The standard was developed through a government funded project to give smaller organisations an affordable and achievable route to certification, rather than the cost and documentation load of ISO 27001. It was previously called IASME Governance. The scheme was rewritten and relaunched under the Cyber Assurance name, and the standard has been updated since, so the Governance certification is no longer issued.
Certification allows companies in a supply chain to show the level of security they work to for a realistic cost, and to show that customer information is being looked after properly.
The requirements sit in fourteen themes, grouped around identifying and classifying what you hold, protecting it, spotting problems, and responding and recovering when something goes wrong. Data protection is part of the standard, including UK GDPR and the Data Protection Act.
The themes that apply to you depend on the size of your organisation. A sole trader answers a shorter set of requirements than a company of two hundred staff, so the work involved stays proportionate.
Cyber Essentials comes first
Your organisation needs a valid Cyber Essentials certificate with at least one month left to run before you can certify to IASME Cyber Assurance. The two certifications are now bought and completed separately, which is a change from the old IASME Governance scheme where the Cyber Essentials assessment was included. The scope of both must cover the whole organisation.
If you do not hold Cyber Essentials yet, we can take you through that assessment first and then move on to Cyber Assurance.
