Cyber and Technical Security Guidance

Summary

This site documents some of the security decisions that the Ministry of Justice (MoJ) has made for the products we operate, and our relationships with suppliers.

The MoJ Technical Guidance covers technical decisions in the MoJ more widely.

Note: This guidance is dated: 22 September 2022.

Popular links

Popular links for all users:

• Security threat level and emergency procedures
• Overseas travel and accessing MoJ IT systems from overseas
• General app guidance
• Minimum User Clearance Requirements Guide
• Government classification scheme
• Remote Working

Change log

A ‘change log’ is available. It details the most recent changes to this information.

The changes are also available as RSS or Atom feeds.

Offline content

For convenience, offline versions of this guidance are available.

The offline versions of this guidance are time-limited, and are not valid after 22 October 2022.

Security culture

In addition to the obvious security resources such as policies, controls, and software and hardware tools, all organisations need employees, suppliers and other colleagues to behave in a way that helps ensure good security at all times. A simple example is where someone will act in a way that maintains good security, even if they don’t know exactly what the formal process is. The extent to which an organisation has good security in indicated by its security culture.

Security culture refers to the set of values, shared by everyone in an organisation, that determines how people are expected to think about and approach security. Getting security culture right helps develop a security conscious workforce, and promotes the desired security behaviours expected from everyone working in or for the organisation.​

The MoJ is creating a portfolio of security culture resources to help supplement the formal policy and guidance material. Initial security culture material is available for preview here.

Getting in touch

• To report an incident.
• For general assistance on MoJ security matters, email security@justice.gov.uk.
• For Cyber Security assistance or consulting, email security@justice.gov.uk. More information about the Security Team is available.
• Suppliers to the MoJ should first communicate with their usual MoJ points of contact.

Background

Government Functional Standard - GovS 007: Security replaces the HMG Security Policy Framework (SPF). The policies which sit within that framework remain in effect, but are now in support of this standard.

Sections 6.3 Cyber security and 6.4 Technical security of the standard state:

• The purpose of cyber security is to ensure the security of data and information. To operate effectively, the UK government needs to maintain the confidentiality, integrity and availability of its information, systems and infrastructure, and the services it provides.

• The purpose of technical security measures is to holistically protect sensitive information and technology from close access acquisition or exploitation by hostile actors, as well as any other form of technical manipulation. Technical security also relates to the protection of security systems from compromise and/or external interference.

Information structure

The MoJ has developed our cyber and technical security taxonomy as follows:

The documents have been developed and defined within this taxonomy, and are listed in the next section, together with their suggested target audiences.

Information security policies

Management direction for information security

Mobile devices and teleworking

Mobile device policy

Teleworking

Human resource security

Prior to employment

During employment

Termination and change of employment

Asset management

Responsibility for assets

Information classification

Media handling

Access control

Business requirements of access control

User access management

User responsibilities

System and application access control

Cryptography

Cryptographic controls

Physical and environmental security

Secure areas

Equipment

Operations security

Operational procedures and responsibilities

Protection from malware

Backup

Logging and monitoring

Control of operational software

Technical vulnerability management

Communications security

Network security management

Information transfer

System acquisition, development and maintenance

Security requirements of information systems

Security in development and support processes

Test data

Supplier relationships

Information security in supplier relationships

Supplier service delivery management

Information security incident management

Management of information security incidents and lost devices

Information security aspects of business continuity management

Information security continuity

Compliance

Compliance with legal and contractual requirements

Information security reviews

Risk Assessment

Risk Management

Risk Assessment Process

Other Guidance

The Government Functional Standard - GovS 007: Security provides the base material for all security guidance in the MoJ.

Glossary

A glossary of some terms used in this guidance is available here.

Acronyms

A more extensive list of acronyms is available here.

Technical Guidance

The MoJ Technical Guidance should be read together with this security-focused guidance.

Feedback

If you have any questions or comments about this guidance, such as suggestions for improvements, please contact: itpolicycontent@digital.justice.gov.uk.