In this article 6 sections
Your ISO certificate is on the wall. Your Cyber Essentials Plus passed in spring. Both are real, and both describe a moment that has already gone. It drifts the day after the assessor leaves.
What is wrong with point-in-time certification?
A point-in-time audit proves you met the standard on the day of the audit. It cannot prove anything about the 364 days that follow. And those are the days when MFA gets disabled for a VIP, a backup fails silently, a leaver keeps their access, and reality quietly diverges from the certificate.
How fast does compliance actually drift?
Faster than most owners think. One new client onboarded without the full checklist. One tool swapped without updating the policy. One busy month where access reviews slip. It starts the moment the audit ends. By the time the next annual audit comes round, the gap between your certificate and your reality can be wide.
We already have ISO and Cyber Essentials, is that not enough?
It is a strong start, and it is not the whole answer. Holding ISO 27001 or Cyber Essentials shows work done at a point in time. It does not show that those standards are still being maintained today. That is the gap the Assurix Trustmark is built to close. It sits alongside the ISO 27001 or Cyber Essentials you already hold. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. Live-measured controls are checked every six hours and the rest on a set cycle, and an Assurix assessor signs off. The result sits on a Trust Portal anyone can open. Where an audit says you did the work, the Trustmark keeps proving you still are.
What does always-current proof change for your clients?
It changes what you can promise. Instead of “we passed our audit in March”, you can say “we are compliant today, and here is the live evidence”. Clients feel the difference. Ian Groves at Start Tech thought his controls were 80 or 90% there. They weren’t. Once the gaps were closed, he said: I sleep much easier at night.
For how the Trustmark compares with the standards you may already hold, see our guide to ISO 27001 for MSPs.
How do you keep proof current without adding headcount?
You let the tools you already pay for do the collecting. Your RMM knows your patch status. Your identity platform knows your MFA coverage. Your backup tool knows whether the last restore worked. The work is connecting those sources once.
So keeping proof current does not mean more staff. Assurix pulls evidence from your PSA, RMM and security tools where it can, and an Assurix assessor reviews the rest. The work starts from 2 hours a week.
A certificate proves a date. Assurix proves today.
Frequently asked questions
Does passing an audit mean I am secure?
It means you met the standard on the day of the audit. It says nothing about the months that follow, when drift happens.
How is the Assurix Trustmark different from ISO or Cyber Essentials?
Those prove work at a point in time. The Trustmark checks live-measured controls every six hours and the rest on a set cycle, so it shows the standard is still being maintained.
Can I lose the Trustmark between audits?
Yes. If a control fails and is not remediated within 30 days, the badge is publicly suspended. That enforcement is what makes it credible.
