DRAFT — REQUIRES REVIEW BY IASME-ACCREDITED CE+ ASSESSOR AND SIGN-OFF BY BRITIAI CTO BEFORE INCLUSION IN BID.
CE05 — NHS SBS Bid Declaration: Cyber Essentials Plus
Use: paste the applicable variant into the information-security questions of the NHS SBS Healthcare AI Solutions Framework (SBS10523) submission, due 12:00 noon, Tuesday 21 July 2026. Choose the variant that matches the factual position on the morning of submission. Do not over-claim. NHS SBS evaluators score candid, evidenced declarations higher than aspirational ones.
Important — what is actually verified, and when. Per the official NHS SBS clarification (Q&A), a bidder is appointed if it holds Cyber Essentials Plus OR can demonstrate equivalent controls, and ISO/IEC 27001 is expressly accepted as the equivalent route. CE+ is not verified at bid submission; it is verified during the certification & accreditation due-diligence window that runs 5 April – 19 May 2027 (via SAP Ariba), ahead of the Framework Start Date of 26 May 2027. This means that at submission BritiAI passes the information-security gate either by (a) holding CE+, or (b) demonstrating equivalent controls evidenced by its in-flight ISO/IEC 27001 programme — and that either route is confirmed at due-diligence in spring 2027, not at the 21 July 2026 submission.
Selection rule:
- Use Variant A only if the IASME-issued Cyber Essentials Plus certificate is in BritiAI’s possession at submission.
- Use Variant B in every other case, including where the assessment has been completed cleanly but the certificate has not yet been issued by IASME, or where BritiAI relies on the ISO/IEC 27001 equivalent-controls route pending verification at the Apr–May 2027 due-diligence stage.
Both variants are written to stand alone in the bid response. Both reference the same underlying evidence pack (CE01–CE04 and the assessor’s report).
Variant A — Certified-by-submission
Cyber Essentials Plus status: Certified.
BritiAI Ltd holds a current Cyber Essentials Plus certificate, issued by IASME on [DD Month 2026] under certificate reference [IASME-CERT-REF]. The certificate is valid for twelve months from the date of issue.
Scope of certification. The certification covers BritiAI Ltd (UK) in whole-organisation scope, including all UK employee endpoints, all BritiAI UK-controlled cloud tenants (Microsoft 365, AWS eu-west-2, GitHub Organisation, identity provider, DNS registrar, code-signing provider), and the UK production environment that delivers BritiAI’s NHS-facing AI services. The subsidiaries Votee Ltd (Hong Kong) and Beever Inc (Toronto) are out of scope and have no routed access into the in-scope environment, consistent with the UK-only deployment topology declared elsewhere in this submission.
What was tested. The independent IASME-accredited assessor verified the five Cyber Essentials technical controls (firewalls; secure configuration; user access control; malware protection; security update management) through five test components: an authenticated vulnerability scan of a representative sample of user endpoints; an authenticated vulnerability scan of in-scope servers; an external vulnerability scan of all in-scope external IP addresses; live email and web malware delivery tests; and a sampled walk-through of MFA enforcement and admin/standard account separation. BritiAI passed all five components.
Maintenance. The controls underpinning certification are maintained as a register with named owners and quarterly review (see internal document CE04). Monthly evidence is collected for patch compliance, MFA status, and endpoint protection coverage. Recertification is diarised for [DD Month 2027].
Evidence available on request. Certificate PDF; assessor’s signed report; controls register (CE04); supporting evidence pack.
Variant B — In-flight at submission
Cyber Essentials Plus status: Assessment completed; certification pending issuance by IASME.
BritiAI Ltd is actively certifying to Cyber Essentials Plus. The independent technical audit was completed by our IASME-accredited assessor on [DD June 2026], with the result confirmed in writing by the assessor on [DD June 2026]. The assessor’s report has been submitted to IASME and the certificate is in the standard IASME issuance window (typically 5–10 working days from a clean assessment). We expect formal certificate issuance on or around [DD Month 2026]. We will share the certificate with NHS SBS within one business day of receipt.
Scope of assessment. The assessment covered BritiAI Ltd (UK) in whole-organisation scope, including all UK employee endpoints, all BritiAI UK-controlled cloud tenants (Microsoft 365, AWS eu-west-2, GitHub Organisation, identity provider, DNS registrar, code-signing provider), and the UK production environment that delivers BritiAI’s NHS-facing AI services. The subsidiaries Votee Ltd (Hong Kong) and Beever Inc (Toronto) are out of scope and have no routed access into the in-scope environment, consistent with the UK-only deployment topology declared elsewhere in this submission.
What was tested. The assessor verified the five Cyber Essentials technical controls (firewalls; secure configuration; user access control; malware protection; security update management) through five test components: an authenticated vulnerability scan of a representative sample of user endpoints; an authenticated vulnerability scan of in-scope servers; an external vulnerability scan of all in-scope external IP addresses; live email and web malware delivery tests; and a sampled walk-through of MFA enforcement and admin/standard account separation.
Credible path to certification. Our readiness, remediation, and dry-run programme is documented in internal documents CE01–CE04 (available on request), with a date-stamped roadmap covering the four weeks preceding assessment. The assessor’s written pass confirmation evidences substantive completion; the remaining step is administrative issuance by IASME.
Equivalent-controls route accepted by NHS SBS. Per the framework’s published clarification, a bidder may be appointed on the basis of CE+ or equivalent controls, with ISO/IEC 27001 expressly accepted as the equivalent route. BritiAI’s in-flight ISO/IEC 27001 programme (see the ISO 27001 declaration) therefore underpins this position independently of CE+ certificate timing. Information-security status is verified at the certification & accreditation due-diligence stage (5 April – 19 May 2027), not at submission.
In the unlikely event of a delay, BritiAI commits to (a) notifying NHS SBS within one business day of any material change to the expected issuance date, and (b) operating to the certified-equivalent controls in the controls register (CE04) throughout the framework engagement. Underlying Cyber Essentials (the foundation tier of the same scheme) is already in place.
Evidence available on request. Assessor’s written pass confirmation; controls register (CE04); supporting evidence pack; CE+ readiness brief (CE01); gap analysis (CE02); remediation roadmap (CE03).
Variant B-alt — Assessment booked but not yet completed at submission
Use only if assessment slips past the 21 July 2026 submission. This is a worse position than Variant B and should be avoided. Included here so the bid team is not improvising under deadline pressure if needed. Note: even in this case, the ISO/IEC 27001 equivalent-controls route remains available and CE+ is only verified at the Apr–May 2027 due-diligence stage.
Cyber Essentials Plus status: Assessment scheduled.
BritiAI Ltd is actively certifying to Cyber Essentials Plus. Our independent IASME-accredited assessor is engaged and the on-site technical audit is scheduled for [DD Month 2026]. We expect formal certificate issuance on or around [DD Month 2026] and will share the certificate with NHS SBS within one business day of receipt.
Scope of assessment. [Same scope wording as Variant B.]
Underlying Cyber Essentials. BritiAI Ltd holds Cyber Essentials (the foundation tier of the same scheme) under certificate reference [IASME-CE-REF], issued [DD Month 2026]. The CE+ assessment verifies the same controls through independent technical testing.
Credible path to certification. Our readiness, remediation, and dry-run programme is documented in internal documents CE01–CE04 (available on request). The controls in the register (CE04) are in operation today; the CE+ assessment confirms them independently.
Commitment. BritiAI commits to (a) notifying NHS SBS within one business day of any material change to the assessment or issuance dates, and (b) operating to the controls register throughout the framework engagement irrespective of certificate timing.
Notes for the bid writer
- Replace every
[…]placeholder with the factual value on the morning of submission. Do not leave placeholders in the submitted text. - Do not include the IASME assessor’s company name in the bid response unless the assessor has agreed in writing to be named.
- Do not attach the assessor’s draft report to the bid; cite its existence and offer it on request. The report contains scoping detail that should be released on a controlled basis.
- Variant B’s “in the unlikely event of a delay” paragraph is deliberate — NHS SBS evaluators look for evidence the bidder has thought about failure modes. Do not delete it.
- The CE+ declaration is read alongside the ISO 27001 declaration elsewhere in the bid. The two must be internally consistent on scope (UK only) and on the Votee/Beever boundary.
End of CE05.