DWP procurement: security policies and standards
These apply to DWP suppliers and contractors where explicitly stated in the security schedule of the contract.
Documents
Details
The Common Standards for Identity Verification and Authentication (CSIVA) of DWP customers is under review. You should refer to Good Practice Guides 45 and 44 instead.
Note, the Department for Work and Pensions (DWP) is unable to reply to general enquiries or questions about these security standards and policies.
These security standards and policies apply to DWP suppliers and contractors only. They do not apply to other government departments, their agencies or arm’s length bodies.
They have been published to help inform DWP Invitations to Tender and other contracting processes.
DWP may choose in an Invitation to Tender or the bid process to reference the standards and policies published here. Questions about a specific standard or policy should be sent to the DWP team managing responses to bids. This team is the only DWP authorised responder on any question about a bid and a standard or policy.
A new or changed policy or standard does not mean a new requirement for any existing contract. DWP will notify contract holders or partners of any changes to a contract.
Suppliers and contractors should contact their DWP contract managers with any questions about:
- varying contracts
- changing the agreed delivery of contracted services
- the applicability of a standard or policy for their contracts
Last updated 28 April 2022 + show all updates
-
Revised version of DWP Acceptable Use Policy (new version is labelled version 3).
-
Revised version of DWP Personnel Security Policy (new version is labelled version 2).
-
Revised version of Security Standard SS-031: Domain Management (new version is labelled version 1.2 and dated December 2021).
-
Added the DWP policy for Microsoft Teams Recording and Transcription. This is for DWP suppliers and contractors only.
-
Revised version of Social Media policy (new version is labelled version 2).
-
Added Personnel Security policy for DWP suppliers and contractors.
-
Revised version of Security Standard SS-033: Security Patching (new version is labelled version 1.3 and dated January 2021).
-
Revised version of Security Standard SS-033: Security Patching (now labelled version 1.2).
-
Revised version of Security standard SS-016: Remote Access (now labelled version 1.2). Typo correction in entry 10.3.2, from ‘Authority’ to ‘Contractor’.
-
Published revised version of Security incident response team referral form for Security standard SS-014. The revised form is dated 3 June 2020.
-
Added the following 10 DWP policies: Cryptographic Key Management Policy, Email Policy, Forensic Readiness Policy, Privileged Users Security Policy, Remote Working Security Policy, Security Classification Policy, SMS Text Policy, Social Media Policy, Technical Vulnerability Management Policy and User Access Control Policy.
-
Published updated versions of the DWP security standards. All are now dated March 2020, except standard SS-014 which is dated 4/3/2020. These have been revised to reflect changes in DWP processes, laws, and national and international security standards and practices.
-
Added DWP Security Standard SS-033: Security Patching.
-
Removed the Common Standards for Identity Verification and Authentication (CSIVA) of DWP customers document. This document is currently under review.
-
Revised versions of the Acceptable Use (version 2.5) and Physical Security (version 2) policies.
-
Revised versions of 'Security Standard - Firewall Security (SS-013)' and 'Security Standard - Network Security Design (SS-018)'. Both are now dated 9 April 2019.
-
Added 'Common Standards for Identity Verification and Authentication (CSIVA) of DWP customers' (version 1.7).
-
Published revised version of Security standard SS-003: Software Development (now version 1.1, dated 07/10/2018).
-
Published revised versions of Acceptable Use (version 2.5), Information Security (version 1) and Physical Security (version 1) policies.
-
Added 'Security standard SS-012: Protective Monitoring Standard'.
-
Added 'Security standard SS-001 (part 2): Privileged User Access Controls'.
-
First published.