Agree the scope before inspecting controls
Identify the legal entity, locations, networks, devices and services covered by the application. Include remote working, personally owned equipment used for business and third-party administration where relevant. Reconcile the asset list with identity, endpoint and purchasing records rather than relying on a spreadsheet nobody maintains.
Check the requirements and question set applicable to your application. Scheme documents change, so do not reuse last year's answers without review. Record uncertain boundaries for clarification with the certification body before committing to a scope statement.
Check settings rather than policy intentions
Review firewalls, secure configuration, security update management, user access control and malware protection. Inspect actual configurations across the in-scope estate, including less visible equipment such as spare laptops and administrative workstations. Sampling can identify problems, but it does not establish that every device meets the requirements.
For SaaS, separate supplier responsibilities from customer settings. A provider may maintain its infrastructure while your organisation remains responsible for accounts, permissions and authentication configuration. Check MFA enforcement and administrative access using tenant evidence rather than a supplier's general security statement.
Turn findings into verifiable actions
Describe each gap precisely: affected assets, requirement, current condition, proposed correction and owner. Distinguish missing information from a confirmed technical weakness. An unsupported operating system needs a different response from a supported device whose update status has not yet been checked.
Agree completion dates and a retest method. Useful evidence includes configuration exports, deployment reports and dated screenshots showing the relevant setting and population. Avoid collecting passwords, recovery codes or unnecessary personal information. Retest the change rather than closing an action because somebody says it is complete.
Prepare an accurate submission
Read each proposed answer alongside its supporting evidence and resolve contradictions. A statement that all users have MFA should match the actual enforcement configuration, including relevant administrative and exceptional accounts. Where an answer depends on an outsourced provider, obtain confirmation covering your service and responsibilities.
Use the existing certification and Plus support pages below for assessment preparation. Horizon can organise risks, controls, owners, evidence and reviews; it does not certify organisations or decide risk. Assessment decisions remain with the certification body.