> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/modules/compliance-ce-and-ce+.md).

# Compliance - CE & CE+

### <mark style="color:$primary;">What is it, how do you obtain it, and what to do next?</mark>

Cyber Essentials, also referred to as CE, is a UK government-backed certification that helps protect your organisation against common cyber threats. There are two levels of certification:&#x20;

* Cyber Essentials (basic level)&#x20;
* Cyber Essentials Plus (includes hands-on technical verification)&#x20;

Cyber Essentials Plus, also referred to as CE+, is a government-backed certification that helps your organisation prove it has strong, basic protections against common online threats like viruses, hacking, and phishing.&#x20;

It's part of the UK's Cyber Essentials scheme, but with a higher level of assurance.&#x20;

#### <mark style="color:$primary;">The Difference</mark>

Cyber Essentials is a self-assessment where you confirm your organisation follows good cyber security practices.&#x20;

Cyber Essentials Plus includes everything in Cyber Essentials, plus a hands-on technical check by a qualified assessor.&#x20;

### <mark style="color:$primary;">**Understand the Requirements**</mark>

You can familiarise yourself with some of the key areas covered by Cyber Essentials:

1. **Firewalls -** putting up a security boundary, ensuring only safe and necessary traffic gets in and out of your network.
2. **Secure Configuration -** setting up devices and software securely so there are fewer ways in for an attacker.
3. **Security Update Management -** keeping all software and devices up to date, applying security patches promptly (general expectation to remediate critical/high-risk patches within 14 days of release) so known vulnerabilities can't be exploited.
4. **User Access Control -** making sure only authorised people have accounts, that access rights match job need, and that admin accounts are tightly controlled with multi-factor authentication.
5. **Malware Protection -** using antivirus/anti-malware tools to have up-to-date protection against viruses and other threats.

### <mark style="color:$primary;">What do the Assessments Involve?</mark>

1. **Self-Assessment Review** - This is your Cyber Essentials questionnaire, once completing this you are able to move on to Cyber Essentials Plus.
2. **Vulnerability Scan** - A digital health check for weaknesses on your computers and external interfaces, a range of IASME approved scanners can be used for CE+. If you do not already have one to hand, Qualys is provided for the audit.
3. **Fixing Issues** - If problems are found in your vulnerability scans, you can fix them and still pass.
4. **Remote Audit** - A certified expert checks your systems in real time:&#x20;
   1. Are updates and antivirus in place?
   2. Are firewalls and user permissions set correctly?
   3. Are MFA controls in place?


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybaops.com/modules/compliance-ce-and-ce+.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.