Assessment queue

Every assessment across all tenants, in one place
Search MSP, control or finding
In queue
9
across 5 stages
Past SLA
2
Kingsway, Foxfield
Waiting on an MSP
4
clarifications sent, no reply
Median days to outcome
11
target 10
All9 Mine5 Needs my attention3 Past SLA2 Renewals4 First assessments5 ISO overlay2
 MSP Stage Holder Review progress Waiting on MSP SLA Findings
Kingsway TechnologyRenewal · submitted 6 AugISO overlay
Secondary review
since 20 Aug
SNSecondary
84 / 160 re-checked
160 classified at primary
2 clarifications
sent 22 Aug, no reply
 2 days over
due 26 Aug
3 mandatory7 advisory
Kingsway Technology · stage history
Received
6 Aug. Submitted by the compliance lead. Assigned from the queue the same day.
Primary review
8 to 19 Aug, primary assessor. All 160 controls classified. 10 findings raised, 3 of them mandatory.
Secondary review
Since 20 Aug, secondary assessor. 84 of 160 re-checked. 2 clarifications sent to the MSP on 22 Aug, still unanswered.
Final sign-off
Not started. Expected 28 Aug once the clarifications are answered.
Outcome
Not sent. Target 30 Aug. Conditional Trustmark likely while the 3 mandatory findings are open.
Foxfield ITFirst assessment · submitted 8 Aug
Primary review
since 10 Aug
JBPrimary
96 / 160 classified
Rosie pre-classified all 160
1 clarification
sent 24 Aug, no reply
 1 day over
due 27 Aug
1 mandatory2 resubmission
Northgate ITRenewal · submitted 14 Aug
Primary review
since 17 Aug
JBPrimary
122 / 160 classified
Rosie pre-classified all 160
1 clarification
sent 25 Aug, due 29 Aug
 4 days left
due 2 Sep
2 advisory118 meets
Harbour SystemsRenewal · submitted 18 Aug
Final sign-off
since 27 Aug
MTSign-off
160 / 160 agreed
primary and secondary agree
 Nothing outstanding 5 days left
due 3 Sep
2 advisory
Meridian Managed ITFirst assessment · submitted 20 Aug
Received
since 20 Aug
 Unassigned
0 / 160 classified
Rosie pre-classified all 160
 Nothing outstanding assign today
due 4 Sep
 Not started
Cavendish TechRenewal · submitted 21 AugISO overlay
Primary review
since 26 Aug
SNPrimary
31 / 160 classified
Rosie pre-classified all 160
 Nothing outstanding 8 days left
due 5 Sep
1 advisory
Blue Ridge ITRenewal · submitted 22 Aug
Outcome
since 27 Aug
MTSign-off
160 / 160 agreed
report drafted, not sent
 Nothing outstanding Ready to send
due 6 Sep
1 mandatory3 advisory
Stonecroft ITFirst assessment · submitted 25 Aug
Primary review
since 27 Aug
JBPrimary
14 / 160 classified
Rosie pre-classified all 160
1 clarification
sent 27 Aug, due 31 Aug
 9 days left
due 9 Sep
 None yet
Aldermere DigitalRenewal · submitted 26 Aug
Received
since 26 Aug
 Unassigned
0 / 160 classified
Rosie pre-classifying, 74%
 Nothing outstanding Not started
due 10 Sep
 Not started
Stage order: Received, Primary review, Secondary review, Final sign-off, Outcome sent. SLA counts from submission and is set per stage. The MSP sees the same stage and expected date on their own assessment page. Selecting rows gives bulk assign and bulk expected-date actions.

Portfolio

71 clients · who is stalled, who has the most open actions, who is closest to done
Sort: days to deadline
All clients71 In assessment9 Certified38 Conditional5 Renewal in 60 days13 Stalled 14 days+6
Kingsway Technology
Renewal · secondary review
Past SLA
Tasks complete147 / 160
Open findings10
Mandatory outstanding3
Deadline in 4 days3 mandatory7 advisory
Northgate IT
Renewal · primary review
On track
Tasks complete157 / 160
Open findings4
Mandatory outstanding0
Deadline in 21 days4 advisory
Foxfield IT
First assessment · primary review
Past SLA
Tasks complete130 / 160
Open findings3
Mandatory outstanding1
Deadline in 2 days1 mandatory2 resubmission
Harbour Systems
Renewal · final sign-off
Ready
Tasks complete160 / 160
Open findings2
Mandatory outstanding0
Deadline in 12 days2 advisory
Meridian Managed IT
First assessment · received
Unassigned
Tasks complete141 / 160
Open findingsNot started
Mandatory outstanding—
Deadline in 18 daysAwaiting assignment
Blue Ridge IT
Renewal · outcome
Conditional
Tasks complete154 / 160
Open findings4
Mandatory outstanding1
Outcome ready to send1 mandatory3 advisory
Cavendish Tech
Renewal · primary review
On track
Tasks complete158 / 160
Open findings1
Mandatory outstanding0
Deadline in 29 days1 advisory
Stonecroft IT
First assessment · primary review
Clarification open
Tasks complete138 / 160
Open findings1
Mandatory outstanding0
Waiting on MSP · 3 days1 clarification
Aldermere Digital
Renewal · received
Unassigned
Tasks complete150 / 160
Open findingsNot started
Mandatory outstanding—
Deadline in 25 daysAwaiting assignment

B5.C — Backups

Assurix Trusted MSP · one control across the tenants currently in assessment
Change control
In assessment9 Same answer4 Rosie disagrees with me2 Not yet classified3
Requirement
Kingsway TechnologySecondary review
Northgate ITPrimary review
Foxfield ITPrimary review
Cavendish TechPrimary review
Backup coverageWhich systems are backed up, and whose?
Own systems and all managed client tenants. Names the two client tenants that are excluded and why.
Own systems and all managed client tenants. M365 and on-premises servers listed separately.
Own systems only. Client backups described as "handled by the client".
Own systems and all managed client tenants, plus break-fix clients marked out of scope.
EvidenceUploaded documents and live metrics
Backup policy v4.docxDatto report AugBackup success 99.1%
Backup policy v2.docxBackup success 97.4%
Backup policy v1.docxNo metric connected
Backup standard.pdfRestore test logBackup success 98.8%
Restore testingFrequency and last test
Quarterly, last tested 12 Jul. Test record attached.
"Regularly." No date or record given.
Annually, last tested Nov 2025.
Monthly sample restore, last tested 4 Aug. Record attached.
RosiePer-task score and flag
92 · consistent
78 · no test date
54 · scope gap
95 · consistent
Assessor classificationMeets / Advisory / Mandatory / Resubmission
Meets
Advisory
Ask for the last restore test date.
Resubmission
Client backups are in scope of the control.
Meets
Calibration: 3 of the 9 MSPs in assessment answered this control about their own systems only. That pattern is a sign the question wording needs changing, not that three MSPs failed it.

Metrics across clients

Compare one client against the rest without opening each tenant
Cohort: in assessment (9)
Client-facing metrics Internal metrics Below threshold7 No data3
MSP Critical patch
compliance		 Supported OS
compliance		 Disk encryption
compliance		 Antivirus
coverage		 Response SLA
compliance		 CSAT net
90 day
Kingsway Technology 88%97%99%100%71%outlier94
Northgate IT 96%99%98%99%93%97
Foxfield IT 62%outlier86%No data96%84%81
Harbour Systems 95%98%97%100%91%96
Meridian Managed IT 94%89%96%No data90%92
Cavendish Tech 98%99%99%100%95%98
Blue Ridge IT 90%96%87%98%92%93
Stonecroft IT 93%95%96%99%No data95
Aldermere Digital 97%98%98%100%94%96
Cohort median 94%97%97%99%91%95
Two outliers to raise at primary review: Foxfield's critical patch compliance is 32 points below the cohort median, and Kingsway's response SLA compliance is 20 points below. Both are trustmark metrics.

Compliance alerts across customers

The same alerts each tenant sees on their own alerts page, in one list, next to the HubSpot ticket
Search customer or metric
Trustmark at risk
2
past day 30
In grace period
3
7 days from detection
Open HubSpot tickets
4
CS queue
Resolved this month
11
median 9 days
Open6 Metric threshold4 Recurring task breach2 In assessment now3 Muted1
CustomerAlertTypeLifecycleHubSpot ticketDays open
Kingsway TechnologyIn assessment
Response SLA compliance 71%
Threshold 85%
 Metric threshold
Day 30 notified
 ▣ #48213 · Open 34 Trustmark at risk
Foxfield ITIn assessment
Critical patch compliance 62%
Threshold 90%
 Metric threshold
Day 30 notified
 ▣ #48277 · Waiting on customer 31 Trustmark at risk
Blue Ridge ITCertified
Annual policy review overdue
Recurring task T044
 Recurring task
Ticket created
 ▣ #48301 · Open 19 Breach in 11 days
Meridian Managed ITIn assessment
Antivirus coverage: no data
RMM not reporting since 14 Aug
 Metric threshold
Detected
 In grace period 5 Grace ends in 2 days
Aldermere DigitalCertified
Disk encryption compliance 87%
Threshold 95%
 Metric threshold
Detected
 In grace period 3 Grace ends in 4 days
Stonecroft ITIn assessment
Quarterly restore test overdue
Recurring task T092
 Recurring task
Ticket created
 ▣ #48344 · Open 12 Breach in 18 days
The workspace does not replace the HubSpot pipeline. HubSpot stays the CS working queue; this list reads the same alerts and shows the ticket id and status next to each one, and resolving an alert here keeps updating the ticket as it does today.

Your assessment

Renewal assessment · submitted 14 August 2026
Current stage

With your assessor — primary review

Your submission is being reviewed control by control. You will get an email when it moves to the next stage, and any findings raised in this stage are released to you when the stage finishes.

Held by
Primary assessor
Expected to finish
2 September 2026
Outcome expected by
11 September 2026
Submitted
14 Aug · confirmed by email
Primary review
Started 17 Aug · ends 2 Sep
Secondary review
Expected 3–7 Sep
Final sign-off
Expected 8–10 Sep
Outcome
Expected 11 Sep

Findings released so far

Advisory
B5.C — Backups
Restore testing is described as "regular" without a date or a test record. Add the date of your last restore test and attach the record.
21 Aug
Advisory
C2.A — Vulnerability Management
Scanning covers servers but not end-user devices. Not a failure of the control, but worth closing before renewal.
22 Aug
Clarification
B1.A — Policy Development
Your access control policy is dated March 2025 and your review cycle says annual. Confirm whether a newer version exists. Reply needed by 29 Aug.
25 Aug
Meets
118 controls reviewed with no findings
The full list is included in your assessment report at the end.
—

What is left with you

1 clarification2 advisory0 mandatory
Advisory findings do not block your Trustmark. The clarification does — answer it and the assessor can finish primary review.

You will be emailed when

· Each stage starts and finishes
· A finding is released to you
· A clarification needs an answer
· The outcome and report are ready
Queue / Kingsway Technology

Kingsway Technology

Renewal assessment · Trustmark with ISO 27001 overlay · submitted 6 August 2026 · 160 controls
Received
6 Aug · assigned same day
Primary review
8 to 19 Aug · primary assessor
160 classified, 10 findings
Secondary review
since 20 Aug · secondary assessor
84 of 160 re-checked
Final sign-off
expected 28 Aug
Outcome
target 30 Aug
Sectionscontrols · findings
A. Governance and risk18 B. Policies and people34 · 4 C. Technical controls30 · 3 D. Data16 E. Detection and logging22 · 1 F. Response and recovery20 · 2 G. Supply chain12 H. Improvement8
Evidence
Metrics from integrations14 Policies and registers31 Unmanaged customer exclusions2
Section B. Policies and people34 controls · 4 findings · 26 re-checked
Control
Rosie
Classification
Evidence
B1.A
Policy Development
Re-checked 21 Aug, agreed with primary
88
Meets
6 files
B1.B
Policy Implementation
Re-checked 21 Aug, agreed with primary
72
Advisory
3 files
B2.A
Identity and Access Management
Re-checked 22 Aug, agreed with primary
91
Meets
4 files, 1 metric
B3.A
Cyber Security Training
Clarification sent 22 Aug, no reply
84
Waiting on MSP
5 files, 1 metric
B5.C
Backups
Next to re-check
92
Meets
B5.D
Resilience Preparation
Not yet re-checked
61
Mandatory
2 files
B4.A
Privileged User Management
Not yet re-checked
Pending
Not classified
4 files
B6.A
Cyber Security Culture
Not yet re-checked
89
Meets
3 files
This assessment
Controls
160
Re-checked
84
Findings
10
Mandatory
3
3 mandatory7 advisory150 meets
6 days in this stage. SLA due 26 Aug, 2 days over.
Likely outcome: conditional Trustmark while the 3 mandatory findings are open.
Reviewers
JB
Primary assessor
Complete 19 Aug
SN
Secondary assessor
In progress, access ends 3 Sep
MT
Final sign-off
Not started
Activity
2 clarifications sent
22 Aug, secondary assessor. B3.A and C2.A. No reply yet.
Secondary review started
20 Aug. Read-only access to the tenant granted for 14 days.
Primary review complete
19 Aug. 160 classified, 10 findings raised.
Rosie pre-classification finished
7 Aug. 160 controls, 12 flagged for a closer look.
Submitted for assessment
6 Aug by the compliance lead. Confirmation email sent, HubSpot ticket 48213 created.
Queue / Kingsway Technology / Section B / B5.C Backups

B5.C — Backups

Secondary review · classified Meets by the primary assessor on 14 August · control 5 of 34 in section B
What the MSP answered3 requirements · last edited 2 Aug
Which systems are backed up, and whose?
All of our own systems, and every client tenant we manage. Two client tenants are excluded because the client runs their own backup: Harlow Group and Bexley Care. Both exclusions are recorded on the unmanaged customer declaration.
Answered 2 Aug by the compliance lead. Edited once, on 4 Aug.
How often are backups tested by restore, and when were they last tested?
Quarterly sample restores across a rotating set of clients. The last test was 12 July 2026, covering three client tenants and our own file server. The test record is attached.
Answered 2 Aug by the compliance lead.
Where are backups stored and how are they protected?
Immutable cloud storage in the UK with a 35-day retention, plus a local appliance per site. Access needs a separate privileged account with multi-factor authentication. Deletion needs two people.
Answered 2 Aug by the compliance lead.
Evidence3 files · 1 live metric
DOCX
Backup and recovery policy v4
Uploaded 2 Aug · 14 pages · approved 10 Jan 2026 · next review 10 Jan 2027
Open
PDF
Restore test record, 12 July 2026
Uploaded 2 Aug · 3 pages · signed by the operations lead
Open
CSV
Backup job report, August
Uploaded 4 Aug · exported from the RMM · 412 rows
Open
Live
Backup success rate: 99.1%
From the RMM integration, collected 25 Aug. Cohort median 98.4%. Threshold 95%.
History
Rosie pre-classification Meets · 92
The answer covers both the MSP's own systems and its managed client tenants, and the two exclusions match the unmanaged customer declaration. Restore testing has a date and a record. The live backup success rate agrees with the uploaded job report. Checked against the 4 other tasks that share this control; no contradictions found.
Primary assessor
Meets14 Aug
Agreed with Rosie. Checked the exclusions against the declaration and the July restore record. Nothing to raise.
Your classification
Meets
The control is met. Nothing for the MSP to do.
Advisory
Worth improving. Does not block the Trustmark.
Mandatory
Must be fixed. Conditional Trustmark until it is closed.
Resubmission required
The answer does not address the control. Send it back.
Note to the MSP
Released when this stage finishes. Leave blank for a Meets.
Internal note
Exclusions verified against the unmanaged customer declaration. Restore record covers three tenants, which is enough for a sample. Agree with primary.
Everything on this screen is recorded against the assessment, not in a separate document. The primary, secondary and sign-off reviewers all write to the same record, and the note to the MSP is what the MSP sees on their own assessment page once the stage finishes.

Notifications

What reaches an assessor, and what they choose to be emailed about
All12 Assessments7 Compliance alerts3 Mentions2 Unread only4
Inbox4 unread
Today
Sign-off requested · Harbour Systems
Secondary review finished with 2 advisory findings and nothing mandatory. Waiting on final sign-off.
12 min ago
Clarification answered · Kingsway Technology
B3.A Cyber Security Training. The MSP replied with the training completion report. One clarification still open on C2.A.
1 hour ago
SLA at risk · Foxfield IT
Primary review is due tomorrow and 64 of 160 controls are still unclassified.
3 hours ago
New assessment received · Aldermere Digital
Renewal, submitted 26 Aug. Unassigned. Rosie is pre-classifying, 74% done.
5 hours ago
Yesterday
Past SLA · Kingsway Technology
Secondary review is 2 days over. The MSP has not answered the clarifications sent on 22 Aug.
Yesterday
Rosie pre-classification finished · Meridian Managed IT
160 controls pre-classified. 12 flagged for a closer look, 3 of them for a possible scope gap.
Yesterday
Trustmark at risk · Foxfield IT
Critical patch compliance has been below threshold for 31 days. HubSpot ticket 48277 is open with CS.
Yesterday
You were mentioned · Northgate IT, control C2.A
The primary assessor left an internal note asking whether end-user scanning is in scope for this control.
2 days ago
What you get notified about
Event
In app
Email
New assessment receivednewAny tenant, any assessor
Assigned to younewYou are made primary, secondary or sign-off
Clarification answerednewAn MSP replied to a request on a control
SLA at risk or pastnewTwo days before, and on the day
Sign-off requestednewSecondary review complete
Rosie pre-classification finishednewReady for primary review
Compliance alert digestExists today, opt-in, daily
MentionsExists today
How this is built
The platform already has an in-app inbox and per-user, per-type toggles for in-app and email, held on NotificationPreference. Nothing new is needed for the delivery side.

What is new is the set of assessment events. NotificationType has 18 values today and none of them are about an assessment, because the assessment does not run in the platform. The rows marked new above are the ones this item adds.

What the MSP is told

The same stage record, pushed to the MSP instead of waiting to be asked
Their notification inbox2 unread
A clarification needs your answer
B1.A Policy Development. Your access control policy is dated March 2025 and your review cycle says annual. Confirm whether a newer version exists. Reply by 29 August.
25 Aug
Feedback released on 2 controls
Primary review finished. Two advisory findings, nothing mandatory. Advisory findings do not block your Trustmark.
21 Aug
Your assessment moved to primary review
An assessor is now reviewing your submission control by control. Expected to finish 2 September.
17 Aug
Assessment submitted
We have your submission. 160 controls, 31 policies and registers, 14 live metrics. You will hear from us at each stage.
14 Aug
Annual policy review due in 14 days
Recurring task T044. This one exists today.
12 Aug
What they choose to receive
Event
In app
Email
Assessment stage changesnewStarted, finished, and the expected next date
Findings releasednewAt the end of each stage
Clarification needednewAnd a reminder if unanswered after 3 days
Outcome and reportnewPass, conditional or resubmission
Task reviewedExists today
Weekly digestExists today
Assurix
to the compliance lead at Northgate IT · 2 Sep, 09:04
Your assessment has moved to secondary review

Your renewal assessment finished primary review on 2 September and is now with a second assessor, who checks the first assessor's findings.

Stage: secondary review
Expected to finish: 7 September
Outcome expected by: 11 September

Two advisory findings were released in the last stage. Advisory findings do not block your Trustmark. One clarification is still waiting on you, on B1.A Policy Development, due 29 August.

Open your assessment

You are getting this because assessment updates are on for your account. Change what you are emailed in Settings, notifications. This email replaces the progress update the account manager sends by hand today.
When an email goes out
· Submission received. ASX-1101 covers this one.
· Each stage starts and finishes, with the expected date for the next one.
· Findings are released at the end of a stage.
· A clarification needs an answer, and again if it is not answered in 3 days.
· The outcome and report are ready.

Every one of these is written from the assessment record the assessors work in. Nothing is typed twice.
Today the MSP gets one confirmation email on submission and then nothing until a person remembers to write to them. That is the gap Pensar described. These are the same events the assessor sees, pointed the other way.