Secure by Design for smartcard deployments
Build security into the RA deployment from design through retirement. NHS guidance connects this work to the government Secure by Design approach, architecture guidance and the Cyber Assessment Framework (CAF)-aligned Data Security and Protection Toolkit (DSPT). The latter assesses cyber security and information governance for specified organisation types. These sources have different purposes and scopes. They do not define one universal smartcard build or certify this reference setup. 025, 026, 028
Read CAF-aligned DSPT explained for definitions, the five NHS objectives and current version. Use DSPT scope and evidence for RA services for applicability, evidence and independent assessment.
Which guidance applies?
| Guidance | Relevance to this deployment | Boundary |
|---|---|---|
| NHS service standard, point 9 | Links to government Secure by Design principles. Calls for ongoing risk management, supplier checks, usable controls and security testing. | Service-team guidance; not a printer installation specification. 025 |
| NHS England Solution Architecture Framework (SAF) | SD01 and SD11 reference secure design. Other requirements cover risk ownership, decisions, logging and recovery. | The beta framework calls for proportionate judgement; its introduction does not expect universal full compliance. 026, 027 |
| CAF-aligned Data Security and Protection Toolkit (DSPT) | B4.a addresses secure design of systems supporting essential functions. B4.b–d address configuration, administration and vulnerabilities. | Apply the relevant organisational scope and assessment expectations. This wiki does not award a DSPT outcome. 028, 030 |
| Cross-government Secure by Design | Provides delivery principles and supporting activities. Government guidance uses the term approach. | The official scope explanation makes principles mandatory for central government and arm's-length bodies; activities can be tailored. Do not extend that mandate automatically to every RA organisation. 031, 032 |
The phrase “NHS Secure by Design framework” can obscure these distinctions. Start with the NHS sources above, then record the policies and assurance route that apply locally. The deployment assurance checklist is this wiki's proposed application of the guidance, not an official NHS assessment form.
Set the local scope
NHS identifies these organisation groups for CAF-aligned DSPT: trusts and foundation trusts, commissioning support units, DHSC arm's-length bodies, integrated care boards, designated independent operators of essential services, and nominated genomics organisations. Its guidance expects professional judgement and Senior Information Risk Owner (SIRO) approval of scope and submission. 028
For an organisation using that route, identify which essential functions depend on smartcard issuance and management. Include the supporting information, systems, networks and supplier dependencies. Data protection considerations can also bring systems handling personal data into scope. Do not assume that a workstation is excluded because it does not hold patient records. 029
Record the applicable local policy, assessment profile, accountable owner and review route. This wiki has not assessed a named organisation or selected its assurance profile.
The scope and evidence guide explains the prescribed template and current assessment cycle. Other organisation categories use different DSPT views; the category table explains that boundary.
Apply the guidance to this architecture
The architecture diagram shows service and device dependencies. It is a starting point for a local security design. Add the actual trust boundaries, data handled, administrative paths and recovery dependencies to the deployment record. The SAF supports documented decisions and proportionate governance. 027
CAF B4.a calls for a design that limits exposure and reduces the impact of a single vulnerability. Its guidance covers connection boundaries, data flows and recovery decisions. Apply those outcomes to the chosen workstation, local software, USB devices and network path. 030
The internet-only capability remains supported. Secure design does not create an extra HSCN prerequisite. The selected route still needs managed access, maintained software and local assurance. These controls do not replace the NHS component requirements.
Use the deployment assurance checklist, requirements register and acceptance plan together. Successful printing and a completed document review do not demonstrate that every security outcome has been met.