Remedion

Cyber Essentials Plus

Make CE Plus easier to achieve—and easier to maintain.

Close the gap between discovery and verified remediation. Probe CE+ controls, lock down apps and USB, manage local admin passwords, track end-of-support platforms, and keep operational evidence ready.

Book a demoSee the platform

What Remedion covers

CE Plus is not a checklist PDF—it is continuous control.

Remedion maps Cyber Essentials+ themes to probe-and-remediate controls, security profiles, application control, vulnerability remediation, encryption, and end-of-support outlook—so readiness is operational every week, not only before the assessor arrives.

CE Hardening policies

Probe and remediate Cyber Essentials+ controls per asset—access control, firewalls, malware protection, secure configuration, and more—with a live compliance score.

Learn more →

Application control & USB

Stop shadow installs and lock down external USB storage unless a specific device is approved—with an auditable request queue.

Learn more →

Vulnerability management

Detect, prioritise, and close findings with repeatable remediation jobs so assessment blockers do not pile up between reviews.

Learn more →

EOS / EOL versions

End-of-support outlook for Windows, Linux, FortiOS, Cisco IOS XE, NX-OS, Meraki, and Dell hardware—matched from live asset inventory.

Learn more →

Local admin & LAPS-style escrow

Create a unique break-glass local admin, disable the shared built-in Administrator, escrow the password encrypted at rest, and rotate on a schedule.

Learn more →

Disk encryption & keys

BitLocker / LUKS status plus recovery-key escrow so helpdesk can recover machines without sticky notes or unmanaged spreadsheets.

Learn more →

CE Hardening themes

Policies aligned to Cyber Essentials+ asset themes.

On each Windows asset, CE Hardening probes controls grouped by theme. Where remediate is supported, IT can apply the change from the portal—and keep an audit trail for evidence.

Access control

  • Unique managed local admin (LAPS-style) with encrypted password escrow
  • Disable built-in Administrator and Guest accounts
  • Password policy baseline and screen lock
  • UAC elevation for installs
  • End-user caller verification and secure AD password reset

Firewalls

  • Host firewall enabled and monitored
  • RDP and remote access hardening controls

Malware protection

  • Defender or equivalent (e.g. CrowdStrike) active in Security Center
  • Optional EICAR / behavioral checks for validation
  • SmartScreen and related malware-facing settings

Secure configuration

  • BitLocker with recovery-key escrow
  • SMBv1 off, SMB signing, LM hash / NTLMv1 controls
  • AutoPlay, AppData exe block, installer restrictions
  • Security profiles for fleet-wide Windows baselines

Patch management

  • Missing Windows updates visibility and remediation jobs
  • Automatic updates posture on endpoints
  • Network firmware currency for FortiOS, IOS XE, and NX-OS

Application security

  • Application control policies for installers and run blocking
  • USB storage lockdown with per-device approvals
  • Approved software lists and exception workflows

Local admin & LAPS-style management

Unique break-glass accounts—not shared Administrator passwords.

Remedion can create a unique managed local administrator on Windows endpoints, disable the built-in Administrator account, encrypt and escrow the password in the portal, and rotate it on a schedule—so support keeps a break-glass path without recycling the same local admin secret across the estate.

  • Strong random password generated on the endpoint
  • Password escrowed encrypted at rest (reveal is permissioned)
  • Optional automatic rotation on a configurable interval
  • Works alongside CE Hardening access-control probes

Managed local admin · QUAD-WIN11-042

LAPS-style escrow · auto-rotate every 30 days

Account
RemedionAdmin
Built-in Administrator
Disabled
Password escrow
Stored · last4 ••••A7F2
Last rotated
12 Jul 2026
Next rotation
11 Aug 2026
CE+ theme
Access control

End of support / end of life

Out-of-support platforms become CE Plus and insurance risk.

Asset EOL outlook matches vendor lifecycle dates to the inventory Remedion already holds—so you see expired, urgent, and upcoming end-of-support before an assessment or insurer questionnaire forces the issue.

Microsoft Windows / Server

Lifecycle end-of-support dates

Ubuntu & RHEL

Linux release support windows

FortiOS

Firewall OS trains

Cisco IOS XE

Catalyst / IOS-XE trains (17.9–17.18)

Cisco NX-OS

Nexus trains including 10.4–10.6

Dell PowerEdge

Hardware service-life outlook

See Asset EOL outlook

Cyber Essentials Plus

Make Cyber Essentials Plus easier to achieve and easier to maintain.

Remedion helps teams close the gap between vulnerability discovery and verified remediation, reducing the operational burden of preparing for CE Plus assessments.

Continuous readiness

  • Close the gap between discovery and verified remediation
  • Reduce last-minute assessment preparation
  • Maintain posture between formal CE Plus reviews
  • Support evidence collection with operational records
  • Apply consistent controls across servers and workstations

Map Remedion to your next CE Plus assessment

Walk through the portal with our team and map Remedion to your estate.

Book a demo