You built the estate. Should you also be the one assessing it?

Cyber Essentials for MSPs › Assessing your own estate

An MSP that has run a client’s estate for six years knows more about it than any assessor ever will. You know which laptop belongs to the director who refuses to be managed, why the finance workstation still runs a piece of software the vendor abandoned, and exactly which conditional access exclusion was added in a hurry last March and never removed.

That knowledge is exactly why you are the right people to fix the estate, and exactly why you are the wrong people to certify it.

The problem is structural, not personal

Every Cyber Essentials question is, for a managed client, a question about a decision you made. Are all devices running supported operating systems. Is multi-factor authentication enabled on all cloud services. Are administrative accounts separate from day-to-day accounts. Is the firewall configuration documented and reviewed.

You did not just observe those things. You chose them, or you inherited them and decided what to do about them, or you proposed fixing them and were told there was no budget. Answering them is therefore an assessment of your own work, and it does not matter how honest you are: the position is compromised before anybody opens their mouth.

Two things follow from that, and they pull in opposite directions. The first is that a client is entitled to an answer that is not filtered through the incentives of the supplier being asked. The second is that nobody else can answer half the questions without your help. Both are true and the whole practical problem is holding them at once.

Where it actually bites

In practice this rarely shows up as anybody lying. It shows up in a handful of specific, recognisable situations where the honest answer is genuinely uncomfortable.

Situations where the assessor and the provider being the same party causes trouble

Situation	Why it is awkward
An exception the client insisted on	You advised against it, you documented the advice, and now you have to record a control as not met because the client overruled you. The written outcome makes it look like your configuration.
A control you deferred for cost	You quoted for it, the client declined, and the certification now turns on it. Raising it mid-assessment reads as an upsell however carefully it is worded.
Software you sold them that is now unsupported	Perfectly reasonable when it was bought. The vendor ended support. Somebody has to say so in writing.
A device you do not actually manage	Bring-your-own devices and director-owned laptops are in scope where they access organisational data. You often do not control them and were never funded to.
An estate you inherited last quarter	You are being asked to certify someone else’s decisions under your own name, before you have had time to fix them.

None of these are failures of integrity. All of them are situations where the person answering benefits from a particular answer, which is precisely the condition that independence exists to remove.

The part nobody enjoys saying out loud

There is a harder version of this and it is worth being blunt about, because pretending it does not exist is what makes the whole subject feel like an accusation.

If you certify your own estate and the client is breached a year later, the certificate is part of the evidence. Whoever is looking at it afterwards, an insurer, a customer running a supplier review, or eventually a solicitor, will notice that the party who configured the controls is the party who confirmed the controls were in place. That is not a good position to be in, and it is worse than the position you would have been in had you not touched the assessment at all.

A separate certification body does not make the breach less likely. It does mean the question afterwards is about the controls rather than about you.

What a separate certification body actually changes

Three things, none of them dramatic.

The answers get read by somebody with no stake in them

Submissions are reviewed by a qualified human assessor who has no relationship with the estate, does not want the managed services contract and has no reason to be generous or harsh. That is the entire value proposition and it is a narrow one.

The uncomfortable conversation becomes somebody else’s to start

When an unsupported operating system or a missing multi-factor policy has to be named, it is named by an assessor rather than by the supplier who will benefit from the fix. You then arrive as the people who can solve it, which is a materially better place to stand than the people who raised it.

The client gets something they can hand over

A certificate from an appointed IASME certification body satisfies an insurer, a tender portal or a customer’s supplier review because the scheme, which IASME runs on behalf of the NCSC, is built on the assessment being independent of the organisation being assessed. A self-assessment signed off by the supplier who built the estate would not carry that.

What you are not giving up

This is the part MSPs worry about and it is mostly unfounded. Placing the assessment elsewhere does not move the valuable work.

The gap analysis, the remediation, the Intune baselines, the conditional access policy rebuild, the removal of standing local administrator rights, the browser and application update rings, the asset register that nobody has maintained since 2021: all of that is yours. It is more work than the assessment, it is worth more, and it is work no certification body is placed to do because it requires exactly the estate knowledge that made you conflicted in the first place.

The split is clean. You know the estate, so you fix it. The assessor does not, so they can judge it.

How to raise it with a client

The framing matters, and the instinct to avoid the subject entirely is the wrong one, because if you do not raise it the client eventually will, usually in front of somebody else.

What works is to present it as a deliberate choice you made on their behalf rather than a limitation you are admitting to. Something close to this, in your own words:

We could put this through ourselves. We are not going to, because a certificate we assessed on an estate we built is worth less to your insurer and your customers than one assessed by an independent certification body, and the whole reason you are doing this is to show it to them. We will get you ready, we will fix what needs fixing, and somebody with no stake in the outcome will mark it.

Three things to have ready for the follow-up questions. First, that the readiness work is where the technical effort sits and it is still yours. Second, that the certification body issues the certificate directly and assesses within one business day of submission, so independence costs nothing in time. Third, that if the client wants the whole thing on one invoice from you, it can be.

Clients who were sceptical about paying a third party almost always come round at the point where the assessor names something you had been raising with them unsuccessfully for two years. The independence you were worried about turns out to be the thing that finally gets the budget released.

The honest counter-argument

There is a version of this where the objection does not hold, and we would rather set it out than pretend otherwise. An MSP that licenses as a certification body in its own right, with trained assessors, a documented quality management system and separation between the people who deliver the estate and the people who assess it, can resolve the conflict internally. That is what the separation of duties inside a quality management system is for.

It is a real option and it is a substantial undertaking, covered separately on this site. What does not work is the middle position: an MSP with no licence, no separation and no audit deciding it can mark its own homework because it is confident the homework is good. The confidence is probably justified. The position still is not.