UK government organisations are measured against one security standard that covers everything from guarding and vetting to cyber defence and incident response, yet many teams only meet it through the cyber lens of GovAssure. Government Functional Standard GovS 007: Security is the Cabinet Office standard that sets expectations for protective security across central government departments and their arm's length bodies (ALBs). This guide explains what GovS 007 contains, who it applies to, how its mandatory and advisory language works, the governance roles and assurance model it requires, where identity and machine access fit, how it connects to GovAssure and the NCSC Cyber Assessment Framework, and how to build evidence against it. It is written for departmental security teams, security advisers in ALBs, internal auditors and suppliers working with government.
Key takeaways
- It is mandated across central government. The Cabinet Office states that functional standards are mandated for use across central government; GovS 007 covers security in departments and ALBs, and other public bodies may find it useful.
- Version 2.0 of 13 September 2021 is current. It replaced version 1.0 of July 2020, with stronger incident management, more risk and threat content throughout and a stronger technical security section.
- "Shall" is mandatory, "should" is advisory. The standard uses consistent language, so a compliance gap analysis can separate requirements from recommendations line by line.
- Accountability sits with the accounting officer. GovS 007 names an accounting officer accountable for security, a board member with a security remit, a senior officer accountable for security and an incident manager among its roles.
- Systems are users too. GovS 007 expects access to information to be limited to identified, authenticated and authorised users or systems, and highly privileged accounts to be protected from cyber attack, which brings service accounts and automation into scope.
What it is and who it applies to
GovS 007 is one of the suite of government functional standards published by the Cabinet Office, which the Cabinet Office describes as giving a coherent, mutually understood way of working within and across government organisations and a stable basis for assurance, risk management and capability improvement. Its scope (section 1.2) is the planning, delivery and management of government security activities, covering risk management, planning and response for physical, personnel, cyber and technical security in departments and ALBs, as well as industry working with government.
| Version | Date (GOV.UK) | Notes |
|---|---|---|
| Version 1.0 | First published 30 July 2020 | Initial security functional standard |
| Version 2.0 | 13 September 2021 | Substantially improved incident management, greater inclusion of risk and threat, stronger technical security section; 28-page PDF |
- Central government departments: must meet the mandatory elements and take part in cross-government assurance.
- Arm's length bodies: within scope of the standard; sponsoring departments typically seek assurance from them.
- Suppliers: section 6.5 covers industry security, so contracts can pass requirements to suppliers handling government assets.
- Wider public sector: local government, health and devolved bodies can use it as a reference model. See the Public Sector Identity Security Guide.
Structure and key requirements
| Section | Content | What to look for |
|---|---|---|
| 1 About this government functional standard | Purpose, scope, meaning of shall, should and may | Which organisations and assets are in scope |
| 2 Principles | Nine principles | The tests your security approach is judged against |
| 3 Context | How security fits government objectives | Alignment with organisational strategy |
| 4 Governance | Governance, assurance (4.2), roles and accountabilities (4.4) | Named roles, board oversight and assurance levels |
| 5 Security life cycle | Planning through delivery and review, including incident response (5.4) | Plans, risk assessment and response arrangements |
| 6 Security practices | 6.1 Physical, 6.2 Personnel, 6.3 Cyber, 6.4 Technical, 6.5 Industry, 6.6 Security risk management, 6.7 Information management, 6.8 Critical assets and services, 6.9 Capability, capacity and resources, 6.10 Security culture, education and awareness | Most of the operational requirements |
| Annexes A to C | References, glossary, subject specific security standards | Supporting standards to read alongside |
Principles
The nine principles in section 2 cover: alignment of security objectives with government policy and organisational objectives; risk-based security management; proportionate controls; holistic planning across all security domains; protection of the most sensitive assets; a positive security culture; competent people; defined accountabilities; and adherence to codes of conduct. Assessors use them to judge whether specific controls are proportionate, so record how each risk decision reflects them.
Mandatory language
| Word | Meaning in GovS 007 | How to treat it |
|---|---|---|
| shall | A requirement, a mandatory element | Must be met; a gap needs a remediation plan and risk owner |
| should | A recommendation, an advisory element | Meet it or record why an alternative is proportionate |
| may | Approval | Permitted option |
| might, can | Possibility; capability and possibility | Informative |
Governance roles
| Role (section 4.4) | Responsibility |
|---|---|
| Senior officer accountable across government (4.4.2) | The Government Chief Security Officer |
| National technical authority (4.4.3) | The NCSC for cyber security |
| Accounting officer (4.4.4) | Accountable for security in the organisation, supported by the management board |
| Board member with a security remit (4.4.5) | Oversees security compliance and auditing, including supplier security |
| Senior officer accountable for security (4.4.6) | Implements and maintains security standards; ensures incident response procedures are in place |
| Senior officer responsible for security information (4.4.7) | Information risk role |
| Incident manager (4.4.8) | Manages incidents, with no conflict of interest in investigating them |
| Specialist roles (4.4.9) | For example risk owners, information asset owners and data protection officers |
Assurance
Section 4.2 requires organisations to comply with mandated cross-government assurance activities coordinated by the Cabinet Office, and recommends assurance on at least three separate levels: operational management, senior management independent of operations, and independent bodies such as internal audit. It also requires the HM Treasury Orange Book risk management requirements to be met, and points to GovS 010 (Analysis) and GovS 003 (People) for related assurance.
Identity and NHI requirements
GovS 007 has no dedicated identity and access management section, but identity runs through its cyber (6.3), information management (6.7) and culture (6.10) practices. Two expectations matter most for machine identities: access to information is limited to identified, authenticated and authorised users or systems (6.7), and highly privileged accounts are protected from cyber attack (6.3). In a modern department the highly privileged accounts are often not people: cloud automation roles, directory synchronisation accounts, backup service accounts and CI/CD deployment identities.
| GovS 007 expectation | Machine identity interpretation | Evidence |
|---|---|---|
| Access only for identified, authenticated, authorised users or systems (6.7) | Every service account, API key and workload identity is named, owned and authorised; no shared or anonymous system access | Inventory of non-human identities with owners and approved purpose |
| Highly privileged accounts protected from cyber attack (6.3) | Tier 0 automation accounts vaulted, scoped and monitored; no long-lived keys for privileged cloud roles | Privileged identity register, rotation records, alerts |
| Detect cyber attacks and have a tested response (6.3) | Detection for abnormal use of service accounts and tokens | Detection rules, exercise reports |
| Access granted and reviewed in line with role and clearance (6.10) | Equivalent review for machine access: periodic recertification by the owning team | Access review records including non-human accounts |
| Supplier security (4.4.5, 6.5) | Supplier integrations and their credentials into government systems | Third-party access register, contract clauses |
See the Privileged Access Management Guide and the Joiner-Mover-Leaver Guide for the human and machine lifecycle controls that evidence these expectations.
Implementation steps
- Confirm the roles. Record who fills each section 4.4 role, including the board member with a security remit and the incident manager, and confirm the incident manager has no conflict of interest.
- Run a shall and should gap analysis. Extract every "shall" and "should" from the 28-page standard into a register, assign an owner and record status, evidence and any proportionate alternative.
- Connect to the risk framework. Ensure security risks are managed under the Orange Book approach and reported to the board, with risk owners named.
- Align the cyber practice with GovAssure. GovAssure assesses government critical systems against the NCSC Cyber Assessment Framework; use the same CAF evidence to show the cyber elements of section 6.3. See the NCSC Cyber Assessment Framework (CAF) Guide.
- Inventory privileged and machine identities. Build the register of human and non-human privileged accounts and apply vaulting, MFA where applicable, rotation and monitoring.
- Test incident response. Exercise the section 5.4 response arrangements, including a scenario involving a compromised service account or supplier credential.
- Set up three lines of assurance. Operational self-assessment, senior management review independent of operations, and internal audit coverage of security.
- Extend to ALBs and suppliers. Sponsoring departments should seek assurance from ALBs; contracts should carry the relevant industry security requirements.
Decision guidance
- Large department: a full register of every clause, a security board, departmental CAF profiles under GovAssure and an internal audit plan mapped to the standard.
- Small ALB: focus on the mandatory "shall" elements, a named senior officer accountable for security, a tested incident plan, and leverage of the sponsoring department's shared services and assurance.
- Supplier: expect requirements through contract rather than direct application; align with Cyber Essentials and any contractual security schedules. See the Cyber Essentials Guide.
- Cloud-first organisation: evidence for 6.3 and 6.7 will come mostly from cloud identity and logging platforms; make sure those platforms are inside the scope of internal audit.
Evidence and assessment
| Evidence | GovS 007 link | Metric |
|---|---|---|
| Role appointment records and board terms of reference | 4.4 | All named roles filled; board security reviews per year |
| Shall and should compliance register | 1, 6 | Percentage of "shall" elements met; open gaps with owners and dates |
| Security risk register | 4.2, 6.6 | Risks reviewed within the defined period |
| GovAssure CAF self-assessment and independent review | 4.2, 6.3 | CAF outcomes achieved against the profile; Targeted Improvement Plan actions closed |
| Privileged and non-human identity register | 6.3, 6.7 | Privileged accounts without an owner; long-lived credentials on privileged accounts |
| Incident exercise reports | 5.4, 6.3 | Exercises per year; time to contain in exercises |
| Internal audit reports | 4.2 | Security audits completed against plan |
GovAssure itself runs in stages that include a self-assessment, independent assurance reviews and Targeted Improvement Plans, and is now run by the Government Cyber Unit, which the security.gov.uk page says has moved to DCMS. Treat the GovAssure output as the cyber evidence for GovS 007, not the whole of it: physical, personnel and industry security need their own evidence.
Mapping to other frameworks
| Framework | Relationship to GovS 007 |
|---|---|
| NCSC Cyber Assessment Framework | The basis of GovAssure; CAF version 4.0 (April 2024) has four objectives: A Managing security risk, B Protecting against cyber attacks, C Detecting cyber security events, D Minimising the impact of cyber security incidents. It evidences the cyber practice (6.3) for government critical systems. GovS 007 itself references the 2018 Minimum Cyber Security Standard rather than the CAF. |
| HM Treasury Orange Book | Risk management requirements that GovS 007 says shall be met; the current edition was published by HM Treasury in May 2023 |
| Other functional standards | GovS 003 People, GovS 005 Digital, GovS 009 Internal Audit and GovS 010 Analysis interact with security requirements |
| ISO/IEC 27001:2022 | A management system model that can implement much of sections 4 to 6; GovS 007 is broader on physical and personnel security. See the ISO 27001 Certification Guide. |
| NIST CSF 2.0 | Govern maps to section 4; Protect, Detect, Respond and Recover map to sections 5 and 6; PR.AA-01 covers identities and credentials for users, services and hardware |
| Secure by Design (UK government) | Applies security through the delivery of digital services. See the Secure by Design for UK Government Guide. |
Common pitfalls
- Equating GovAssure with GovS 007: GovAssure covers cyber for critical systems; the standard also covers physical, personnel, technical and industry security.
- Roles on paper only: a named board member with a security remit who never receives security reporting does not meet the intent of section 4.4.
- Ignoring the "systems" in access control: service accounts and integrations are left out of access reviews, so section 6.7 is only met for people.
- Privileged automation with standing keys: a deployment or sync account with permanent high privilege and a static secret is exactly the exposure section 6.3 asks organisations to prevent.
- ALBs left to self-certify: sponsoring departments assume ALB compliance without evidence.
- Untested incident response: section 5.4 arrangements that exist as documents but have never been exercised, especially for supplier or credential compromise.
Practitioner checklist
- Confirm you are working from GovS 007 version 2.0 (13 September 2021) and watch GOV.UK for revisions.
- Record the holder of every section 4.4 role and the incident manager's independence.
- Build a register of every "shall" and "should", with owner, status and evidence.
- Manage security risks under the Orange Book approach with named risk owners.
- Reuse GovAssure CAF evidence for the cyber practice and close Targeted Improvement Plan actions.
- Inventory privileged human and non-human accounts and remove standing static credentials.
- Include service accounts and supplier integrations in access reviews.
- Exercise incident response at least annually, including a machine credential compromise scenario.
- Operate three levels of assurance and include security in the internal audit plan.
- Seek evidence from ALBs and pass industry security requirements into supplier contracts.
Standards and references
- Cabinet Office: Government Functional Standard GovS 007 Security
- Cabinet Office: GovS 007 Security, version 2.0 (PDF)
- Cabinet Office: Functional Standards
- Government Security: GovAssure
- NCSC: Cyber Assessment Framework
- HM Treasury: The Orange Book, Management of Risk
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Public Sector Identity Security Guide · NCSC Cyber Assessment Framework (CAF) Guide · Secure by Design for UK Government Guide · Privileged Access Management Guide. This guide summarises GovS 007 and is not legal advice.