Enterprise security architecture¶
Security is part of how we design and deliver, not a gate at the end. Enterprise security architecture helps teams build secure services by default and manage risk openly when they cannot.
-
How Defra applies the government Secure by Design approach and its ten principles across the delivery lifecycle.
-
A lightweight, team-led way to find and fix security problems early.
-
What to do when a control cannot be met, and who can accept the risk.
-
The Must and Should controls every Defra service follows.
Who does what¶
| Role | Responsibility |
|---|---|
| Service owner / SRO | Owns the security risk of the service and accepts residual risk within appetite |
| Delivery team | Builds security in: threat models, secure code, scanning, fixing vulnerabilities |
| Security architects | Advise teams, review designs, maintain security patterns and guardrails |
| Security operations centre | Monitors, detects and responds to threats across Defra |
| Senior Information Risk Owner (SIRO) | Owns information risk for the department and accepts risks beyond service owner authority |
| Chief Information Security Officer | Sets security policy and risk appetite |
Standards we align to¶
- Secure by Design - the government approach for digital services
- Secure by Design artefact library - reusable security patterns, blueprints, checklists and threat models from across government
- Government Cyber Security Strategy
- The NCSC Cyber Assessment Framework, assured through GovAssure
- Government security classifications
- NCSC cloud security principles
- OWASP Application Security Verification Standard