About Secure by Design

The approach emphasises that everyone involved in the development of new systems and services should take cyber security risks seriously, and collaborate so that risks are identified and managed effectively.

Secure by Design’s core elements include its policy, principles and activities. The Cyber Security Standard requires all organisations delivering new digital services and technical infrastructure to meet the 10 Secure by Design principles.

To support these principles, Secure by Design provides:

• risk-driven activities for building appropriate and proportionate cyber security controls within digital services
• clarity on roles and responsibilities to continuously manage security risks and improve security culture

Introduction to Secure by Design

How organisations show they’re implementing Secure by Design

While Secure by Design is not an assurance process, one of its principles is to continuously deliver effective security controls throughout the life of a service.

Delivery teams should complete a self assessment as evidence they’re meeting the Secure by Design principles.

Secure by Design’s wider context

Secure by Design is a strategic priority that is included as outcome 9 in the Government Cyber Action Plan. It’s a core requirement of the government Cyber Security Standard and was part of the transforming for a digital future roadmap: 2022 to 2025.

The Secure by Design policy has been developed by the Government Cyber Unit (GCU), which is part of the Department for Digital, Culture, Media and Sport (DCMS), and a cross-government working group in collaboration with:

• the Government Security Group (GSG)
• the National Cyber Security Centre (NCSC)
• industry experts

The Service Standard Point 9 (Create a secure service which protects users’ privacy) advises service teams that they must follow the Secure by Design principles.

The Service Manual, which helps teams meet the Service Standard, also includes Secure by Design as an essential part of designing quality services.

Secure by Design for the defence industry

The Ministry of Defence (MoD) offers advice on how delivery teams and suppliers working on its systems and services can design for security from the start.

The MoD approach to Secure by Design shares the cross-government objective of making security an integral part of service design through effective risk management, collaboration and continuous improvement. This has been mapped to its specific environment and project management life cycle.

Further information

For more about Secure by Design:

• review the implementation guide for details of how teams can prepare for transition to Secure by Design within the required timescales
• browse questions about Secure by Design for answers to some common queries
• look at case studies to see how organisations have implemented and benefitted from the approach