Least privilege
People and services receive only the access required for their role.
Security principles
Security decisions that can be explained and operated
Security controls are most useful when they match the system’s users, information and risks and can be maintained after launch.
Principles we apply
Controls matched to the system
Secure defaults
New users, features and environments begin in a controlled state.
Defence in depth
Identity, application, data and infrastructure controls work together.
Traceability
Important actions and changes are recorded proportionately to operational need.
Data minimisation
The platform collects, exposes and retains only the information required.
Resilience and recovery
Failure, backup, restoration and operational ownership are considered during design.
Putting principles into practice
Work may include a permissions matrix, sensitive-data inventory, threat scenarios, logging requirements, backup and recovery decisions, and ownership of security-related changes.
Proportionate, not absolute
No platform or control can guarantee complete protection. Priorities should be based on the system’s likely threats, impact and operating context.
Review your security assumptions
Make access, data and recovery decisions visible early.