How FaultyPacket evidence supports Cyber Essentials, ISO 27001 and NIS2 email questions
Assessors, auditors and customer questionnaires often ask how an organisation looks after its email domain. This page maps three FaultyPacket outputs to those questions. It describes what each output shows; it does not say any scheme requires it.
What This Page Covers
Each FaultyPacket output records what public DNS or your own DMARC aggregate reports showed at a stated time. This page sets out which common assessor questions those records can help answer. Whether a record is accepted as evidence, and whether a control is met, is for your assessor, auditor or adviser to decide. Nothing here is legal advice or a certification statement.
- Sources were checked on 31 October 2026. Links to each source are given at the end of each section.
The Three Outputs
- Timestamped DNS evidence (free): run a scan at faultypacket.co.uk/#scanner and download a PDF and JSON record, with a SHA-256 hash, of what public DNS showed for DMARC, SPF, MTA-STS, TLS-RPT and MX at the moment of the scan. Saving a baseline and rescanning after a change gives a dated before-and-after comparison.
- Management summary: a one-page summary in the NIS2, DMARC and bundle packs, written for a board or DPO file. It sets out what was observed, what the DNS change achieves and the questions that remain open.
- Local RUA Workbench (£15 one-off): reads the DMARC aggregate (RUA) reports your mailbox receives, on your own machine, with nothing uploaded. It shows pass and fail over time, sending sources, SPF and DKIM alignment, failure reasons and new senders, with CSV, JSON and print exports.
Cyber Essentials (UK)
Cyber Essentials: Requirements for IT Infrastructure v3.3 (NCSC, April 2026, in use from 27 April 2026) sets out five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. When checked on 31 October 2026, the v3.3 requirements document does not name DMARC, SPF or DKIM as a mandatory control.
So FaultyPacket records are not Cyber Essentials evidence, and they are not needed to complete the question set. Some organisations keep them in the same file because customer and supplier questionnaires sent alongside Cyber Essentials do ask about email domain protection.
- Source: NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3, www.ncsc.gov.uk (PDF) (checked 31 October 2026).
- Source: NCSC Cyber Essentials resources, www.ncsc.gov.uk (checked 31 October 2026).
ISO/IEC 27001:2022 (Annex A)
The Annex A controls below may be relevant to the question; the control titles were checked against the ISO/IEC 27001:2022 Table A.1 preview on 31 October 2026. How a control is scoped and evidenced is set by your own Statement of Applicability and your auditor.
- "How is information protected when it is sent to other parties?" Timestamped DNS evidence of the DMARC policy, MTA-STS mode and TLS-RPT record. Control that may be relevant: A.5.14 Information transfer.
- "Which outside services receive data about your mail, and is that reviewed?" Timestamped DNS evidence lists the report addresses observed in the DMARC record; the management summary records whether they sit on your own domain or an outside address. Controls that may be relevant: A.5.19 Information security in supplier relationships; A.5.22 Monitoring, review and change management of supplier services.
- "How do you watch for misuse of your domain?" Local RUA Workbench exports showing pass and fail over time and new senders. Control that may be relevant: A.8.16 Monitoring activities.
- "How is mail in transit protected?" Timestamped DNS evidence of MTA-STS and TLS-RPT. Controls that may be relevant: A.8.21 Security of network services; A.8.24 Use of cryptography.
- "Can you show what the record was, and when?" The SHA-256 hashed PDF and JSON record and the dated before-and-after comparison. Control that may be relevant: A.5.28 Collection of evidence.
- Source: ISO/IEC 27001:2022, Annex A, Table A.1, www.iso.org (titles checked 31 October 2026).
NIS2 (Directive (EU) 2022/2555)
Article 21(2) lists measures that in-scope entities take. Whether an organisation is in scope, and how its national law applies the Directive, is a question for its own advisers. The points below show where FaultyPacket records may help answer the related questions.
- Article 21(2)(d), supply chain security: the timestamped DNS evidence and the management summary show where DMARC reports are sent, which supports a review of the outside services involved.
- Article 21(2)(f), assessing whether measures work: the dated before-and-after comparison and the Local RUA Workbench trend show whether a DNS change had the intended effect.
- Article 21(2)(h), cryptography: the timestamped DNS evidence shows the MTA-STS mode and TLS-RPT record for mail in transit.
- Source: Directive (EU) 2022/2555, Article 21, eur-lex.europa.eu (text checked 31 October 2026).
Limits of the Records
- Timestamped DNS evidence is a point-in-time observation of public DNS. It does not see inside mail systems, contracts or agreements with outside services.
- The scanner does not see DKIM keys without a selector. DKIM results come from the aggregate reports that receivers send, which the Local RUA Workbench reads.
- Scan domains you own or are authorised to check, and no others.
Start Here
Run a free scan at faultypacket.co.uk/#scanner, save the record, and add it to your assessment file with the date. Packs are one-off payments from £5 to £39 at faultypacket.co.uk/#products.
Prepared by FaultyPacket, 31 October 2026.