What Assurix checks
The 59 controls behind your Trustmark.
Assurix independently assesses 59 controls across an MSP’s security and service. 40 security controls are aligned to the NCSC Cyber Assessment Framework (CAF) 4.0. 19 operational controls are built for MSPs.
94 MSPs working with Assurix. See them in the Trustmark Directory.
A demo MSP (Downforce Technologies)
How they are checked
Every control is Pass or Fail.
- Pass or Fail. Both pillars, security and service, are assessed together, and both must pass.
- Live. Measures come from the MSP’s own tools every six hours, such as response SLA, resolution SLA, client satisfaction, critical patching and supported operating systems. They depend on the tools the MSP connects.
- Assessed. The rest follow a set cycle: 13 controls each quarter, 1 every six months and the rest each year. Assessed evidence counts the same as a live measure.
- Signed off. An Assurix assessor signs off, and reviews the evidence every quarter and in full every year.
- 30 days. A failed control opens a 30-day window to fix it. If it isn’t fixed, the Trustmark is suspended publicly.
- Time. From 2 hours a week, around 50 hours to the Trustmark in total. ISO 27001 holders typically need less.
Control list as published on 26/10/2026. Each control is worded as your clients and prospects see it on your Trust Portal, with its current result.
Codes follow the platform’s numbering, so some numbers are skipped.
Control groups 10 groups
40 security controlsAligned to NCSC CAF 4.0, grouped by its four objectives.
A. Managing security risk 9 controls
- A1_A
Board-level ownership of cyber risk
Is cyber risk owned and discussed at board level?
- A1_B
Named owners for every security job
Is someone specifically accountable for each part of security?
- A1_C
How risk decisions get made
Are risk decisions made quickly, by the right people, with the right information?
- A2_A
A structured approach to risk
Is there a repeatable way of finding and managing risk?
- A2_B
Understanding who might attack, and how
Does the provider understand how it would be attacked, and act on it?
- A2_C
Checking the controls actually work
Are security controls tested rather than assumed?
- A3_A
Knowing what systems and data exist
Does the provider know what systems and data it depends on?
- A4_A
Supplier risk
Does the provider understand the risk coming from its own suppliers?
- A4_B
Software suppliers and updates
Do the provider's software suppliers build securely and ship trustworthy updates?
B. Protecting against cyber attack 20 controls
- B1_A
Written policies exist
Are the security rules written down?
- B1_B
Policies are actually followed
Are those policies followed in practice, not just filed?
- B2_A
Proving who is signing in
Is access properly controlled and verified?
- B2_B
Company devices
Are all of the provider's own devices managed and secure?
- B2_C
Administrator accounts
Are the most powerful accounts tightly controlled?
- B2_D
Keeping access rights current
Are access rights kept up to date and recorded?
- B3_A
Knowing what data is held
Does the provider know what sensitive data it holds, and where?
- B3_B
Data moving between places
Is data encrypted while it is being sent?
- B3_C
Data at rest
Is stored data protected and backed up properly?
- B3_D
Phones and tablets
Is sensitive data on mobile devices protected?
- B3_E
Disposing of equipment
Is data properly destroyed before equipment is reused or thrown away?
- B4_A
Systems designed securely
Was security designed in, or bolted on afterwards?
- B4_B
Systems set up securely
Are devices and servers hardened, and kept that way?
- B4_C
How administrators work
Is powerful access used in a controlled and traceable way?
- B4_D
Finding and fixing weaknesses
Are known software weaknesses found and fixed?
- B5_A
Ready to recover
Is the provider ready to recover quickly and safely?
- B5_B
Built to keep running
Are critical systems separated and duplicated?
- B5_C
Backups
Can the provider actually restore from backup?
- B6_A
Security culture
Is security taken seriously day to day, not just on paper?
- B6_B
Training
Is everyone trained, tracked and kept up to date?
C. Detecting cyber security events 6 controls
- C1_A
Monitoring coverage
Can the provider see what is happening across its systems?
- C1_B
Protecting the records
Are those records trustworthy if they are ever needed as evidence?
- C1_C
Raising alerts
Are alerts raised reliably when something is wrong?
- C1_D
Acting on alerts
Are alerts investigated consistently?
- C1_E
The people watching
Do the people monitoring have the skills and the authority to act?
- C1_F
Knowing what normal looks like
Can the provider recognise unusual behaviour, and use threat information?
D. Minimising the impact of incidents 5 controls
- D1_A
A response plan
Is there a plan for when something goes wrong?
- D1_B
The capability to respond
Are the people, information and arrangements in place to recover?
- D1_C
Practising
Is the plan rehearsed, not just written?
- D2_A
Learning from incidents
Are incidents examined properly afterwards?
- D2_B
Acting on what was learned
Do the lessons actually change anything?
19 operational controlsBuilt for MSPs, and assessed alongside the security controls.
Responsiveness 1 control
- E4
Escalation
If something serious happens, can you reach someone senior?
Response and resolution SLAs are live measures, shown on the Trust Portal beside this control.
Proactive service 4 controls
- F1
Repeat problems
Do the same problems keep coming back?
- F3
Catching problems first
Does the provider find problems before you report them?
- F4
Monitoring and alerting
Would the provider know if something failed overnight?
- F6
The provider's own management tools
Are the tools that reach into your systems properly locked down?
Transparency 2 controls
- G1
Reporting
Are clients given regular, meaningful reporting?
- G5
Billing
Are invoices clear enough to check?
Client experience 8 controls
- H1
Linking technology to your goals
Is technology planning tied to what your business is trying to do?
- H2
Quarterly reviews
Do clients get a regular strategic review, not just support?
- H3
Onboarding
Is there a proper process for taking on a new client?
- H5
Offboarding
If you left, would it be handled properly?
- H6
Commitments in the contract
Are service commitments written into the contract?
- H7
Client retention
Do clients stay?
- H8
Serious complaints
Do serious complaints reach the top?
- H10
Working inside your systems
How is your environment protected from the provider's own staff and processes?
People and culture 3 controls
- I1
Keeping the team informed
Does the whole team know what is going on?
- I2
Staff satisfaction
Are the people supporting you likely to stay?
- I3
Joining, leaving and support
Are joining, leaving and ongoing support handled consistently?
Financial stability 1 control
- J1
Financial resilience
Is the provider financially able to keep investing in your service?
An MSP that promises, or one independently checked every day?
- Book a demo.30 minutes with Ollie. Mit joins the second call.
- Start in the month you pick.From 2 hours a week, quick wins first.
- Show prospects your live results.Share your link in proposals and at renewal.
Questions first? Read what MSP owners ask
Choosing an IT provider for your business? You shouldn’t have to take their word for it.