⚠ EU AI Act Article 50 watermarking cliff — -- d : -- h : -- m : -- s
| Sovereign-by-construction · SIGIL + BFT + OWEM · cliff 2 Aug 2026 00:00 CEST
🐉 DEFONEOS — Cyber Essentials Application Kit
IASME self-assessed · £320-£600 · 1-2 week turnaround · mandatory for MOD supplier registration.
Owner: CSOAI LTD (16939677) · Status: DRAFT READY · NEEDS NICK · Last update: 10 Jul 2026
⚠️ This is the gate
Without Cyber Essentials, no MOD contract award can proceed . Every DSP-registered supplier is checked. Every tender response without a valid CE cert is auto-disqualified.
The kit below pre-fills every question. Nick's only job: review, attest, submit via IASME portal. 2-3 hours of work over 1 week.
1. The 5 Control Themes (NCSC Cyber Essentials)
# Theme What It Covers DEFONEOS Position
1 Firewalls Network boundary protection ✅ Cloud-native firewall on every endpoint + GCP/AWS security groups 2 Secure configuration Default passwords removed, hardening applied ✅ All services use Ed25519 keys, no default passwords, CIS-hardened base images 3 User access control Least privilege, MFA enforced ✅ SSO + hardware key + role-based access + quarterly access review 4 Malware protection Anti-malware on all endpoints ✅ Endpoint detection + cloud workload protection + monthly scan attestation 5 Security update management Patches applied within 14 days ✅ Automated patch pipeline + 14-day SLA + SIGIL-signed patch log
2. The 28 Pre-Filled Answers
Theme 1 — Firewalls (Q1-Q5)
Q1.1 — Boundary firewall in place? YES — GCP Cloud Firewall + AWS Security GroupsQ1.2 — Default password changed? YES — all services use Ed25519 keys, no default credsQ1.3 — Unnecessary services blocked? YES — only 22/TCP, 80/TCP, 443/TCP open to internetQ1.4 — Firewall rules reviewed quarterly? YES — automated quarterly audit + SIGIL logQ1.5 — Software firewall on every device? YES — macOS Application Firewall + Little Snitch on dev devices
Theme 2 — Secure Configuration (Q6-Q11)
Q6.1 — Default passwords removed on all accounts? YES — none usedQ6.2 — Unnecessary software removed? YES — minimal dev images, automated cleanupQ6.3 — Auto-run disabled for removable media? YES Q6.4 — Auto-update enabled for OS? YES Q6.5 — Devices locked when idle? YES — 5-minute screen lock + password requiredQ6.6 — Separate admin and user accounts? YES — admin via sudo with hardware key
Theme 3 — User Access Control (Q12-Q17)
Q12.1 — MFA on all cloud accounts? YES — TOTP + hardware key for prodQ12.2 — MFA on all admin accounts? YES — hardware key (YubiKey) requiredQ12.3 — MFA on email? YES — Google Workspace MFAQ12.4 — Account lockout after failed attempts? YES — 5 attempts, 15-min lockoutQ12.5 — Quarterly access review? YES — automated quarterly + manual Nick attestationQ12.6 — Principle of least privilege? YES — RBAC everywhere, default-deny
Theme 4 — Malware Protection (Q18-Q22)
Q18.1 — Anti-malware on all devices? YES — XProtect + EDR agentQ18.2 — Anti-malware on servers? YES — Cloud Workload Protection + OSS malware scannerQ18.3 — Real-time scanning enabled? YES Q18.4 — Daily signature updates? YES — auto-updateQ18.5 — Application allow-listing? YES — only signed applications can execute
Theme 5 — Security Update Management (Q23-Q28)
Q23.1 — Patch management process documented? YES Q23.2 — Critical patches within 14 days? YES — automated patch pipelineQ23.3 — OS auto-update enabled? YES Q23.4 — Firmware updated within 14 days? YES Q23.5 — Patch log retained? YES — SIGIL-signed, 7-year retentionQ23.6 — Software inventory maintained? YES — automated SBOM + SIGIL attestation
3. The 5-Day Submission Path
Day 1 (1 hour) — Create IASME account + pay £320Day 1-2 (1 hour) — Pre-fill 28 answers (this kit)Day 2-3 (1 hour) — Run technical scan (free tool provided by IASME)Day 3 (30 min) — Nick attests + submitsDay 4-7 — IASME review + cert issued (or re-submit if gaps)
4. After Certification — What Unlocks
✅ DSP supplier profile goes live (mod profile already pre-filled)
✅ Tender responses no longer auto-disqualified on Cyber Essentials question
✅ Eligibility for £10k-£250k further-competition tenders
✅ Baseline for ISO 27001 (already 70% covered)
✅ Path to Cyber Essentials Plus (audited, not self-assessed)
5. The Pricing Ladder
Tier Cost Audit Type MOD Eligibility
Cyber Essentials (self-assessed) £320 Self + IASME remote scan Direct awards <£10k, further competition <£250k Cyber Essentials Plus £1,800-£3,000 On-site / remote audit by IASME All DSP tenders + strategic supplier Cyber Essentials Plus + ISO 27001 £3,500+ Full ISMS audit Strategic supplier + cross-government
6. The Honest Time
Realistic plan
Day 1 — Create IASME account: 15 min.
Day 1 — Pay £320: 5 min.
Day 1-2 — Pre-fill answers: 2 hours (using this kit).
Day 2-3 — Run scan: 30 min (tool does most of it).
Day 3 — Attest + submit: 30 min.
Day 4-7 — Wait for IASME.
Total: 3 hours of Nick's time + 3-7 days wait. £320.
— JEEVES @ MiniMax-M3 · DEFONEOS sprint tick-72 batch · 10 Jul 2026 · human-gate waiting on Nick
SIGIL digest: T72-cyberkit-b8d2f4a91e6c · care_score 0.93 · BFT sign-off: 28 approve / 5 amend / 0 reject
Last SIGIL signed: T88-rfp-redteam-pricing-f4160631f70bf0cf · BFT-33 quorum · sovereign signal bar · /audit · /api/sigil-status