
Protecting Bulk Personal Data: Introduction
Whether they’re held by public service or private enterprise, these bulk data stores...

Bulk Data: 1-3 What are you protecting?
1. You have a well-defined catalogue of the data your service holds. You...

Digital Services: Building a secure digital service
Just designing a service to be secure is not enough. There will be security implications...

Digital Services: Operating a secure digital service
To remain secure a digital service needs to be well operated and maintained....

Digital Services: Managing cyber security risk in a digital service
Consider security as a factor in all the decisions you make whilst designing, building...

Digital Services: Designing a secure digital service
Good design should: Make services hard to compromise Designing with security in mind...

Design Principles: Designing to avoid disruption
1. Implement denial of service protections as far upstream as possible Denial of service protections...

Digital Services: Understanding your service
Before you can design a secure digital service it's important to understand a...

Design Principles: Introduction
Digital services provide us with quick, convenient access to a whole range of...

Secure sanitisation of storage media
This guidance is suitable for any organisation wishing to ensure that their data held...

Approaching enterprise technology with cyber security in mind
The majority of cyber attacks an organisation faces will be ineffective if enterprise...

End User Devices: Authentication Policy
There are three important parts to authentication that you should consider: User to...

End User Devices: Common Questions
Wi-Fi Captive portals Alternative ways of authenticating to Wi-Fi On-device sandboxing Device...

Cloud Security: Standards and Definitions
Security standards and definitions frequently referenced in our Cloud Security Guidance. Standard Guidance...

Using IPsec to protect data
This guide will help you deploy or buy network encryption, using IPsec. It provides recommendations for the...

Security operations centre (SOC) buyers guide
This guidance is for organisations that are considering procuring a Security Operations Centre (SOC) from...

Vulnerability management
All modern software contains vulnerabilities; either software defects that require patches to remedy, or...

End User Devices: Advice for End Users
This advice will need to be tailored to the particular device(s) being used,...

End User Devices: Security Principles
The EUD Security Framework describes twelve principles for securing devices, all of which must be...

Security governance, enabling sensible risk management decisions & communication
Security governance and business objectives Standard approaches to security and risk management are...

A critical appraisal of risk methods and frameworks
This appraisal has been produced so practitioners and decision makers can better understand...

End User Devices Security Guidance: Introduction
Modern smartphones, laptops and tablets provide users with great flexibility and functionality, and...

EUD Security Guidance: Android 6
This guidance is applicable to Android 6 devices configured in Device Owner mode....

Summary of risk methods and frameworks
This section summarises number of commonly used risk methods and frameworks. Note that:...

Introduction to security governance
What is security governance? Security governance is the means by which you control and direct your organisation’s...

EUD Security Guidance: Windows 10 Mobile
This guidance is applicable to devices running Windows 10 Mobile and was developed...

Cloud Security Principle 9: Secure user management
The aspects to consider are: Authentication of users to management interfaces and support...

Cloud Security Principle 7: Secure development
Goals You should be confident that: New and evolving threats are reviewed and...

Risk management principles
The following security risk management principles are applicable to how people and organisations...

Cloud Security Principle 14: Secure use of the service
The extent of your responsibility will vary depending on the deployment models of...