Identity and access¶
Who users are and what they are allowed to do. Getting this right once, centrally, is safer and simpler for everyone.
Doctrine: 2. Standards and guardrails before exceptions, 4. Data is an enterprise asset, 6. Outcomes and services over organisational structures
Principles: 5. Connect and collaborate, 6. Secure today, safe tomorrow
Who these guardrails apply to
The core department. Whether the identity and access guardrails also apply to Defra's arm's length bodies is still to be confirmed.
Technology capability Security & Compliance: customer identity and access, and staff identity and access.
GR-IAM-01 Use the strategic customer identity services¶
Must Services for citizens, farmers and businesses use Defra Customer Identity (Defra ID), which uses GOV.UK One Login and Government Gateway as identity providers, for authentication. Services do not build their own sign-in. See Defra Customer Identity in the Defra Digital Service Manual.
Why: Users get one account across Defra services, we manage relationships between people and organisations (including agents) once, and we avoid storing credentials.
How to meet it: Talk to the Customer Identity team in discovery about the level of identity assurance you need and how the service will represent organisations and agents.
GR-IAM-02 Staff sign in with Microsoft Entra ID¶
Must Staff-facing services and products, including SaaS, use single sign-on through Microsoft Entra ID with multi-factor authentication. No local staff accounts.
Why: Joiners, movers and leavers are handled in one place, and conditional access protects every product.
GR-IAM-03 Authorise on least privilege¶
Must Users, services and pipelines get only the permissions they need, granted through roles or groups, and reviewed regularly.
GR-IAM-04 Separate authentication from authorisation¶
Should Use the identity provider to establish who someone is; keep business authorisation rules (for example "can act for this holding") explicit, testable and in the right service.
GR-IAM-05 No secrets in code¶
Must Secrets, keys and credentials are held in a managed secrets store, rotated, and never committed to source control. Use workload identity in preference to long-lived keys.
How to meet it: Enable secret scanning on every repository (GR-OPEN-03).
GR-IAM-06 Privileged access is controlled and audited¶
Must Production and administrative access is just-in-time, uses phishing-resistant MFA, and is logged to the security operations centre.