System Card: Cyber Essentials Agent
This system card describes the configuration, safety guardrails, intended uses, and operational limitations of the Cyber Essentials scoping and readiness assistant.
System Overview
The Cyber Essentials Agent is an autonomous scoping and readiness assistant. It operates entirely within the constraints of the official IASME Cyber Essentials questionnaire rules, providing users with actionable, tailored advice on network boundaries, patching, and access control.
Capabilities
- Interactive scoping of network boundaries for CE compliance.
- Real-time gap analysis of submitted hardware and software inventories.
- Automated generation of readiness reports mapping current posture against the 5 core technical controls.
- Dynamic policy template drafting for password policies and bring-your-own-device (BYOD) guidelines.
Intended Uses
The agent is designed to help users scoping out their network boundaries and check their system parameters against the IASME Cyber Essentials questionnaire rules.
It helps clarify which devices need patching, password policy settings, and the required router rules.
Out-of-Scope Limitations
The agent does NOT possess permission to automatically modify system parameters or configure client gateways directly.
It cannot issue official certifications without human validation by IASME-accredited lead assessors.
Safety Guardrails
Strict Knowledge-Base Grounding
The agent is grounded using our IASME-approved Cyber Essentials knowledge base. It is constrained to refuse queries unrelated to cybersecurity compliance.
Sensitive Data Refusal
Strictly rejects inputs containing clear-text passwords, corporate API tokens, credit card details, or sensitive personally identifiable information (PII).
No-Execution Policy
Strictly forbids generating or running commands directly on target client devices. The agent acts solely as a telemetry-gathering advisory guide.
Data Handling
Chat messages are sent to Google Gemini via the Gemini API to generate each answer; the model is given no tools, browsing or memory and receives only the current conversation. Conversation transcripts (the messages exchanged, a random session identifier, the model name and a timestamp, but no IP address or device details) are stored for 30 days for quality and abuse monitoring, then deleted automatically. If you ask for a readiness report, the details you enter and your answers are emailed to you and to our sales team and recorded in our CRM. Nothing you type is used to train models, and the agent asks you not to share passwords, credentials, IP addresses or other secrets.
Human Oversight
While the agent autonomously navigates the scoping phase and gap analysis, all final attestations and certifications are subject to rigorous human review. A certified IASME lead assessor must validate the agent's findings before any official compliance status is granted.
Run the Agent
Launch the agent in your browser to verify your readiness for passing Cyber Essentials