What is Secure by Design?
Sign in if you’re a MODNET user
To view more guidance sign in using your mod.gov.uk address – also known as your ‘Digital Identity for Defence (DIfD)’ or ‘MODNET’ account.
If you have any questions contact your line manager or MOD point of contact.
Secure by Design (SbD) is an approach that puts cyber security at the heart of every stage of a capability’s lifecycle.
The Ministry of Defence is implementing Secure by Design in all top-level budgets and arm’s length bodies.
All capabilities and services that handle Defence data must follow Secure by Design. This includes capabilities delivered by suppliers.
It is used throughout government departments to implement and manage cyber security, guided by the Cabinet Office and National Cyber Security Centre.
SbD definitions
Capability
The potential ability to do work, perform a function or mission, achieve an objective, or provide a service.
Programme
A programme is a temporary, flexible organisation that co-ordinates, directs and oversees a set of projects and other related work.
Programmes are required to be registered on the CAAT and may be subject to independent assurance.
Project
A project is a temporary management environment, undertaken in stages, created for the purpose of delivering one or more business products or outcomes.
Projects are required to be registered on the CAAT and may be subject to independent assurance.
System
A collection of different components that work together to produce better results than component parts working independently.
Systems and applications are not required to be registered on the CAAT and will not be subject to independent assurance. However, they may be considered as part of a programme or project assessment.
The MOD Secure by Design approach
By ‘shifting security to the left’ the MOD is designing security into capabilities from the start. So that teams can meet evolving threats, making sure risks are proactively and proportionately mitigated.
Security is no longer a one-time checkbox or isolated activity but is an ongoing, integral part of capability development and operation.
Just like any other business risk, capabilities must continually assess and manage their security risk throughout the Concept Assessment Demonstration Manufacture/Migration In-Service Disposal/Termination (CADMID/T) lifecycle.
One size does not fit all
There are many differences between capabilities, such as operational output, requirements and risks.
Capabilities are different and this should be considered when developing a cyber security strategy.
The Secure by Design approach needs to be applied and adapted to the context, complexity, and criticality of what is being delivered. As such, there is no ‘one size fits all’ approach to Secure by Design.
The selection of cyber security controls should be proportionate depending on the criticality, scale and complexity of your capability.
Too much security can be prohibitively expensive and is usually too difficult to maintain.
Too little security could mean a capability being compromised, with devastating consequences.
Treating cyber security as continual risk management rather than as an obstacle, means a capability can better respond to emerging cyber threats, technology changes and evolving operational requirements.
The UK Government SbD information can be found on GOV.UK.