Securely Adopting M365

Requirements

The primary requirement was to oversee the Security & Risk Management function of the National Enabling Programme (NEP), which was a national programme created to support the secure deployment of Microsoft Cloud Services throughout UK policing.

This included providing cyber security advice and guidance to the +40 UK policing organisations throughout their adoption of Microsoft 365 products, ensuring adoption of M365 products remained within risk tolerance of the National Senior Risk Owner (NSIRO).

Implementation

Regular engagement with the information security teams across 42 policing organisations, supporting their local delivery of M365 towards national design and security standards. As well as supporting the entire programme delivery function, ensuring;

• User adoption remained within the guardrails of pre-approved processes
• Technical configuration of individual organisational Microsoft tenants remained within risk tolerance 
• Updates to technical blueprint designs followed the Secure by Design process

Challenges

The ‘stand out’ challenge was the almost immediate and overnight remote working requirement that swiftly followed the COVID pandemic. This required a swift change in focus and delivery, including a temporary risk profile allowing the restricted use of remote working products such as Microsoft Teams throughout policing, ensuring full re-alignment of the original technical blueprints as soon as possible.

Results

The UK policing organisations that aligned to the central set of designs and processes now have a suite of tools that enable them to collaborate safely, securely and efficiently.

Stats

• 42 UK policing organisations aligned to a national set of technical designs
• 184 Security Controls implemented, focusing on People, Process and Technology
• 1 COVID pandemic successfully overcome