Guide to adopting Secure by Design – Preparation

Assign accountability for Secure by Design to senior leaders

The Chief Digital and Information Officers (CDIOs), or equivalent, who lead on digital strategy and delivery should be accountable for the adoption of the Secure by Design approach across the organisation.

Collaborating with the organisation’s Chief Information Security Officers (CISOs), Chief Technology Officers (CTOs) and the Senior Responsible Officers (SROs) and service owners on project teams, they will:

• ensure the organisation meets the Secure by Design policy
• ensure project delivery teams meet the Secure by Design principles
• raise awareness and promote the benefits of Secure by Design among executive committees and senior leadership teams
• establish Secure by Design as a shared responsibility between digital, technology and security
• help teams understand their roles and responsibilities related to Secure by Design
• sponsor the required changes for integrating Secure by Design across the organisation

Appoint a Secure by Design champion

Having a champion who works with stakeholders across your organisation will provide the momentum required to drive the adoption of Secure by Design.

The champion does not necessarily need to be a cyber security expert, but they should have a good understanding of the Secure by Design approach and be able to effectively communicate this to others.

They will need to:

• be a central point of contact with the Central Digital and Data Office (CDDO) team
• promote the importance of Secure by Design within their organisation and generate support from others
• establish and run a Secure by Design working group
• produce a Secure by Design transition plan
• report progress towards milestones to senior leaders and internal governance forums

Establish an internal Secure by Design working group

A working group formed of representatives from teams affected by the Secure by Design approach (such as digital and data, project delivery, cyber security, risk management, assurance and commercial) is an essential part of adopting Secure by Design across an organisation.

Your champion should lead this initiative, organising the programme of activity and ensuring the necessary leadership and resources are available to facilitate progress.

The group will help to:

• encourage collaboration and knowledge sharing among stakeholders from various workstreams
• create alignment between Secure by Design and organisational goals
• establish accountability by defining roles and responsibilities for implementing Secure by Design best practice
• monitor progress towards milestones
• address any issues that arise during the implementation phases

Produce a Secure by Design engagement plan

A fundamental objective of Secure by Design is to make cyber security everyone’s collective responsibility.

The example RACI matrix outlines which roles could be involved in Secure by Design activities throughout the digital delivery lifecycle, but your whole organisation should be encouraged to understand the principles of cyber security.

Organisations should work to assess current levels of knowledge within their teams and use appropriate communication channels (such as onboarding material, messaging groups and internal newsletters) to increase awareness and understanding.

Understand your organisation’s current Secure by Design state

It’s crucial to understand the cyber security practises your organisation currently has in place to help guide and support the security efforts of teams delivering digital services. A common approach to core security activities (such as determining risk appetites, threat modelling, and technical risk assessments) will allow delivery teams to produce consistent outputs more efficiently.

Produce a readiness assessment by conducting a lightweight review of your existing cyber security capabilities against the Secure by Design principles and activities. Organisations that fall within the scope of GovAssure can use evidence already collected as part of that process to complete this review. This aim of this activity is to identify necessary improvements and establish associated timelines, which can then be integrated into your transition plan.

Produce a transition plan

Organisations need to outline the steps necessary to move from their current state to achieving all the requirements of Secure by Design. A detailed roadmap will help to ensure this transition is managed effectively and efficiently.

Each organisation’s plan will be different depending on the areas identified as requiring improvement in their preparation checklist. The following headings could provide a useful structure for producing a clear and actionable plan:

• Relevant stakeholders and their roles
• Elements in scope of Secure by Design
• Goals, objectives and milestones
• Specific tasks and timelines
• Resource allocation

Regular progress reports should be communicated with the organisation so teams can be confident that milestones are being met and issues can be addressed as they arise.

Update your internal policies and processes with Secure by Design requirements

Ways of working across your organisation need to be updated to reflect the Secure by Design policy.

This may include digital standards, network access policies, data policies, hardware policies, governance structures, and any other process used by teams that have cyber security implications.

Champions should work with their organisation’s project management office to ensure Secure by Design requirements are referenced within assurance criteria, guidance and templates used across the delivery of digital services.

Agree pilot projects for trialling Secure by Design

Your transition plan should be tested in a real-world scenario before applying it across all in-scope projects.

This will allow you to gather data and feedback from those involved to help you:

• see if the processes you have planned are effective
• check that your resource assumptions are correct
• monitor whether the appropriate responsibilities have been assigned to leadership and delivery roles

The Secure by Design policy applies to new services and significant changes to services that fall into scope of the digital and technology spend controls approval process. Projects that meet this criteria are good candidates to use for testing.