Security
Security guardrails for every Defra service. They put the government Secure by Design approach into practice.
Who these guardrails apply to
The core department. Whether the security guardrails also apply to Defra's arm's length bodies is still to be confirmed .
See also enterprise security architecture , and create a secure service in the Defra Digital Service Manual, which links to the Defra Group Security policies you must follow.
GR-SEC-01 Follow Secure by Design
Must Every new service and significant change follows the Secure by Design activities, with a named risk owner, from discovery onward.
How to meet it: start from the patterns and checklists in the Secure by Design artefact library rather than designing controls from scratch.
Phases, evidence and status for GR-SEC-01 Status Draft Phases Discovery, Alpha, Beta, Live Led by Security architect Evidence Automated check Manual Maps to Service Standard 9 ; Technology Code of Practice 6 ; Secure by Design principles 1 , 3 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-02 Keep a current threat model
Must Each service has a threat model , created by the team in alpha and revisited at every significant change and at least annually.
Phases, evidence and status for GR-SEC-02 Status Draft Phases Alpha, Beta, Live Led by Security architect , Developer Evidence Automated check Manual Maps to Service Standard 9 ; Technology Code of Practice 6 ; Secure by Design principles 3 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-03 Classify information
Must Identify the government security classification and data types the service handles, and design controls to match.
Phases, evidence and status for GR-SEC-03 Status Draft Phases Discovery, Alpha Led by Security architect , Data architect Evidence Automated check Manual Maps to Technology Code of Practice 6 ; Secure by Design principles 3 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-04 Encrypt in transit and at rest
Must Use TLS 1.2 or higher for all traffic, internal and external, and encrypt data at rest using platform-managed or customer-managed keys.
Phases, evidence and status for GR-SEC-04 Status Draft Phases Beta, Live Led by Developer , Security architect Evidence Automated check Manual Maps to Technology Code of Practice 6 ; Secure by Design principles 8 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-05 Scan continuously and fix quickly
Must Run static analysis, dependency, container and infrastructure scanning in the pipeline. Fix critical vulnerabilities within 14 days and high within 30 days, or record a risk decision.
Phases, evidence and status for GR-SEC-05 Status Draft Phases Beta, Live Led by Developer Evidence Automated check Static analysis, dependency, container and infrastructure scanning in the pipeline Maps to Technology Code of Practice 6 ; Secure by Design principles 9 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-06 Test before go-live and after major change
Must Commission an independent IT health check (penetration test) proportionate to risk before go-live and after significant change, and track remediation.
Phases, evidence and status for GR-SEC-06 Status Draft Phases Beta, Live Led by Security architect , Delivery manager Evidence Automated check Manual Maps to Service Standard 9 ; Secure by Design principles 9 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-07 Log for detection and response
Must Send security-relevant events (authentication, authorisation failures, administrative actions, data exports) to the security operations centre. See GR-OPS-01 .
Phases, evidence and status for GR-SEC-07 Status Draft Phases Beta, Live Led by Developer , Security architect Evidence Automated check Manual Maps to Secure by Design principles 5 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-08 Protect the supply chain
Should Assess suppliers and third-party products for security before use, pin and verify dependencies, and know what is in your software (keep a software bill of materials).
Phases, evidence and status for GR-SEC-08 Status Draft Phases Alpha, Beta, Live Led by Security architect , Developer Evidence Automated check Dependency review and software bill of materials generation in the pipeline Maps to Technology Code of Practice 6 ; Secure by Design principles 2 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0 GR-SEC-09 Manage risk explicitly
Must Where a control cannot be met, record the risk and get it accepted by the right owner through the security exception process . Accepted risks are time-limited.
Phases, evidence and status for GR-SEC-09 Status Draft Phases Alpha, Beta, Live Led by Security architect , Product manager Evidence Automated check Manual Maps to Secure by Design principles 1 , 3 DDTS doctrine 2 Owner Enterprise security architecture, last reviewed 2026-10-01, since v0.1.0