The development team has identified key areas where security conscious decisions are embedded within the design, build, and ongoing maintenance of our applications. These include identity management, network protection, data encryption, access control, system integration, monitoring, and controlled deployment practices.

The following sections provide a high-level summary of the controls implemented in each of these areas.

1. Centralised Identity and Access Management

Applications use Entra as a single, organisation-controlled identity platform for authentication and access management.

Evidence of control

• Centralised identity service used across all core applications
• Organisational accounts and group-based access control consistently applied

Assurance outcome

Access is centrally governed with consistent authentication policy enforcement and controlled user lifecycle management across the estate.

2. Controlled Network Entry and Protection

All access is routed through Application Gateway which is a controlled and monitored gateway layer rather than direct exposure of applications.

Evidence of control

• Single managed entry point for web services
• Web application firewall protection applied at the network edge
• Restrictions in place to limit direct internet exposure of services
• Additional controls applied for higher-sensitivity applications

Assurance outcome

Inbound traffic is inspected and controlled prior to reaching application services, reducing external attack exposure.

3. Protection of Data in Transit

Encryption is enforced for data transmitted between users, applications, and supporting services.

Evidence of control

• Encrypted communication enforced across all applications and data services
• Consistent use of modern transport security standards
• No unencrypted production communication channels in use

Assurance outcome

This reduces the risk of interception or unauthorised access to data in transit.

4. Centralised Secrets and Certificate Management

Sensitive credentials and configuration data are managed centrally rather than within application code.

Evidence of control

• Central secure repository used for certificates and secrets
• Controlled and audited access to sensitive configuration
• Automated lifecycle management of key materials
• No secrets stored within application source code

Assurance outcome

This reduces exposure risk and ensures consistent governance of sensitive materials.

5. Segregation of Environments

Production and non-production environments are fully separated.

Evidence of control

• Distinct staging and production environments
• Separate configuration and data stores per environment
• Controlled promotion of changes through defined release stages

Assurance outcome

This reduces the risk of unintended impact to live services from testing or development activity.

6. Role-Based Access Control

Access to applications is managed through organisational roles and security groups.

Evidence of control

• Group-based access control model used across applications
• Separation of standard and administrative roles
• Centralised provisioning and removal of access rights

Assurance outcome

Access is consistently governed, auditable, and aligned to organisational structure.

7. Controlled System Integration

System-to-system communication is implemented using controlled, authenticated integration patterns.

Evidence of control

• Use of managed messaging and integration services
• Authentication required for system-to-system communication
• Restricted and defined integration endpoints

Assurance outcome

This limits unauthorised system access and reduces the impact of compromise in individual components.

8. Consistent Security Standards in Application Design

Security-related development standards are applied consistently across applications.

Evidence of control

• Shared validation approaches across systems
• Documented standards for input handling and data integrity
• Consistent implementation of validation rules across services

Assurance outcome

This reduces inconsistency and lowers the risk of insecure input handling.

9. Monitoring, Logging, and Operational Visibility

Applications are designed to provide operational visibility and support incident response.

Evidence of control

• Centralised logging across applications in Application Insights
• Service health monitoring in place (logged in Application Insights)
• Alerting configured for abnormal behaviour and failures (via emails)

Assurance outcome

This supports early detection of issues and enables effective investigation and response.

10. Controlled and Auditable Delivery Process

Security is embedded within the software delivery lifecycle.

Evidence of control

• Version-controlled deployment pipelines
• Peer-reviewed changes to application and infrastructure configuration
• Standardised release and promotion processes
• Documented environment and infrastructure configuration

Assurance outcome

Changes are traceable, repeatable, and subject to consistent governance controls.