Parliamentary Search

Written question asked by Andrew Gwynne (Labour) on Wednesday, 29 March 2017, in the House of Commons. It was due for an answer on Tuesday, 18 April 2017. It was answered by Chris Skidmore (Conservative) on Tuesday, 18 April 2017 on behalf of the Cabinet Office.

Government Departments: Cybersecurity

Question

To ask the Minister for the Cabinet Office, pursuant to the Answer of 23 March 2017 to Question 68395, what assessment he has made of any potential security risks arising from component, platform and capability reuse beyond central government of GOV.UK (a) Notify and (b) Pay; and what steps the Government is taking to mitigate such risks.

Answer

In accordance with the HMG Security Policy Framework, all GDS products, including GOV.UK Notify and Pay, are subject to an ongoing, through-life information risk management activity to ensure that we identify information security risks and treat them proportionately and cost-effectively.

As part of this ongoing activity, risk assessments and security checks (‘IT healthchecks’) based on National Cyber Security Centre guidelines are carried out by independent experts and Privacy Impact Assessments are used to assess the potential impact to any personal data being processed.

Security considerations form an integral part of the pilots we are undertaking to explore how GOV.UK Pay, GOV.UK Notify and similar products can be made available to the wider public sector.

Risk mitigation activities may include the implementation of, or changes to, staff clearances, procedures, processes, software source code, service architecture, release process and monitoring or alerting as required to effectively treat risks where they exceed tolerance.

Secondary information

Type
Written question
Reference
69712
Session
2016-17
Related items
Government Departments: Digital Technology
Thursday, 23 March 2017
Written questions
House of Commons
Grouped for answer
Yes
Subjects
Government departments Cybersecurity
Link
View this Written question on www.parliament.uk