An incomplete scope hides unmanaged equipment
A device list drawn only from the main office can miss remote laptops, personal devices and equipment administered by another supplier. Cloud services may also be overlooked because nobody regards them as infrastructure. These omissions undermine the accuracy of answers about access, configuration and software support.
Compare endpoint management, identity records, purchasing data and team service lists. Investigate discrepancies instead of excluding inconvenient assets. Check the applicable Cyber Essentials requirements before finalising boundaries; a narrower organisational scope must still satisfy the scheme's scoping rules.
Updates are configured but not completing
An update policy is not proof that updates reach devices. Machines may be offline, lack storage, require restarts or run applications outside the normal deployment tool. Unsupported software creates another problem: there may be no vendor security update available to install.
Review installation results and exceptions against the applicable scheme deadlines, not just deployment schedules. Include operating systems, browsers and other in-scope software. Assign someone to investigate failures, arrange replacement where support has ended, and verify completion after remediation rather than assuming an automatic process succeeded.
Cloud responsibilities fall between organisations
A SaaS provider's security documentation does not prove that your tenant has the required access controls. MFA may be available but unenforced, dormant accounts may remain enabled, or everyday users may retain administrative privileges. These are customer-side configuration and account-management issues.
Write down who manages identities, tenant settings, account removal and provider liaison. Examine the actual enforcement rules and relevant exceptions. Ask outsourced administrators for service-specific evidence: a generic assurance letter cannot establish how your accounts are configured or whether leavers have been removed.
Answers describe intentions rather than reality
Copying a policy statement into an assessment can conceal a gap between written requirements and operational practice. Different teams may also give contradictory accounts of the same control. Resolve those differences before submission; wording cannot compensate for a setting that has not been implemented.
A readiness review connects answers with evidence, while a gap assessment structures remediation. Horizon can organise the risks, controls, owners and reviews behind that work. People decide corrective action; the certification body determines the assessment outcome.