The foundations required for embedding cyber security practices in digital delivery and building resilient digital services.
The following principles must be met by delivery teams with support from security professionals throughout the service lifecycle.
1. Create responsibility for cyber security risk
2. Source secure technology products
3. Adopt a risk-driven approach
4. Design usable security controls
5. Build in detect and respond security
6. Design flexible architectures
7. Minimise the attack surface
8. Defend in depth
9. Embed continuous assurance
10. Make changes securely
As outlined in the Secure by Design policy, these principles are mandatory for government departments and arm's-length bodies (ALBs), and optional for other parts of the public sector. Third party suppliers to these organisations should liaise with their security contacts to understand the specific requirements that apply.
Organisations may introduce additional principles and tailor the recommended activities to meet their specific circumstances, provided they still meet the core principles.
Read the implementation guide for details of how teams can prepare for transition to Secure by Design within the required timescales.
Assign risk owners to be accountable for managing cyber security risks for a service throughout its lifecycle. These must be senior stakeholders with the experience, knowledge and authority to lead on security activities.
Where third-party products are used, perform security due diligence by continually assessing platforms, software and code for security vulnerabilities. Mitigate risks and share findings with suppliers to help them improve product security.
Establish the project’s risk appetite and maintain an assessment of cyber security risks to build protections appropriate to the evolving threat landscape.
Perform regular user research and implement findings into service design to make sure security processes are fit for purpose and easy to understand.
Design for the inevitability of security vulnerabilities and incidents. Integrate appropriate security logging, monitoring, alerting and response capabilities. These must be continually tested and iterated.
Implement digital services and update legacy components to allow for easier integration of new security controls in response to changes in business requirements, cyber threats and vulnerabilities.
Use only the capabilities, software, data and hardware components necessary for a service to mitigate cyber security risks while achieving its intended use.
Create layered controls across a service so it’s harder for attackers to fully compromise the system if a single control fails or is overcome.
Implement continuous security assurance processes to create confidence in the effectiveness of security controls, both at the point of delivery and throughout the operational life of the service.
Embed security into the design, development and deployment processes to ensure that the security impact of changes is considered alongside other factors.
Secure by Design | About | Activities | Implementation
The Secure by Design approach will evolve to reflect the needs of government digital services. Your feedback will help us to improve it.
Last update: 25 March 2024
OFFICIAL