Who assesses you, and how each kind works

Who examines you depends on the level and the contract

Self-assessment. You assess, you score, you submit, an individual affirms it. Applies at the lowest level and to a subset at the second.

Third-party assessment. An accredited organisation conducts it. This is the route for most contracts at the second level and is the one most suppliers are preparing for.

Government-led assessment. Conducted by a government organisation, at the highest level, against an extended control set.

Which applies to you is stated in your contract and not chosen by you.

What they are and are not

An organisation accredited by the programme's accreditation body, staffed by certified assessors. They examine, they do not consult, and the separation matters: an organisation that helped you prepare generally cannot also assess you.

Which means the readiness review and the assessment are two engagements with two suppliers, and planning for one is a common budgeting error.

Four questions

Have you assessed organisations like ours, in manufacturing, with equipment on a shop floor? What is your availability? What do you need from us in advance, and in what format? And what are the commonest reasons organisations like ours fail?

The last question separates assessors who will tell you things from those who will only tell you outcomes.

The constraint nobody plans for

The number of accredited organisations is finite and demand is uneven. Lead times are measured in months and lengthen as contractual dates approach.

Book early. A booking can be moved more easily than it can be created, and the blog entry on slippage lists this among the recurring causes.

Scoped by the size of your environment

Fees scale with the number of controls in play, the number of systems and the number of locations, which is one more reason the boundary decision governs the budget.

Ask a prospective assessor how they scope a fee before you finalise the boundary rather than after.

Why you cannot buy the outcome

The assessor's accreditation depends on their independence, and an assessor who negotiated a result would lose it. This is worth understanding because it explains why no vendor and no consultant can promise certification, however the proposal is worded.

The blog entry on reading a proposal covers what such promises actually mean.

Findings, and what happens to them

An assessment produces findings. Depending on their nature and the rules in force, some may be addressed within a defined period through a plan of action while others prevent the outcome outright.

The entry on the assessment week describes how it runs and the entry on plans of action covers the limits of what may be deferred.

What assessors ask for in advance

The plan, the boundary documentation, the asset inventory, the evidence index and access arrangements. Sent in the format they ask for, on time, because the first impression of an organised supplier is formed before anybody arrives.

A separate engagement, and worth it

Somebody experienced examining you as an assessor would, several months out, producing findings you can still act on.

It costs a fraction of a failed assessment and it is the single item most often cut from a budget under pressure.

Agreed before they start

What is being assessed, which systems, which locations. Disagreement about this discovered on the first morning costs a day of an expensive engagement and occasionally the engagement.

Send the boundary documentation early and ask them to confirm they agree with it.

Who needs to be available

The compliance owner throughout. Whoever administers each in-scope system, on call. Somebody from the floor. And the sponsor, briefly, at the start and the close.

Booking those people in advance is what prevents the assessment stalling while somebody is found.

Findings are not the end of the conversation

Depending on their nature, some findings can be addressed within a defined period. Establishing which category a finding falls into, and what the timeline is, is the first thing to ask rather than the last.

The entry on plans of action covers what may and may not be deferred.

Assessors are people, accredited organisations are companies

Both are certified, under different arrangements, and the distinction occasionally matters when checking credentials. Verifying that an organisation and the individuals it sends are both properly accredited is a reasonable check and the registers exist for it.

Ask, and check rather than assume, for the same reason you would with any professional engagement.

Accredited organisations are listed publicly

A public marketplace of accredited organisations and certified individuals is maintained by the accreditation body. Checking a prospective assessor against it takes a minute and establishes that the accreditation is current rather than claimed.

Elsewhere in what the requirement actually says

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.