Search - National Standard Microsite
Robotic Process Automation Cyber Security Guidance
This guidance describes best practice cyber risk management controls for using Robotic Process Automation (RPA)
for the purpose of automating manual administrative overheads for National Policing Forces and
applications. This document only provides guidelines to automating manual processes and is not intended for machine
learning (ML) or artificial intelligence (AI) derived solutions. Please refer to separate guidelines and standards
for Digital Process Automation (DPA), AI and ML related activities.
Safe deployment of TikTok
This guidance provides an overview of approaches to deploy TikTok safely
National Police Information Security Risk Management Risk Balance Case Template
The National Policing Information Security Risk Management Framework provides the foundations of risk management across policing in line with the Police Cyber Assurance Framework (PCAF).
This template must be completed in conjunction with the National Security Risk Management Framework and Guidance.
The Risk Decision Document should be a single document that outlines any national risk, and the recommended measures for mitigating it. The template is organised into sections, each containing specific guidance points on content to be included.
National Police Information Security Risk Management Guidance
The National Policing Information Security Risk Management Framework provides the foundations of risk management across policing in line with the Police Cyber Assurance Framework (PCAF). This guidance supports the risk management framework by detailing the actions required to firstly assess a risk, and then to manage it via the national risk register. This guide must be read in conjunction with the National Security Risk Management Framework.
National Police Information Security Risk Management Framework
This framework is to ensure that all security risks are identified, assessed, and managed in accordance with best practice in order to facilitate improved governance. It is mandatory for all information systems that hold Police information or which deliver an operational service to policing to undergo a risk assessment, as stipulated in the National Policing Community Security Policy. The Security Risk Management Framework mutually supports the Police Cyber Assurance Framework (PCAF). The framework supports the requirements of the National Community Security Policy (NCSP.)
POLE Data Standards Catalogue v1.0
The intended purpose of this standard is to promote interoperability and improve the data quality of systems by converging on a common set of POLE data definitions used within Policing. POLE data definitions describe how People, Objects, Locations and Events (POLE) should be formatted.
There are 44 POLE entities described in this standard including:
- 20 person entities
- 13 object entities
- 5 location entities
- 6 event entities
The standard defines the attributes (field size, format, type) used to create the entities and contains and “entity x attribute map”. It also contains validation rules for these attributes.
This standard is owned by the National Police Chiefs Council (NPCC) and should be regarded as the default data standard for all POLE entities.
Along with the standard, the POLE data model (POLE v1.1.accdb) and data dictionary (POLE data standards - Data dictionary v1.1.xlsx) are also attached below.
IDENTITY AND ACCESS MANAGEMENT STANDARD
This standard defines the requirements which, when applied, will define identity and access management
standards to national policing IT systems. Areas considered include account management, access control
mechanism, privilege access, account provisioning, account review, access suspension and termination,
guest accounts, third party access and audit requirements.
This standard adheres to the National Policing Community Security Policy Framework and is a suitable
reference for community members, notably those who build and implement IT systems on behalf of
national policing.
This standard also relates to other PDS standards such as passwords, system access, PAM, vetting, which
the audience should also consider
Bluetooth Guidance V1.0
This guidance provides policing and law enforcement organisations with relevant information regarding risks associated with deploying Bluetooth technology within the workplace, and to enhance the risk-based decisions required in the use of such technology. This guidance adheres to the National Policing Community Security Policy Framework and is a suitable reference for community members, notably those who build and implement IT systems on behalf of national policing.
Cryptography Standard v 1.0
The purpose of this standard is to establish a set of cryptographic algorithms and protocols for use in specific applications for the transmission and storage of Police Data up to the classification of OFFICIAL. The requirements are the minimum acceptable levels of encryption and are aligned to the NIST and NCSC frameworks and are applicable to cloud environment, on premises environments and the data networks that interconnect them.
Third Party Assurance for Policing (TPAP)
This Standard is to ensure that all third party suppliers are examined to fully understand their overall security posture and how that may impact upon Policing, ensure they fully understand the responsibilities they have in looking after policing data, that elements such as the importance of vetting and the cyber security of their systems is understood and they are aware of the requirements when handling and communicating that data.