Patching gaps, incomplete MFA, and devices you forgot about. These three account for most failures.
Quick answer: Patching gaps, incomplete MFA, and devices you forgot about. These three account for most failures.
The Usual Culprits
1. Patching isn't current
The standard says critical patches within 14 days. The assessor will check.
What catches people:
- That server no one touches because "it just works"
- Third-party software that doesn't auto-update
- Devices that haven't been online recently
- Firmware on firewalls and network kit
2. MFA isn't everywhere
You enabled MFA on Microsoft 365. Great. But:
- Is it on your VPN?
- Your firewall admin portal?
- Every cloud service with company data?
- Admin accounts on local machines?
3. Forgotten devices in scope
Your scope includes every device that accesses company data. That means:
- The MD's personal laptop they sometimes use for email
- The old PC in the warehouse running stock software
- Mobile phones accessing company email
- That test machine the developer uses
4. "We'll fix it before the assessment" optimism
Assessments get booked. Remediation takes longer than expected. Assessment day arrives. Things aren't ready.
This is avoidable with proper gap analysis and realistic timelines.
How to Pass First Time
Get a gap analysis before booking the assessment. Know exactly what needs fixing.
Fix everything before scheduling. Don't book the assessment until you're genuinely ready.
Remember your full scope. Document every device, every user, every system that touches company data.
Check the awkward stuff. That legacy system. The MD's iPad. The firewall firmware from 2019.
What We Do
We run pre-assessment gap analysis that catches these issues before the real assessment. Our clients know exactly what needs fixing and have time to fix it.
For managed clients, most of this is already handled. Patching is current, MFA is enforced, devices are managed. Certification becomes a formality rather than a scramble.
---
- a gap analysis costs less than a failed assessment.
---