Five Free Checks: What They Measure—and What They Don’t

Security Check: The Exterior

Do not measure: nothing within your environment, nothing related to the due diligence measures under the Cybersecurity Act. Nor is this the assessment required for the subsidy.

Check what anyone on the internet can see about your domain. Email security (SPF, DKIM, DMARC), DNS and DNSSEC, certificates, and security headers. Thirty seconds, no account required.

The result: forward the red lines to your administrator. SPF, DKIM, and DMARC are settings in your DNS; they don’t require a purchase.

Start the Security Check

Tenant Check: Inside Microsoft 365

Don’t take this at face value: it requires an administrator account, doesn’t count PIM-eligible administrators, and says nothing about contracts outside of Microsoft 365.

Be sure to check: MFA coverage, administrator accounts, Secure Score, unused licenses, and which users only have SMS or phone verification. It takes two minutes. It doesn’t save anything from your tenant.

The result: cancel licenses, enforce MFA, and transition SMS users to a passkey. Microsoft will discontinue its own SMS and voice verification effective February 1, 2027, and for administrators and external users effective July 1, 2027.

Start the Tenant Check

Chain Response: Your Client’s Questionnaire

Don’t be fooled: he doesn’t write answers or make things up.

Note, though: it reads the questionnaire and indicates for each question whether a source is available. Anything missing remains a gap. You only upload the list. It’s free.

The result: the gaps become your to-do list with due dates, which you send along.

Start Chain Response

AI Register: Your Team’s AI

Do not take this as a legal opinion.

Just a heads-up: an overview of your AI tools and their transparency statements—all in about ten minutes—will be sent to your email as three documents.

The result: guidelines for each tool, and a ready answer if a client or auditor asks about them.

Launch the AI Registry

Normscan: What Still Needs to Be Put on Paper

Don’t measure: there’s no guarantee of certification, and he won’t draft your documents.

Just to be clear: about twenty questions, your readiness for each chapter of the standard in three sections, the missing documents, and an estimate of the turnaround time—all sent to you as a PDF via email.

The result: you’ll know what still needs to be done to meet ISO 27001, ISO 9001, or NEN 7510.

Take the Normscan

This Is How We Do It

The checks are free and can be used on your own. If you’d like to discuss the results, we’ll compare them to your 2027 budget: what constitutes an institution, a license, and a project. In *De Meting*, we publish the findings of the Security Check for a larger group of domains.

Discussing the results