to add a new content
Resource
Securing Technology at OFFICIAL

Guidance on how organisations should secure their technology and services to protect UK government information classified as OFFICIAL. 

The vast majority of UK government public services are conducted at the Official classification. Business operations and services include information routinely used that can have damaging consequences if lost or stolen.

Security at Official is achieved through following good commercial practices and understanding security needs and matching these requirements to the latest available technology availabilities. 

Published 01/01/2015
Authoring body: CESG National Technical Authority for Information Assurance
Guidance
Resource
End User Device (EUD) Security Guidance 2

Guidance for organisations deploying a range of end user device platforms as part of a remote working solution.

Modern smartphones, laptops and tablets provide users with great flexibility and functionality, and include security technologies to help protect information and as such this security guidance document is general to all end user devices (EUD) and their deployments to help harness its security capabilities without hindering its functioning ability by ensuring device configuration are set up correctly.

This guidance is to help optimise security functions, allow for greater user responsibility to reduce security complexity, maintaining user experience, logging and audit information and enable greater interoperability of IT systems.

Published 01/01/2018
Authoring body: National Cyber Security Centre (NCSC)
Guidance
Resource
Intelligence Management APP

Intelligence is information collected and gathered for the purpose of taking action. This process is continuous and critical to effective policing operations that allow for tactical options and prioritisation. Such intelligence can sometimes be classified as confidential or sensitive.

A Code of Practice has been issued by the secretary of state to develop a national intelligence model (NIM), which sets out principles and standards for chief officer and police and crime commissioners to adhere. Ensures the results of the standards are systematic for continuous progress and also helps promote compatibility of procedures and terminology for the (NIM) as well as monitor and evaluate the promulgation of good practice.

The code of the practice came into effect in January 2005.

Published 28/05/2019
Authoring body: College of Policing (CoP)
Guidance
Resource
Setup Government Email Services Securely

All public services sending emails out on behalf of government organisations must follow all protocols, processes and guidelines to ensure that they secure their email service. This includes:

  • the service providing users with mailbox access

  • internal relays and gateways

  • email filtering services

  • third party services that send email on your behalf, like transactional email services

Key configurations are needed to ensure you email services run smoothly:

  • Transport Layer Security (TLS)

  • DomainKeys Identified Mail (DKIM)

  • Domain-based Message Authentication, Reporting & Conformance (DMARC)

  • Public Domain Name System (DNS)

  • Ability to make administrative changes

 

If there are any changes made to your email security, ensure that you communicate such changes to all staff in your organisation.

Published 01/01/2020
Authoring body: Government Digital Services (GDS)
Guidance
Resource
Securing Government Email

This guidance applies to all email domains that public sector organisations run on the internet. It also helps ensures that public sector organisations exchanges email securely with other public sector organisations. Protecting emails in transit makes it difficult for domains to be spoofed.

All public sector emails must be kept secure by:

Encryption and authentication only work if both the sender and the recipient use them.

The Government Digital Service recommends protecting email by:

  • forcing TLS when sending to .gov.uk

  • forcing TLS when sending to any other domains that supports it if the local risk profile requires it

  • using extra encryption services if needs be

Published 01/01/2019
Authoring body: Government Digital Service (GDS)
Guidance