GovAssure

GovAssure is the new cyber security assurance approach for government that will replace the cyber security element of the Departmental Security Health Check (DSHC) from April 2023.

The GovAssure assurance approach meets the requirements for an objective understanding of government cyber security as set out in the Government Cyber Security Strategy. GovAssure uses the National Cyber Security Centre’s Cyber Assessment Framework (CAF).

Organisations will assess critical systems against one of two target CAF profiles for government, the Baseline or the Enhanced Profile. This will provide organisations and the Security Function with a more effective mechanism to understand the level of cyber resilience across government.

Scope of GovAssure

GovAssure is designed for OFFICIAL systems and does not currently apply to systems processing data classified as SECRET or above. Higher classification systems will be considered at a later date. GovAssure will apply to government sector Critical National Infrastructure (CNI), bringing them under a common assurance process for cyber.

• Start with the GovAssure Overview
• Stage 1: Organisational context and services
  • Part A: Organisational mission, objectives and priorities
  • Part B: Identifying and defining the essential services and determining their categorisation
• Stage 2: In-scope systems and assignment to the Government CAF profile
  • Part A: Identify critical systems that underpin the essential services and functions
  • Part B: Prioritise systems and agree which systems to include in scope for GovAssure
• Stage 3: CAF self-assessment
  • Suggested 10 steps for conducting the self-assessment.
  • CAF Objectives and Components
  • Indicators of Good Practice (IGPs)
  • Using WebCAF for the self-assessment
• Stage 4: Independent assurance review
  • The Assurance Review Process
  • Becoming a GovAssure Independent Assurance Reviewer
  • Stage 4 outcome checklist
  • Peer Review Guidance for Lead Government Departments
  • Conducting a peer review
• Stage 5: Final assessment and targeted improvement plan ('get well plan')
• Templates and Downloads