Regulators enforce the law. Somebody still has to say how you stand.

What the official bodies actually do

Four things are commonly mistaken for assurance. Each does a real job. Each stops short of saying how a particular organisation or building stands.

The Health and Safety Executive

Regulates and enforces workplace health and safety: it inspects, serves notices and prosecutes organisations that fall short. We are aware of nothing it issues that states a particular organisation manages risk well, and an absence of enforcement is a silence, with no finding in anyone's favour.

The Security Industry Authority

Licenses individual security operatives and approves security businesses through a voluntary contractor scheme, and will regulate compliance with the Terrorism (Protection of Premises) Act 2025 once the duties commence. Nothing it has published so far suggests it will issue a statement that a particular building is well prepared.

Secure by Design

A government policy setting out what departments and their delivery teams must do when building digital services and technical infrastructure. The policy carries no certification route, so a supplier asked to show it meets the principles assembles its own evidence every time it is asked.

Cyber Essentials and ISO/IEC 27001

Certifications with a defined scope and an independent assessment behind each one, and worth holding in their own right. They describe the frame around the work. How you handle security risk on a particular customer's work sits outside both.

A naming trap worth knowing. Secure by Design is the government policy above. Secured by Design, with a d, is a separate police-owned scheme covering products and building developments. They are different things, each certifies within its own field alone, and both names are excluded from every Westmark holder's claim wording.

Somebody is usually relying on the answer

An assessment is rarely bought for its own sake. It is bought because a decision elsewhere turns on it.

1. Primes and contracting authoritiesDeciding whether to put an organisation on a bid, and carrying the flow-down obligation if they get it wrong. A register entry is quicker to check than an audit is to run
2. Boards and directorsCarrying duties personally, and needing better than an internal reassurance that the position is sound
3. Elected members and scrutinyAsking how the authority stands across the buildings it holds, and entitled to an answer written by somebody other than the service being asked about
4. Insurers and brokersPricing a risk at renewal from what the proposal form says. A dated independent record beats a tick
5. Licensing and Safety Advisory GroupsLooking at a plan from an organiser they may never have dealt with, on a timetable that allows no examination of their own
6. The people inside the buildingStaff who will be asked to run an evacuation or a lockdown, and the public who assume somebody has already thought about it

Four things every Westmark outcome carries

A judgement is worth something to a third party only where they can see how it was reached. An internal exercise, however careful, reaches none of these on its own.

An outcome is an opinion formed on evidence examined within a defined scope, on a sample, at a point in time. It is Westmark's own judgement, separate from certification, accreditation or approval by any government body, and separate from compliance with any law. A scheme that overstated itself would fill the gap with the same problem again.

Relying on somebody else's mark?

Every mark we issue is on the register with its scope, its dates and its standing. Verify a mark on the register

• Guide for buyersWhat an outcome means and what it covers. (PDF, opens in a new tab)
• The duty, in plain EnglishWhat the 2025 Act asks, who it reaches, what cannot be certified. (PDF, opens in a new tab)
• Secure by Design, in plain EnglishThe policy, the contract conditions, and what can be certified. (PDF, opens in a new tab)