Cyber Essentials Documentation

Every Sovereign AI deployment is built against the NCSC Cyber Essentials control set. The table below summarises how each theme is implemented on the appliance, container and rack tiers, and what documentation your assessor receives.

1. Firewalls and boundary defence

Appliances ship with egress denied by default — a deployment only reaches the internet if you explicitly whitelist a destination. Cloud containers sit behind a dedicated security group with no inbound rules other than your VPN range. We provide the rule export as evidence.

2. Secure configuration

Images are built from a minimal, signed base with unused services removed, disk encryption enabled and default credentials impossible (no shared admin account exists). Hardening checklists are supplied per tier.

3. User access control

Administrative access requires named accounts with multi-factor authentication and is logged to an append-only local audit trail. Role-based access controls separate operators from end users.

4. Malware protection

Model artefacts and container images are hash-verified before load. The inference stack accepts no arbitrary code execution from prompts, and shell access is disabled outside a break-glass procedure.

5. Security update management

Security patches are published monthly and within 14 days of a critical advisory. Patching is performed by us on cloud and rack tiers, and by your team or under a support plan on appliances. A patch register is available on request.

Evidence pack

• Architecture and data-flow diagrams for your deployment
• Sub-processor register with UK data residency confirmation
• Hardening checklist and firewall rule export
• DPIA input template mapped to UK-GDPR articles

Request the pack under NDA at audit@sovereignai.adem.io.