Security Policy Framework

The Security Policy Framework (or "SPF") is a set of high-level policies on security, mainly affecting the UK government and its suppliers.[1][2]

The SPF has 70 "mandatory requirements", which are grouped into 7 areas:[3]

1: Governance, Risk Management & Compliance
2: Protective Marking & Asset Control
3: Personnel Security
4: Information Security & Assurance
5: Physical Security
6: Counter-Terrorism
7: Business Continuity

These mandatory requirements are a baseline which apply to all UK government departments; higher requirements may apply in some cases.[4] Public-sector bodies are responsible for managing their own technical security risks, but can draw on expertise and guidelines provided by CESG and the Cabinet Office. The Centre for Protection of National Infrastructure also helps protect critical infrastructure.[5] The Ministry of Defence has its own separate policies and systems.

The SPF superseded the Manual of Protective Security. Part of the SPF is produced by CESG, and part by the Cabinet Office's Security Policy Division.[6]

External links

References

  1. ^ "Government publishes new Security Policy Framework". Agenda Security. http://www.agenda-security.co.uk/security-policy.asp. Retrieved 14 August 2011. 
  2. ^ "Information Assurance Requirements for Transformational Government". CESG. January 2010. http://www.eurim.org.uk/activities/ig/idg/InformationAssuranceRequirements2.pdf. Retrieved 14 August 2011. 
  3. ^ "STREAM for the Security Policy Framework". Acuity Risk Management. http://www.infosec.co.uk/ExhibitorLibrary/526/STREAM_for_Security_Policy_Framework_23.pdf. 
  4. ^ "Only one in five adults trust government to keep their personal details safe". Security Park. 16 June 2009. http://www.securitypark.co.uk/security_article263231.html. 
  5. ^ "Cyber Security Strategy of the United Kingdom". pp. 23. http://www.computerweekly.com/blogs/read-all-about-it/Cabinet%20Office%20Cybersecurity%20review%2009.pdf. Retrieved 14 August 2011. 
  6. ^ "The Department of ‘No’ - The Privacy, Identity & Consent Blog". 17 February 2011. http://www.computerweekly.com/blogs/the-data-trust-blog/2011/02/the-department-of-no.html. Retrieved 14 August 2011.