Adopting Secure by Design in live delivery
A delivery programme told that Secure by Design was mandatory, with the self-assessment treated as a document to complete near go-live.
The challenge
The team understood Secure by Design as a form to fill in. Security decisions were still being raised late, and the self-assessment was being completed retrospectively to describe choices that had already been made.
That inverts the intent. Completed late, the assessment records history rather than influencing design — and a high confidence score produced that way is misleading to everyone who relies on it.
Our approach
- Create real ownershipEstablish who owns cyber risk for the service, so decisions have an accountable owner instead of falling between delivery and security.
- Move decisions earlierBring threat modelling and risk-driven design into the points where architecture and procurement choices are actually made.
- Evidence as you goCapture decisions, risk acceptances and supporting evidence while the work happens, rather than reconstructing them later from memory.
- Make assurance continuousUse the self-assessment as a live conversation about confidence through delivery, not a document produced once before a gate.
What changed
Security decisions started landing early enough to change the design rather than to document it, and the confidence profile began reflecting the service as built.
The team could explain not just what its score was, but why — which is the question an assurance reviewer actually asks.
This is an anonymised, representative engagement. We do not publish client names, or figures we cannot substantiate, without explicit permission — in government and critical infrastructure, naming a client can itself be a security concern.
Other case studies
- Getting ready for GovAssure — A department facing its first GovAssure cycle, unsure which systems were in scope and whether its evidence would survive independent review.
- Clearing a supplier assurance backlog — An organisation with far more suppliers than it could assess, treating every one of them to the same depth and therefore assuring none of them well.
- Reviewing security across OT and IoT — An operator whose operational technology had been assessed with methods designed for corporate IT, producing findings its engineers could not act on.