What is cyber assurance, and does a small business need it?

Cyber assurance is being able to show someone else, with evidence, that your security is in place and working. For a UK small business that nearly always starts with Cyber Essentials. Cyber Essentials Plus, IASME Cyber Assurance and ISO 27001 come later, if and when a customer, an insurer or a contract asks for them.

The question usually arrives as a supplier questionnaire. A customer’s procurement team sends forty questions about your security, or asks for “evidence of cyber assurance”, and nobody in the business is quite sure what they’re being asked to produce.

Who’s asking, and why

There are three usual sources.

Customers. Larger companies are now expected to check their suppliers, because a supplier’s breach can become their breach. The easiest thing for them to ask for is a certificate, and in the UK the default is Cyber Essentials. Paul wrote about how that request turns up and how to handle it earlier this year.

Insurers. Cyber insurance renewal forms now ask about MFA, backups and patching in detail. A certificate makes those forms easier to answer, and some insurers price it in.

Regulators and clients in regulated sectors. The SRA, FCA and ICO all expect firms to protect client data. None of them requires a particular certificate, but if something goes wrong, they will ask what you had in place, and a certificate is a quick way to show them.

The options, smallest first

	What it checks	Who checks it	Cost (10–49 staff)	Renew
Cyber Essentials	Five technical controls	An assessor reviews your answers	£440 + VAT	Every year
Cyber Essentials Plus	The same five controls, tested on your actual devices	An assessor tests a sample of your kit	Quoted, typically £1,500–£3,000 + VAT	Every year
IASME Cyber Assurance Level 1	Cyber Essentials plus governance: risk, data protection, incidents, continuity, training	An assessor reviews your answers	£440 + VAT, on top of Cyber Essentials	Every year
IASME Cyber Assurance Level 2	The same as Level 1, audited	An assessor audits on site or remotely	Quoted individually	Audit every three years, Level 1 every year
ISO 27001	A full information security management system	An accredited certification body	Usually five figures in year one, once you count the work	Surveillance audits yearly, recertify every three years

The Cyber Essentials and IASME fees are fixed nationally, so they’re the same whichever certification body you use. Micro businesses with fewer than ten staff pay £320 + VAT for each.

Cyber Essentials

The UK government-backed baseline, run by IASME for the NCSC. It covers firewalls, secure configuration, user access control, malware protection and security updates. You answer a question set online, an assessor reviews it, and you pass or fail. If you certify the whole organisation and turn over less than £20m, £25,000 of cyber insurance is included.

This is what most customers mean when they ask for cyber assurance, and it’s what central government contracts handling personal data have required since 2014.

Cyber Essentials Plus

The same five controls, but an assessor tests them on a sample of your laptops, phones and accounts rather than taking your word for it. You need to pass standard Cyber Essentials first, and the Plus audit has to follow within three months. Customers ask for it when they want proof rather than a declaration, which is common in defence, the public sector and financial services supply chains.

IASME Cyber Assurance

This is where “cyber assurance” is also the name of a certificate. It builds on Cyber Essentials and adds the parts of security that aren’t technical settings: whether you’ve assessed your risks, how you handle personal data, what you’d do in an incident, how you’d keep running, and whether your staff are trained.

Level 1 is a verified self-assessment, like Cyber Essentials. You need a valid Cyber Essentials certificate with at least a month left on it before you can apply. Level 2 adds an independent audit, and you need to have passed Level 1 first.

It’s often described as a lighter-weight route to the ground ISO 27001 covers, sized for small businesses. It suits a business whose customers have started asking governance questions (do you have an incident response plan, a data protection policy, a risk register) that Cyber Essentials doesn’t answer.

ISO 27001

The international standard for an information security management system. It’s well recognised outside the UK, and it takes ongoing work: written policies, risk treatment, internal audits, management reviews, and an external audit every year. For a small business it’s usually only worth doing when a large or overseas customer requires it by name.

Which one do you need?

• A customer asked for “Cyber Essentials” or “cyber assurance” and nothing more specific: Cyber Essentials.
• A government or defence contract, or a customer who wants it independently tested: Cyber Essentials Plus.
• A customer’s questionnaire goes beyond technical controls into risk, data protection and incident response: IASME Cyber Assurance Level 1, with Level 2 if they want it audited.
• A large enterprise or overseas customer names ISO 27001: ISO 27001. Cyber Essentials won’t substitute for it.
• You’re not sure which of these applies: book a 30-minute call and we’ll tell you.

If nobody has asked yet, start with Cyber Essentials anyway. The included insurance covers much of the cost, and doing the work first means you can answer the questionnaire when it arrives instead of scrambling.

The April 2026 change most people haven’t noticed

Assessments started from 27 April 2026 use version 3.3 of the requirements and a new question set called Danzell. The headline change: if any cloud service you use offers multi-factor authentication and it isn’t switched on, you automatically fail. Free services, ones bundled with something else and paid add-ons all count. Cloud services can’t be left out of scope either, and IASME’s question set treats company social media accounts as cloud services too.

For most small businesses the biggest cloud service is Microsoft 365, so this is where assessments now stand or fall. Every account needs MFA, including admins, shared mailboxes people sign in to, and that one account the accountant uses. Old sign-in methods that skip MFA need to be blocked as well, or the assessor can reasonably say MFA isn’t enforced.

Our Microsoft 365 security checklist covers how to do that, along with most of the other Cyber Essentials controls as they apply to Microsoft 365. If you’d rather not do it yourself, our Microsoft 365 security uplift does it at a fixed price.

What it really costs

The certificate fees are small. The cost that varies is the work before the assessment: switching on MFA everywhere, getting laptops managed and patched, removing old accounts, and writing down what you do. For a business already in reasonable shape that’s a few days. For one that isn’t, it can be a few weeks.

Keep a written record as you go. Whichever certificate you go for, the assessor, the next customer questionnaire and your insurer will all ask the same questions, and having the answers in one place saves you doing it three times.

The official sources are worth bookmarking: IASME’s pages on Cyber Essentials and IASME Cyber Assurance, and the NCSC’s Cyber Essentials requirements.