Modernising Cyber Security Assessments for Policing

Requirements

To develop and deploy a cost effective toolset to support the adaptation and adoption of the NIST Cybersecurity Framework (CSF) across 56 Policing Organisations, supporting the continuous cyber security maturity methodology and aligning to the NPCC Cyber Security Strategy 2020-2030.

Requirements included:

• Methods for user input and updates
• Individual and combined reporting outputs 
• Flexibility and scalability for future developments

Implementation

Development of the toolset was focused around the use of existing licensed Microsoft products, widely used across policing. This helped with keeping costs down to a minimum and focusing the limited available resources on deployment support. 

Throughout the development phase, a pilot group was setup to ensure the product was fit for purpose and met end user needs, whilst remaining focused around national level requirements. User feedback was incorporated into later iterations of the product, to ensure the product was developed by policing, for policing.

Challenges

A primary challenge was the limited timeframe for delivery. With the product first being made available to the pilot user group just 5 months after the initial ideas workshop, followed by national sign-off just 4 months later. This also resulted in a 6 month delivery window to deploy, onboard and support over 50 policing organisations separately, whilst maintain product service including issue resolution and further product enhancements.

Results

All UK policing organisations have adopted SyAP as the toolset and supporting methodology for managing cyber security risks and, at the time of writing, are into the second year of continuous updates, with improvements reported throughout. 

The toolset has been further developed since the initial inception and now includes additional functionality to further improve the reporting of local cyber risks and enhance the visibility of these risks at a national level, which in turns increases the responses to new cyber threats to policing. 

Stats

• 20 Months – From initial concept to full deployment
• 56 Policing Organisations – Individually using the toolset
• 110 Security Controls – Building upon the foundations of the NIST Cybersecurity Framework 
• 1 National Report – For the first time ever, UK policing now has a centralised and regularly updated reporting suite showing cyber security maturity across all UK policing organisations

Testimonial

White Hawk Solutions provided my team with a thoughtful, professional and comprehensive service as we developed a new assurance regime for policing at a national level. Their expert support was fundamental to the success of the project.

Chris, Head of National Police Audit Risk and Compliance – Police Digital Service