Assess where you stand, before somebody else does
More and more often a customer, an insurer or a tender asks you to demonstrate that the IT is in order. An assessment says where you stand against that requirement, what is missing and in which order to tackle it. That is different from an audit, and the difference is worth knowing.
Assessment, audit and certificate
They are asked for interchangeably and deliver different things.
- An assessmentAn internal measurement against a standard, meant to know where you stand. No outside judgement and no paper for third parties, but a list of what has to happen and roughly what it costs.
- An auditA review by an independent party, with a report that can be shown to a third party. Dearer, and worthwhile when somebody really comes asking.
- A certificateThe outcome of an audit by an accredited body, with a period of validity. This is a months-long track and not a document you buy.
How an assessment runs
Four steps. The last is what separates a report from an improvement.
Establish what is being assessed against
NIS2, ISO 27001, a customer’s questionnaire or an insurer’s requirements. They overlap largely, but the order and the emphasis differ and that decides the work.
Measure what is there
Conversations, reading out settings and reviewing documents. What policy says and what happens in practice are rarely the same, and the gap is the real outcome.
Report with an order
Not only what is missing but in which order it pays off. A list of eighty items without priority does not get done, and we know that beforehand.
An owner and a date per item
Every item gets a name and a deadline. Without those two an assessment is a snapshot that produces the same outcome a year later.
What belongs with this
Assessing hangs off governance and off the measures themselves.
Know where you stand, with an order to work through
Tell us who is asking and why. You get an assessment against that requirement, with a list in order of priority rather than alphabetical.
Practical IT knowledge in your inbox
New guides on management, security and the workplace, written by the people doing the work. No sales talk, and you can unsubscribe in one click.