The Security Policy Framework (or "SPF") is a set of high-level policies on security, mainly affecting the

UK government His Majesty's Government, abbreviated to HM Government or otherwise UK Government, is the central government, central executive authority of the United Kingdom of Great Britain and Northern Ireland.

and its suppliers. The structure has changed over time. Version 11 was published in October 2013; it has 20 "Mandatory Requirements" grouped into four policy areas. Previously the SPF had as many as 70 Mandatory Requirements, which were more detailed, and which were grouped into 7 areas: :1: Governance, Risk Management & Compliance :2: Protective Marking & Asset Control :3: Personnel Security :4:

Information Security Information security is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or reducing the probability of unauthorized or inappropriate access to data ...

& Assurance :5: Physical Security :6: Counter-Terrorism :7:

Business Continuity Business continuity may be defined as "the capability of an organization to continue the delivery of products or services at pre-defined acceptable levels following a disruptive incident", and business continuity planning (or business continuity ...

These mandatory requirements are a baseline which apply to all UK government departments; higher requirements may apply in some cases. Public-sector bodies are responsible for managing their own technical security risks, but can draw on expertise and guidelines provided by CESG and the

Cabinet Office The Cabinet Office is a Departments of the Government of the United Kingdom, ministerial department of the Government of the United Kingdom. It is responsible for supporting the Prime Minister of the United Kingdom, prime minister and Cabinet ...

. The Centre for Protection of National Infrastructure also helps protect critical infrastructure. The Ministry of Defence has its own separate policies and systems. The SPF superseded the Manual of Protective Security. Part of the SPF is produced by CESG, and part by the

's Security Policy Division.

External links

Current SPF

SPF resources on CESG's website

Older copies of the SPF and MPS requested under the Freedom of Information Act

Resources for the SPF

References

{{reflist Classified information Government of the United Kingdom Information sensitivity Public policy in the United Kingdom