Cyber Assurance vs ISO 27001: The Affordable UK Alternative

What each one is

• Cyber Assurance (IASME): UK risk-based information assurance standard, 14 themes, two levels (verified or audited).
• ISO 27001: international Information Security Management System (ISMS) standard with 93 controls in Annex A and a 3-year audit cycle (initial + 2 surveillance audits).

Scope comparison

• Cyber Assurance: 14 themes covering people, policy, access, intrusion, change, monitoring, backup and resilience, scaled to organisation size.
• ISO 27001: a full ISMS with explicit context-of-organisation, leadership, planning, support, operation, performance evaluation and improvement clauses, plus Annex A controls.

Cost comparison

• Cyber Assurance Level 2: typically £1,800–£8,000 + VAT for the audit itself (varies with complexity), valid 3 years with light annual soft check. Plus the Level 1 + CE prerequisite annually.
• ISO 27001: typically £8,000–£25,000+ for initial certification with two annual surveillance audits over the 3-year cycle, then re-certification.

Audit rigour

• Cyber Assurance L2: documentation review + staff interviews + observation, by an IASME-licensed assessor.
• ISO 27001: stage 1 (documentation) + stage 2 (operational audit) by a UKAS-accredited certification body, plus annual surveillance.

Buyer recognition

• Cyber Assurance: well recognised across UK supply chains, NHS, central government and increasingly private sector.
• ISO 27001: globally recognised, often required by large multinational and US-based buyers.

When to choose Cyber Assurance

• You're a UK SME and your buyers accept Cyber Assurance.
• Your budget rules out ISO 27001 right now.
• You want a credible governance standard as a stepping stone to ISO 27001.
• You operate primarily in UK markets.

When ISO 27001 wins

• You sell internationally to large enterprises.
• A buyer specifically requires ISO 27001 (no equivalents).
• You're already mature and the ROI of ISO is justified.

See also: Cyber Essentials vs ISO 27001.