Level 2 review.
Common mistake: teams complete the questionnaire assuming Level 1 is sufficient, then discover the client wants Level 2 and have to redo evidence collection from scratch.
2. Map your IT environment and data flows
List every device, cloud service, and SaaS application your business uses, plus where customer and employee data lives. This becomes your asset register, which the questionnaire references repeatedly across its risk management and data security sections.
Don't skip shadow IT — unsanctioned tools your team adopted without approval are exactly what assessors probe for. A 2026 gap analysis that misses three SaaS tools your marketing team signed up for independently will surface at review, not before.
3. Complete the self-assessment questionnaire
The IASME Cyber Assurance questionnaire covers themes including senior management involvement, risk management, asset management, access control, data security, resilience, and third-party/supply chain risk. Answer every question with your actual practice, not your aspirational policy — assessors cross-check answers against evidence in step 4.
Work through it section by section rather than end to end in one sitting. Rushed answers create inconsistencies an assessor will flag, and a 2026 resubmission costs more time than a careful first pass.
4. Automate evidence collection for every control
This is where most SMEs lose weeks. Each questionnaire answer needs supporting evidence — a screenshot of your MFA settings, a copy of your patch management log, a signed data processing agreement with a key vendor. Chasing these manually across a dozen different systems is the single biggest source of delay.
OneClickComply automates evidence collection so screenshots, logs, and policy documents get pulled and mapped to the right control automatically, instead of your team hunting through email threads and shared drives. If you want the mechanics of this step in more depth, read how to automate evidence collection for audits.
Expected outcome: every questionnaire answer has a linked evidence file before you submit, not a promise to find it later.
5. Close gaps before you submit
Run a gap analysis against your completed questionnaire and flag every control where evidence is missing or weak. Fix the highest-risk gaps first — access control and backup evidence tend to carry the most weight with assessors in 2026 reviews.
Don't submit hoping an assessor won't notice a gap. Assessors are trained to spot inconsistency between your written answer and your evidence pack, and a failed first review adds a full assessment cycle to your timeline.
6. Submit for assessor review (Level 2 only)
Your chosen Certification Body assigns an assessor who reviews your questionnaire and evidence remotely. Expect follow-up questions on anything ambiguous — respond within the timeframe the assessor sets, usually 5-10 working days, or your review resets to the queue.
Automate your IASME evidence pack
Map controls to evidence automatically and cut submission time in 2026.
7. Plan for annual renewal
IASME Cyber Assurance certification runs on a 12-month cycle. Build evidence collection into your regular operations rather than treating it as an annual scramble — the businesses that struggle every year are the ones that let their asset register and risk log go stale between submissions.
Troubleshooting
Problem: assessor flags missing MFA evidence. Fix: capture a dated screenshot of MFA enforcement settings from your identity provider admin panel, not just a policy statement.
Problem: risk register hasn't been updated in over a year. Fix: review and re-score your top risks quarterly — a stale risk register is one of the fastest ways to fail the risk management theme.
Problem: third-party/vendor risk section is thin. Fix: build a lightweight vendor risk process covering your top 10 suppliers by data access. See how to build a vendor risk assessment process for the structure.
Problem: Cyber Essentials Plus expired mid-review. Fix: renew Cyber Essentials Plus first — it's a foundational control many procurement teams expect alongside IASME Cyber Assurance, and a lapsed certificate stalls your review.
Problem: HR onboarding/offboarding evidence is inconsistent. Fix: standardise a checklist for account creation and deactivation, then keep dated logs for the last 12 months.
Problem: questionnaire answers don't match actual practice. Fix: interview the person who actually runs each control before answering, not the person who wrote the policy two years ago.
Tools and resources
- Asset register spreadsheet or CMDB tool
- MFA and access control logs from your identity provider
- Backup and patch management logs
- A vendor risk process — see vendor risk management software for UK SMEs
- Evidence automation software — OneClickComply maps evidence to controls automatically across ISO 27001, Cyber Essentials, and IASME Cyber Assurance
What to do next
Once your IASME Cyber Assurance evidence pack is solid, most SMEs move on to Cyber Essentials Plus renewal or ISO 27001 as the next tier for larger contracts. If Cyber Essentials Plus is due, work through how to prepare for a Cyber Essentials Plus audit next — the evidence overlap between the two frameworks means you won't be starting from zero.
Frequently asked questions
One last thing
The questionnaire itself rarely trips up SMEs — the evidence pack does. Businesses that treat evidence collection as a continuous, automated process instead of a pre-audit scramble consistently submit faster and get fewer assessor follow-up questions. Seriously Simple Cyber Compliance means building that habit once, in 2026, rather than rebuilding it every renewal cycle.