What happens between a PISF submission and a certificate

Most organisations prepare for a PISF assessment as if the submission were the finish line. The answers are written, the evidence is uploaded, somebody presses submit, and the team exhales.

From the other side of the table, the submission is where the work begins. A reviewer now has to decide, control by control, whether what was claimed is actually shown. Understanding how that review works is the single most useful thing a team can know before it submits, because it changes what a good submission looks like.

What follows is the review chain as we designed it in CyberNexus, which we built for exactly this process. The advice applies whatever tool your reviewer uses.

The submission should be frozen

The first rule of a fair review is that nobody moves the goalposts halfway through. When an organisation submits, its assessment should become a snapshot that cannot be edited. The reviewer reads that snapshot, and the organisation can see exactly what the reviewer is reading.

This protects both sides. The organisation cannot quietly improve an answer after the reviewer has started, and the reviewer cannot be accused of judging a version the organisation never sent. If something needs to change, it goes back as a formal clarification, and the change is recorded.

For your preparation, this means one thing. Treat submission as final. Anything you plan to fix next week should be written down as a corrective action with an owner and a date, not left as an answer you intend to revisit.

A reviewer reads one control at a time

A careful reviewer does not start from your overall score. They open each control and put three things side by side. The authoritative text of the control, the answer you gave, and the evidence behind it.

CyberNexus

Demo environment, sample dataAzbersInnovations

For each control they record a verdict. It is approved, it needs modification, or it is rejected. Where they want a change, a good process forces them to write a finding explaining why, so the organisation is never left guessing what was wrong.

Two scores then sit next to each other. The score the organisation gave itself, and the score once the reviewer's verdicts are applied. Where they match, you have been honest and well evidenced. Where they differ, the difference is visible and specific, which is far better than an argument about a single number at the end.

Why cases get sent back

A well run review rarely returns a case because an organisation admitted a gap. An honest gap with a corrective plan, an owner and a realistic date is exactly what a reviewer wants to see. It shows the organisation knows where it stands.

Cases come back for other reasons, and they are almost always avoidable.

• Evidence that does not match the claim, such as a policy attached to a control that asks for a configuration.
• Evidence that is out of date, such as an access review from the previous year offered as current.
• Answers of compliant with nothing attached where the control expects proof.
• Gaps marked as closed with no evidence that anything changed.

Each of these is a mismatch between what was said and what was shown. The fix before submission is simply to read your own answers the way a reviewer will, one control at a time, with the control text open beside them. Our piece on what a regulator actually wants to see goes further into that habit.

The decision is layered for a reason

After the case auditor has been through every control, the decision should not rest with one person. In the chain we built, the case moves from the auditor to a sector head, who can only decide cases from their own sector, and then to the Authority head, who takes the final decision to accredit, ask for changes or decline.

Layering exists so that a decision can be explained and defended later. If an organisation appeals, everyone involved is looking at the same frozen submission, the same verdicts and the same findings. There is no reconstruction from memory and email.

CyberNexus

Demo environment, sample dataAzbersInnovations

The same records give the regulator something it has never easily had, a national view. Which domains are weakest across the country, which sectors are slowest to close gaps, and where guidance and training would do the most good.

A certificate anyone can check

The final step is the one that makes the rest worth doing. A certificate issued at the end of all this should be verifiable by anyone who relies on it. A bank assessing a supplier, a partner signing a contract or a member of the public should be able to enter a certificate number and see whether it is genuine and still active.

CyberNexus

Demo environment, sample dataAzbersInnovations

That only works if suspension, revocation and expiry update the public status as well. A certificate that stays green after it was withdrawn is worse than no certificate at all, because it gives false comfort to exactly the people it was meant to protect.

Before you press submit

Run through this list once, with the people who will answer the reviewer's questions in the room.

1. Every compliant answer has evidence attached, and the evidence is the kind the control asks for.
2. No evidence is older than the period the control expects it to cover.
3. Every gap has a corrective action with a named owner and a realistic date.
4. Nothing is marked closed without proof that it changed.
5. Someone who did not write the answers has read ten controls at random the way a reviewer would.

If that last check turns up a problem, assume there are more like it. It is far cheaper to find them now than to find them in a finding.

Common questions

What happens after a PISF assessment is submitted

The submission is frozen and passed to a reviewer, who checks each control against its authoritative text and the evidence provided, and records a verdict. The case then moves through further review before a final decision to accredit, request changes or decline.

Why are PISF submissions returned

Most often because the evidence does not support the answer. Common causes are evidence of the wrong kind, evidence that is out of date, compliant answers with nothing attached, and gaps marked closed without proof of change. Honest gaps with a corrective plan are rarely the problem.

Can a PISF certificate be verified

It should be. A well designed certification process lets anyone enter a certificate number and confirm that it is genuine and currently active, with suspension, revocation and expiry reflected immediately.

Can we change our answers after submitting

Not directly. A fair review depends on both sides reading the same frozen submission. Changes happen through formal clarification requests, which are recorded alongside the case.