Sector: central government
For departments that can't outsource the accountability.
Departments, agencies and arm's-length bodies. GovAssure, the CAF and Secure by Design, delivered by people who've worked on the inside.
The risk carries a named owner.
In central government, cyber risk sits with named individuals: a senior responsible owner on each programme, an accounting officer above them. And GovAssure has changed what holding that risk means in practice: departments are now assessed against the NCSC Cyber Assessment Framework, and the review looks for evidence of outcomes where it once accepted a statement of policy.
That evidence has to come from a real estate. Most departments run legacy systems that have carried services for decades and can’t simply be replaced, while their programmes are expected to follow the government’s Secure by Design approach under sustained pressure to deliver. Add a supplier-heavy model, where much of the build and run sits with third parties, and a department can hold all of the accountability while holding very little of the day-to-day control.
Under GovAssure, assurance means evidence an assessor can test.
Where the pressure shows
- A GovAssure review is on the calendar, and the evidence behind the self-assessment is thin.
- A legacy system everyone depends on, that nobody quite owns.
- Secure by Design expectations arriving in the middle of a programme that was planned without them.
- Security assurance spread across suppliers, with no single view of where the risk sits.
- An SRO who carries the risk on paper, without the security fluency to challenge what they’re told.
How we help
Secure by Design applied to real programmes: clear boundaries around legacy estates, and designs that stand up when the assurance questions arrive.
TransformationCAF and GovAssure readiness delivered as operating change, so the evidence exists because the department genuinely works that way.
Security training and awarenessRole-specific awareness for delivery teams and senior owners: enough fluency for an SRO to ask the right questions and weigh the answers.
The rules that apply to you
The Cyber Assessment Framework sits at the heart of GovAssure: the outcome-based principles your department will be assessed against, read the way an assessor reads them.
NIS2Where UK bodies interact with EU-regulated operations: shared services, cross-border functions and suppliers that fall inside NIS2's scope.
Steering a transformationHow a multi-year cyber transformation inside a UK department is scoped, governed and reported. Anonymised, but the way of working isn't.