So as we've conducted a number of assessments, what lessons have we learned as an assessment body that we can sort of pass over to applicants?

So probably one of the big ones is the scope in the assessment correctly.

We've had a number of organisations that maybe thought something could be out of scope when it couldn't.

or maybe they've just missed something on their questionnaire.

If the assessment isn't scoped correctly and you move on to CE+, when we come to conduct the technical scope verification, if we see something that doesn't add up, you'll have to go back and redo the cyber essentials questionnaire so that it does match up.

So scoping the assessment is essential.

And again, like you said, many people finding this out with excluding test and development networks maybe they're part of a group and they've previously done whole organization but now they can't because of the statements for designating who can and who can't be whole organization that ties in quite nicely with the next point so if you're not doing whole organization segregation has to be network based and that is VLAN or firewall, so layer two or layer three of the OSI model.

Jamie, so from your perspective, from a certification body's perspective, what obviously we said a lot about what, you know, what to do, right? How How to do this and what are the steps? What steps should people be taking, whether it's research or fresh certification?