Implementing Secure by Design (SbD) principles can be complex, but the outcomes are invaluable. This case study highlights how SbD was applied to a critical legacy system within the Ministry of Defence (MOD), overcoming key challenges and delivering measurable improvements in security and stakeholder engagement.
The Cyber/Information Security Assurance Coordinator (SAC) at the MOD was tasked with supporting the migration of a critical legacy system to a modern hosting environment. This system hosted applications built before modern cybersecurity standards existed, exposing it to risks such as outdated configurations, vulnerabilities, and compliance gaps.
To ensure a successful transition, the system’s risk posture had to be assessed thoroughly in line with the government-mandated Secure by Design (SbD) directive.
The SAC’s objective was to identify existing cyber risks and recommend appropriate treatments using the principles of Treat, Tolerate, Transfer, or Terminate. The NIST 800-53 cybersecurity framework was employed to guide risk identification and control selection.
A key SbD principle was embedding ownership and accountability: stakeholders needed to understand, accept, and act on identified risks.
A structured and collaborative SbD approach was rolled out, based on industry best practices and real-time engagement. Key actions included:
Comprehensive assessments, guided by NIST 800-53 controls, revealed and prioritised system vulnerabilities. This helped establish a clear security baseline.
High-quality assurance materials were created, including vulnerability remediation plans and risk-based Plans of Action and Milestones (POA&Ms). Actions such as improved patch management, tighter access controls, and secure configuration baselines were initiated.
An executive summary was developed for the Senior Responsible Owner (SRO), outlining risks and proposed mitigations. This briefing helped drive alignment and decision-making.
The SAC provided tailored security guidance to project teams, supported risk discovery efforts, and worked closely with cyber security architects to map associated assets and interdependencies.
The engagement produced clear, measurable outcomes:
This engagement demonstrated how Secure by Design principles can be successfully applied in high-risk, legacy environments. By proactively identifying and managing cybersecurity risks, structured POA&Ms were created and acted upon.
Ultimately, this work enhanced the security of critical defence systems and reinforced the importance of risk ownership, collaboration, and continuous improvement in delivering modern, resilient public-sector technology.
As Secure by Design becomes a baseline expectation, embedding it early is not just strategic; it’s essential.
Learn more about i3Secure’s Secure by Design services here.
Get in touch with our specialists to learn how we can enhance your cyber security posture.
Contact Us
Contact