What to send an assessor
Assessors review what you submit in the portal. Extra context helps only when it answers a control, not when it is a dump of every policy you own.
Always have ready
- A clear scope: which legal entity, which locations, and which systems are in.
- How you apply MFA to in-scope cloud services and remote access.
- How you meet the 14-day security-update rule, and what is excluded.
- How guest, BYOD and unused accounts are handled.
Send when asked, not in advance
Screenshots, export files and policy extracts are useful when an assessor asks a specific question. Do not email a zip of the whole estate to hello@ unless we have asked for it.
If something is missing
Say so in the submission. An honest gap with a date you will close it is easier to assess than a vague yes. See what happens if you fail for the remark window.