CE Version Explorer

What is your organisation's name?

Name of just one legal entity. Max 150 characters. Trading names permitted. If other legal entities are in scope, answer yes to A1.6.

What is your organisation's registration number?

Primary legal entity only. Max 20 characters. Must correspond to name in A1.1. LTD/LLP/CIC: 8 digits or 6 with 2-letter prefix. GOV/SOL/PRT/SOC/OTH: enter 'none'. No company number: use DUNS number.

What are the two main reasons for applying for certification?

Select the two most important reasons. Do not share bid/project numbers that are protectively marked. Do not share names of customers who contractually require confidentiality.

Is this assessment for your whole organisation or only a part of it?

Whole organisation includes all networks, user accounts and devices accessing organisational data. Partial organisation means some networks are excluded using a firewall or VLAN.

If you are certifying part of your organisation please write a detailed description of the scope here.

Scope description on certificate will say 'Partial Organisation, see certificate platform for details'. Full description available via Blockmark system.

Are the networks included in the scope of this assessment being used at the company locations you provided earlier?

Confirm whether all in-scope networks are used at the locations listed in A1.5.1. If in-scope networks are at other locations, provide the number of additional sites.

How many staff are home or remote workers?

Any employee given permission to work remotely for any period at time of assessment counts as a home/remote worker.

Please provide a list of network equipment that will be in scope for this assessment (including firewalls and routers).

Must include make, model AND quantity. Include all equipment controlling data flow. Exclude switches/WAPs without firewall. Home/remote workers: describe software firewalls in notes. Do not include home environment routers/firewalls. No IP/MAC/serial numbers.

Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.

Include make and OS version. Windows edition and feature version required. Corporate and BYOD. Important: only in-scope devices connecting to cloud services must be included. Out-of-scope device user accounts accessing cloud services must still comply with MFA. Windows 10 beyond 14 October 2025 requires Microsoft ESU.

Please list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.

All servers in scope. Include OS version.

Please list all the cloud services that are in use by your organisation and provided by a third party.

Cloud services cannot be excluded from CE scope. Includes IaaS, PaaS, SaaS. Social media accounts (Facebook, LinkedIn, X) are also cloud services. Definition: on-demand, scalable, hosted on shared infrastructure, accessible via internet, accessed via account, stores or processes data for the organisation.

If you answered no to question A4.1.1, is this because software firewalls are not installed by default as part of the operating system you are using? Please list the operating systems.

Very few OS lack software firewalls. Windows, macOS, common Linux distributions all have them.

Have you reviewed your firewall rules in the last 12 months?

Describe review process. Must remove rules no longer needed.

Is your firewall configured to allow unauthenticated inbound connections?

Most firewalls block by default. Check your settings.

Please describe how you approve and document your allowed inbound connections.

Business case documented, recorded, signed off at board level, risks reviewed regularly.

When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?

A. Throttling (max 10 guesses in 5 min); B. Account lockout after 10 attempts; C. None. If vendor doesn't allow configuration, use vendor default.

Which method do you use to unlock the devices?

PIN of at least 6 characters only if device-unlock only. Brute-force protection required: throttling (max 10 in 5 min) or lockout after 10 attempts.

Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes are applied within 14 days of release?

Describe the manual update process.

Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes?

Must remove software when no longer supported by manufacturer.

Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment?

Unsupported software must be on a sub-set with no internet access. If out-of-scope sub-set remains internet-connected, must select 'Partial Organisation' in A2.1.

Do you ensure that staff only have the access privileges that they need to do their current job? How do you do this?

Principle of least privilege must be applied.

Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?

MFA; throttling (max 10 guesses in 5 min); or lockout after 10 attempts.

Please explain how you encourage people to use unique and strong passwords.

Must support users in choosing strong passwords. No forced expiry. No complexity requirements. Use password managers. Three-random-words approach.

Do all of your cloud services have multi-factor authentication (MFA) available as part of the service?

Cloud service definition: on-demand, scalable, hosted on shared infrastructure, accessible via internet, accessed via account, stores or processes data for the organisation. Where MFA is available, it must be enabled for all users and admins.