A little preparation can make the first conversation with your assessor much more useful. Before booking an assessment, establish what your customer has asked for, gather your existing certificate details and identify who can help answer the questions.
This guide is a starting point for organising that work. Use the current IASME applicant guidance for the full requirements.
1. Keep the customer’s request to hand
Record the requested DCC level, any Cyber Essentials or Plus requirement and the relevant deadline. If the request is unclear, ask the customer to clarify it before booking.
Separate a tender deadline from an assessment date or a contract condition. Knowing which one matters helps everyone plan realistically. The MOD’s Cyber Security Model guidance explains how requirements are set within procurement.
2. Gather your Cyber Essentials details
Find your certificate, scope statement and expiry date. Note changes since certification, such as new locations, systems or services, for discussion with your assessor.
The CE and DCC scopes need to align appropriately; DCC considers the organisation more broadly than its internet-connected technology. See IASME’s scope FAQs .
3. Prepare a short description of the organisation
Write down the legal entity being assessed, what it does and its main locations. Explain the services and systems it relies on, including outsourced IT or shared services.
Use this as a starting point for the scoping discussion. A plain description is more useful than an elaborate diagram that leaves important dependencies unexplained.
4. Read the Level 0 questions before collecting documents
Use the current applicant guide to understand each question and the evidence it calls for. Build your evidence list from those requirements.
Avoid sending a large folder of policies without explaining which question each document addresses. Record the relevant document, owner and location so that you can find it again. IASME’s preparation guidance explains the relationship between answers and supporting evidence.
5. Involve the right people
Appoint one person to coordinate the submission. Ask early which answers need input from management, IT or an external provider.
Give contributors specific questions and dates. If someone else holds a document or record, check that it will be available when needed. Do not assume your IT provider can answer every organisational question on your behalf.
6. Be clear about gaps and assistance
Keep a short list of missing information, unfinished work and questions for the assessor. It is better to raise uncertainty early than to submit an answer that does not reflect what happens in practice.
If you need implementation help, discuss this before assigning the work. Assessment impartiality may require another provider. IASME’s FAQ explains the distinction between implementation and assessment .