
Security governance, enabling sensible risk management decisions & communication
Security governance and business objectives Standard approaches to security and risk management are...

Secure sanitisation of storage media
This guidance is suitable for any organisation wishing to ensure that their data held...

Approaching enterprise technology with cyber security in mind
The majority of cyber attacks an organisation faces will be ineffective if enterprise...

End User Devices: Authentication Policy
There are three important parts to authentication that you should consider: User to...

End User Devices: Common Questions
Wi-Fi Captive portals Alternative ways of authenticating to Wi-Fi On-device sandboxing Device...

A critical appraisal of risk methods and frameworks
This appraisal has been produced so practitioners and decision makers can better understand...

End User Devices Security Guidance: Introduction
Modern smartphones, laptops and tablets provide users with great flexibility and functionality, and...

EUD Security Guidance: Android 6
This guidance is applicable to Android 6 devices configured in Device Owner mode....

Summary of risk methods and frameworks
This section summarises number of commonly used risk methods and frameworks. Note that:...

Introduction to security governance
What is security governance? Security governance is the means by which you control and direct your organisation’s...

EUD Security Guidance: Windows 10 Mobile
This guidance is applicable to devices running Windows 10 Mobile and was developed...

Risk management principles
The following security risk management principles are applicable to how people and organisations...

Cloud Security Principle 14: Secure use of the service
The extent of your responsibility will vary depending on the deployment models of...

Cloud Security Principle 12: Secure service administration
The design, implementation and management of administration systems should follow enterprise good practice, whilst recognising...

Cloud Security Principle 10: Identity and authentication
Weak authentication to these interfaces may enable unauthorised access to your systems, resulting...

Cloud Security Principle 8: Supply chain security
Cloud services often rely upon third party products and services. Consequently, if this...

Risk management and risk analysis in practice
What is risk? Risk is the impact of uncertainty on people or organisations. Risks...

Risk management introduction
Risk management is about managing the impact of uncertainty on people or organisations....

Cloud Security Principle 13: Audit information for users
Goals You should be: aware of the audit information that will be provided...

Cloud Security Principle 11: External interface protection
If some of the interfaces exposed are private (such as management interfaces) then...

Cloud Security Principle 9: Secure user management
The aspects to consider are: Authentication of users to management interfaces and support...

Cloud Security Principle 7: Secure development
Goals You should be confident that: New and evolving threats are reviewed and...

Cloud Security Principle 5: Operational security
There are four elements to consider: Configuration and change management – you should ensure...

Cloud Security Principle 3: Separation between users
Factors affecting user separation include: where the separation controls are implemented – this...

Implementing the Cloud Security Principles
For each of the 14 principles, we answer three questions: 1. What is the...