I don’t think the experience here is performative unless treated as just passing a test. The task of getting the accreditation should be one that leads you through a reflective process of considering how robust your systems, controls, policies and procedures are. It’s about how you approach it.

Hi Gareth. Forget the badge it gives you - it’s more about the structured process of being made to think through and address cyber security risk. If anything it’s too light touch. I think we’ve reached the point where not having it suggests a lack of awareness of relevant risk.