What cannot be seen from outside
A passive check can show part of the technical side, such as email authentication, HTTPS and DNSSEC. That touches basic cyber hygiene, cryptography and secured communications (Article 21(2)(g), (h) and (j)).
It cannot show policies, incident response, backups, training, access control or anything else that is not visible from outside.