DRAFT — REQUIRES REVIEW BY IASME-ACCREDITED CE+ ASSESSOR AND SIGN-OFF BY BRITIAI CTO BEFORE INCLUSION IN BID.
CE02 — Cyber Essentials Plus Gap Analysis
Document owner: BritiAI CTO Scope: BritiAI UK (parent) — employee endpoints, UK cloud tenants, UK NHS-facing production environment. Votee (HK) and Beever (Toronto) explicitly out of scope. Baseline assumption: BritiAI is a UK SME operating predominantly on cloud SaaS (Microsoft 365 or Google Workspace, AWS eu-west-2, GitHub, an MDM such as Intune/Jamf/Kandji). Where current-state evidence has not yet been verified at device level, the row is marked [VERIFY] and listed in the summary at the end. Prepared: 15 Jun 2026
How to read this document
For each of the five Cyber Essentials technical controls we capture: the IASME requirement (Montpellier question set), BritiAI’s defensible current state, the gap, the evidence the assessor will request, the remediation action, the owner, and a target date ahead of the 23 Jun 2026 assessment window.
Items marked [VERIFY] require real device-level or tenant-level inspection before we can declare them in the bid. They are the focus of the dry-run on 22 Jun 2026 (see CE03).
Control 1 — Firewalls
Requirement (summary): A correctly configured firewall must protect every device that connects to the internet. For SMEs on cloud SaaS without a corporate LAN, this is typically the host-based firewall on each endpoint. Default admin passwords on any boundary device must be changed. Inbound services exposed to the internet must be documented, justified, and protected.
| Item | Detail |
|---|---|
| Current state | BritiAI staff work from home or co-working. No corporate LAN, no on-prem boundary firewall. Internet boundary protection is provided by (a) host-based firewalls on every endpoint (Windows Defender Firewall / macOS Application Firewall) and (b) AWS security groups on the production VPC. No inbound services run on user endpoints. [VERIFY] that the macOS Application Firewall is enabled on every macOS endpoint — it is off by default. |
| Gap | Likely gaps: (1) macOS Application Firewall not enforced by MDM policy on all devices; (2) no documented justification list for inbound AWS security group rules on the production VPC. |
| Evidence needed | MDM compliance report showing host firewall = on for every device; AWS security group export with documented justification for every 0.0.0.0/0 ingress rule; screenshot of host firewall settings on the assessor’s sampled devices. |
| Remediation | Push MDM configuration profile enforcing host firewall on all endpoints; produce a one-page “in-scope inbound services” register listing every AWS ingress rule, port, source, and business justification. |
| Owner | IT Lead (endpoints), Head of Platform (AWS) |
| Target | 19 Jun 2026 |
Control 2 — Secure configuration
Requirement (summary): Devices and software must be configured to reduce inherent vulnerabilities — remove or disable unnecessary user accounts, change default passwords, disable auto-run/auto-play, and require authentication before access. Cloud services in scope must be configured to require MFA and to have no anonymous access to company data.
| Item | Detail |
|---|---|
| Current state | Endpoints provisioned via MDM with a baseline configuration profile (assumed). All endpoints have disk encryption (BitLocker/FileVault) [VERIFY]. Lock screen requires password after ≤15 minutes idle [VERIFY]. Cloud tenants (Microsoft 365, AWS, GitHub) require MFA for all users [VERIFY GitHub Org-level enforcement]. No default vendor passwords in use. |
| Gap | Likely gaps: (1) inconsistent screen lock timeout across mixed Windows/macOS estate; (2) GitHub Organisation MFA enforcement at Org level not confirmed; (3) auto-run/auto-play not explicitly disabled via MDM policy; (4) guest/anonymous sharing in Microsoft 365 / Google Workspace not restricted. |
| Evidence needed | MDM baseline profile export; screenshots of disk encryption status per sampled device; GitHub Org security settings screenshot showing “Require two-factor authentication” enforced; Microsoft 365 / Google Workspace external sharing policy screenshot. |
| Remediation | Harden MDM baseline profile to mandate: disk encryption on, screen lock ≤15 min, auto-run off, guest accounts removed. Enforce GitHub Org-level 2FA. Restrict external sharing to allow-listed domains in M365/Google. |
| Owner | IT Lead, Head of Platform |
| Target | 20 Jun 2026 |
Control 3 — User access control
Requirement (summary): User accounts must be controlled by an approval process. Each user has a unique account. Admin accounts are separated from standard user accounts. MFA is required on all cloud services. Admin privileges are reviewed regularly and removed when no longer needed. Strong password policy or MFA-only authentication is enforced.
| Item | Detail |
|---|---|
| Current state | All cloud accounts provisioned through HR-IT joiner process. SSO via the BritiAI identity provider (Microsoft Entra ID assumed) for the majority of SaaS. MFA enforced for all SSO logins [VERIFY]. Named admin accounts exist for cloud platforms. [VERIFY] that named admins have separate standard accounts for daily use and only elevate to the admin account for admin tasks. [VERIFY] that no Votee or Beever staff hold admin rights in BritiAI UK tenants. |
| Gap | Likely gaps: (1) one or more admin accounts may not have a paired standard account in active use; (2) GitHub Organisation owners may not all have MFA verified at Org level; (3) AWS root account MFA needs hardware token confirmation; (4) DNS registrar and code-signing accounts may not be in the SSO perimeter — these are common SME blind spots; (5) cross-entity admin rights (Votee/Beever staff in BritiAI tenants) must be enumerated and removed if unjustified. |
| Evidence needed | Admin account register with paired standard account per named admin; MFA status export from IdP; AWS IAM credential report; GitHub Org member list with 2FA column; screenshots of break-glass account procedure and seal evidence; written confirmation from CTO that no out-of-scope entity staff hold in-scope admin rights. |
| Remediation | Produce and maintain the admin account register; enforce hardware token MFA for AWS root and DNS registrar; bring DNS, registrar, and code-signing into SSO where supported, or document as out-of-SSO with compensating MFA; revoke any unjustified cross-entity admin rights. |
| Owner | CTO (admin register), IT Lead (IdP), Head of Platform (AWS / GitHub) |
| Target | 19 Jun 2026 |
Control 4 — Malware protection
Requirement (summary): Every in-scope device must run an active anti-malware solution OR use application allow-listing OR (for some platforms) only install applications from a vendor-approved store. Definitions must be current. The solution must scan files on access, scan web pages on access, and prevent connections to known malicious sites.
| Item | Detail |
|---|---|
| Current state | Windows endpoints: Microsoft Defender for Endpoint, definitions auto-updated, tamper protection on [VERIFY tamper protection]. macOS endpoints: rely on built-in XProtect plus a managed endpoint protection product (e.g. Defender for Endpoint for macOS, or SentinelOne) [VERIFY product, version, and tamper protection across the macOS fleet]. Mobile devices: iOS/Android — relying on platform sandbox plus vendor app store restriction; no third-party AV. |
| Gap | Likely gaps: (1) macOS fleet endpoint protection coverage and tamper protection are the highest-risk verification items — XProtect alone is borderline and assessors increasingly expect a managed product; (2) browser-based web malware blocking (SafeBrowsing/SmartScreen) not centrally enforced via MDM; (3) email malware filtering at the M365/Google tenant level not documented. |
| Evidence needed | MDM compliance report showing endpoint protection installed, running, definitions ≤24h, tamper protection on; screenshot of email gateway anti-malware settings; on-the-day live test where assessor emails an EICAR test file and attempts a web download — both must be blocked. |
| Remediation | Standardise macOS fleet on a single managed EDR/AV product; enforce tamper protection by policy; enforce browser SmartScreen/SafeBrowsing via MDM; document email gateway anti-malware configuration. |
| Owner | IT Lead |
| Target | 20 Jun 2026 |
Control 5 — Security update management
Requirement (summary): All software on in-scope devices must be licensed and supported. High- and critical-severity vendor patches must be applied within 14 days of release. Unsupported software must be removed.
| Item | Detail |
|---|---|
| Current state | OS auto-update enabled on all endpoints via MDM. Browser auto-update enabled. AWS-managed services patched by AWS. Container base images rebuilt on cadence in the production pipeline [VERIFY cadence and CVE-triggered rebuilds]. [VERIFY] that no endpoint runs an out-of-support OS (Windows 10 22H2 reaches end of support 14 Oct 2025 — any remaining Windows 10 endpoints must be on ESU or upgraded to Windows 11). [VERIFY] that no endpoint runs out-of-support macOS (currently anything older than macOS 13 Ventura is risky as of mid-2026). |
| Gap | Likely gaps: (1) one or two laptops on EOL OS versions; (2) Node.js, Python, or other developer runtimes installed locally and out of support; (3) browser extensions out of support; (4) 14-day patch SLA not evidenced by MDM compliance reports — only by policy. |
| Evidence needed | MDM patch-compliance report per device showing OS build, last update date, and 14-day SLA status; software inventory per device; written confirmation from CTO that no unsupported software is in use. |
| Remediation | Run a fleet-wide patch sweep this week; enumerate developer runtimes and update or remove out-of-support versions; produce MDM patch-compliance export for evidence pack; upgrade or retire any Windows 10 / old macOS endpoints. |
| Owner | IT Lead |
| Target | 21 Jun 2026 |
Cross-cutting gap: external attack surface
The CE+ external vulnerability scan tests every IP address declared in scope and every IP the assessor’s recon reveals. Common SME failures are forgotten staging hostnames, deprecated TLS ciphers on a vendor-hosted endpoint, and an exposed admin interface on a legacy subdomain.
| Item | Detail |
|---|---|
| Current state | Production AWS environment fronted by managed load balancer with modern TLS profile. [VERIFY] full enumeration of *.britiai-domain subdomains and any historical IPs still pointing at BritiAI-controlled infrastructure. |
| Gap | Unknown until enumeration is complete. |
| Evidence needed | External attack surface register: every public hostname, every public IP, owner, purpose, in-scope flag. |
| Remediation | Run external recon (DNS enumeration, certificate transparency log search, Shodan lookup) before the assessor does. Decommission anything that should not be live. Fix any TLS or service-version findings. |
| Owner | Head of Platform |
| Target | 22 Jun 2026 (in time for dry-run) |
Summary — items that need real device-level verification before declaration
The following rows are marked [VERIFY] and must be confirmed on real devices and real tenants during the dry-run on 22 Jun 2026 before we declare the corresponding control in the bid or to the assessor:
- macOS Application Firewall enabled on every macOS endpoint (Control 1).
- Disk encryption status on every endpoint (Control 2).
- Screen-lock timeout on every endpoint (Control 2).
- GitHub Organisation-level 2FA enforcement (Controls 2 and 3).
- External sharing policy in M365 / Google Workspace (Control 2).
- Paired standard account in active use for every named admin (Control 3).
- AWS root account MFA on a hardware token (Control 3).
- DNS registrar and code-signing account MFA (Control 3).
- Cross-entity admin rights (Votee/Beever staff in BritiAI tenants) enumerated and removed (Control 3).
- macOS fleet endpoint protection product, version, definitions freshness, and tamper protection (Control 4).
- Email gateway anti-malware test (EICAR delivery blocked) (Control 4).
- Web download malware test (EICAR download blocked) (Control 4).
- 14-day patch SLA evidenced by MDM compliance report, not just policy (Control 5).
- No out-of-support OS on any endpoint (Control 5).
- No out-of-support local developer runtimes (Control 5).
- External attack surface fully enumerated and clean (cross-cutting).
These sixteen items are the dry-run agenda.
End of CE02.