DRAFT — REQUIRES REVIEW BY IASME-ACCREDITED CE+ ASSESSOR AND SIGN-OFF BY BRITIAI CTO BEFORE INCLUSION IN BID.
CE03 — CE+ Remediation Roadmap
Window: Mon 15 Jun 2026 → assessment day on/around Fri 26 Jun 2026. Post-assessment: certification expected to issue within 5–10 working days of a clean pass. Bid deadline: 12:00 noon, Tue 21 Jul 2026. Note on verification timing: CE+ is not verified at bid submission. Per the NHS SBS Q&A, a bidder is appointed on CE+ or equivalent controls (ISO/IEC 27001 expressly accepted as the equivalent route), and information-security status is verified at the certification & accreditation due-diligence stage running 5 Apr – 19 May 2027, ahead of the Framework Start Date of 26 May 2027. Document owner: BritiAI CTO.
Operating principles for the roadmap
- Every day has a named owner. Slippage is escalated to CTO same day.
- Every remediation generates an evidence artefact filed in
/04_CEPlus/evidence/with a stable filename pattern:YYYYMMDD_<control>_<artefact>.{png|pdf|csv}. - The dry-run on Mon 22 Jun 2026 is treated as a real assessment. Any item that would fail the dry-run is fixed before assessment day.
- No new software, no new admin grants, and no scope changes are made between dry-run and assessment.
Week 1 — Preparation and remediation (Mon 15 Jun → Sun 21 Jun)
Mon 15 Jun
- Confirm CE+ scope in writing with assessor: BritiAI UK only; Votee/Beever out of scope. Owner: CTO.
- Stand up
/04_CEPlus/evidence/folder and naming convention. Owner: IT Lead. - Issue this roadmap to all in-scope staff with a request to defer non-urgent software installs until after 26 Jun. Owner: CTO.
- Begin asset inventory export from MDM: device, user, OS, build, last check-in. Owner: IT Lead.
Evidence produced: scope letter to assessor; asset inventory CSV v1.
Tue 16 Jun
- Complete asset inventory; reconcile against HR headcount to find unmanaged devices. Owner: IT Lead.
- Enumerate every cloud tenant and SaaS app in use, with admin owners and MFA status. Owner: IT Lead + Head of Platform.
- Begin admin account register (Control 3): named admins, paired standard accounts, cross-entity flag. Owner: CTO.
Evidence produced: cloud tenant register; admin account register v1.
Wed 17 Jun
- Enforce GitHub Organisation-level 2FA. Owner: Head of Platform.
- Audit GitHub Org membership; remove ex-staff and unjustified cross-entity members. Owner: Head of Platform.
- Confirm AWS root MFA is on a hardware token; if not, fix today. Owner: Head of Platform.
- Confirm DNS registrar and code-signing accounts have MFA. Owner: Head of Platform.
Evidence produced: GitHub Org 2FA enforcement screenshot; AWS IAM credential report; registrar and code-signing MFA screenshots.
Thu 18 Jun
- Push hardened MDM baseline profile to all endpoints: host firewall on, disk encryption on, screen-lock ≤15 min, auto-run off. Owner: IT Lead.
- Confirm macOS Application Firewall is on across the macOS fleet. Owner: IT Lead.
- Standardise macOS endpoint protection product across the fleet; enable tamper protection. Owner: IT Lead.
Evidence produced: MDM baseline profile export; MDM compliance report v1.
Fri 19 Jun
- Fleet-wide patch sweep. Reboot any device with a pending update. Owner: IT Lead.
- Enumerate local developer runtimes (Node.js, Python, JDK, etc.) on engineering laptops; update or remove out-of-support versions. Owner: Head of Platform.
- Verify no in-scope endpoint runs an out-of-support OS. Upgrade or retire any that do. Owner: IT Lead.
- Restrict external sharing in M365 / Google Workspace to allow-listed domains. Owner: IT Lead.
Evidence produced: MDM patch-compliance report; developer-runtime audit CSV; M365/Google external sharing policy screenshot.
Sat 20 Jun
- External attack surface enumeration: DNS sweep, certificate transparency log search, Shodan lookup against BritiAI-owned IP ranges and domains. Owner: Head of Platform.
- Decommission any stale subdomains, staging hosts, or legacy IPs. Owner: Head of Platform.
- Produce inbound services register for the production VPC: every AWS security group ingress with port, source, justification. Owner: Head of Platform.
Evidence produced: external attack surface register; inbound services register.
Sun 21 Jun
- Cross-entity admin sweep: enumerate any Votee or Beever staff accounts in BritiAI cloud tenants; revoke any unjustified rights. Owner: CTO.
- Confirm break-glass account exists and is sealed with documented procedure. Owner: CTO.
- Final asset inventory reconciliation; lock the in-scope device list for the assessor. Owner: IT Lead.
Evidence produced: cross-entity admin sweep memo; break-glass procedure document; final in-scope device list.
Week 2 — Dry-run, assessment, certification (Mon 22 Jun → Sun 28 Jun)
Mon 22 Jun — Dry-run day
Treat this as a full rehearsal. Walk through every item on the verification list in CE02:
- Sample 3–5 devices across OS mix; confirm host firewall, disk encryption, screen lock, endpoint protection, definitions freshness, patch state, no out-of-support software.
- Live EICAR test via email and web download. Both must be blocked. If either fails, fix today.
- Walk through admin account separation with a named admin: log in to standard account, attempt admin action, confirm step-up to admin account is required.
- Run authenticated vulnerability scan against the sample devices using the same tool the assessor will use, or an equivalent. Triage findings against the 14-day SLA.
- Run external vulnerability scan against the locked external attack surface register. Triage and fix any high/critical findings.
Owner: CTO chairs; IT Lead and Head of Platform execute.
Evidence produced: dry-run report; remediation log for any items found.
Tue 23 Jun — Fix day
Resolve every dry-run finding. Re-test the items that failed. No new changes outside the remediation list.
Owner: IT Lead, Head of Platform. CTO sign-off at EOD that the estate is assessment-ready.
Wed 24 Jun — Quiet day
Freeze configuration changes. Run one final MDM compliance report. Distribute joining instructions to staff whose devices will be sampled (do not power off, do not run updates that morning, be available for the assessor’s screen-share).
Thu 25 Jun — Assessment day (subject to assessor scheduling within w/c 23 Jun)
- Assessor performs the five test components: internal authenticated vuln scan on sampled devices, internal authenticated scan on in-scope servers, external scan on declared IPs, malware delivery tests, MFA and admin separation walk-through.
- CTO and IT Lead present throughout. No remote troubleshooting on uninvolved devices during the audit window.
Evidence produced: assessor’s interim findings note (if any); assessor’s pass/fail confirmation email.
Fri 26 Jun — Buffer day
Reserve for any same-week assessor re-test or follow-up evidence requests.
Mon 29 Jun → Fri 3 Jul — Certification window
- Assessor submits report to IASME. Typical issuance is 5–10 working days from a clean pass.
- CTO chases assessor mid-week if certificate not received by Wed 1 Jul.
- If certificate issues before the 21 Jul submission, the bid uses the certified-by-submission declaration variant (CE05a).
- If certificate has not yet issued, the bid uses the in-flight-at-submission declaration variant (CE05b), citing the assessor’s pass email as evidence of substantive completion.
Contingency: if the assessment is not clean
IASME permits a re-test within (typically) 30 days of the original assessment without restarting the engagement. If the assessment on 25 Jun reveals failures we cannot remediate same-week:
- CTO informs the bid lead within 24 hours of the assessor’s findings.
- Remediation plan with named owners and dates is produced within 48 hours.
- Re-test is scheduled at the earliest assessor availability — typically inside the 30-day window.
- Bid declaration (CE05b) is updated to reflect the honest position: “assessment completed [date], findings under remediation, re-test scheduled [date], certification expected [date].”
This is materially better in NHS SBS scoring than a silent omission or an over-claimed status.
Post-certification (after issuance)
- File the certificate in
/04_CEPlus/evidence/and circulate to bid lead within 24 hours. - Update bid declaration to certified variant.
- Diarise CE+ recertification 12 months from issuance.
- Move maintenance into BAU: monthly MDM compliance review; quarterly admin account register review; quarterly external attack surface review.
Roadmap summary table
| Date | Headline activity | Owner |
|---|---|---|
| Mon 15 Jun | Scope confirmed; evidence folder live; asset inventory begins | CTO / IT Lead |
| Tue 16 Jun | Cloud tenant register; admin account register v1 | IT Lead / CTO |
| Wed 17 Jun | GitHub Org 2FA; AWS root MFA; registrar MFA | Head of Platform |
| Thu 18 Jun | MDM baseline pushed; macOS firewall + EDR confirmed | IT Lead |
| Fri 19 Jun | Fleet patch sweep; runtime audit; OS support audit; sharing policy | IT Lead / Head of Platform |
| Sat 20 Jun | External attack surface enumerated and trimmed | Head of Platform |
| Sun 21 Jun | Cross-entity admin sweep; break-glass; device list locked | CTO / IT Lead |
| Mon 22 Jun | Dry-run | CTO chairs |
| Tue 23 Jun | Fix dry-run findings | IT Lead / Head of Platform |
| Wed 24 Jun | Freeze and final compliance report | IT Lead |
| Thu 25 Jun | Assessment | Assessor + CTO |
| Fri 26 Jun | Buffer / re-test if needed | All |
| 29 Jun → 3 Jul | Certificate issuance window | Assessor / IASME |
| 21 Jul | Bid submission (12:00 noon deadline) | Bid Lead |
End of CE03.