Use the five control areas as a practical baseline
- Firewalls and internet gateways
- Secure configuration
- User access control
- Malware protection
- Security update management
The readiness conversation helps clarify scope and likely remediation. Certification is completed through an authorised certification body.