Security

1. Specification

Security tooling is the layer where “sovereign” is most often confused with “secure”. A service can be secure and still entirely under another jurisdiction’s control. The evidence finds endpoint protection, security monitoring and key management concentrated in a handful of overseas vendors. The profile keeps keys and telemetry under the buyer’s control and allows sector bodies to share security operations.

2. Layer profile

Id	Criterion	Standard
SE-1	Keys are generated, held and rotated under the buyer’s control.	General criterion G3; buyer-controlled HSM
SE-2	Telemetry from every layer is exportable in an open format to a service the buyer chooses.	OpenTelemetry; syslog
SE-3	Security monitoring can be run by a shared sector service, not only by the vendor.	Sector SOCs such as Jisc’s; open detection rule formats
SE-4	Endpoint protection does not require a vendor cloud account to operate.	Policy and updates deliverable from buyer-controlled infrastructure
SE-5	Vulnerability disclosure and software bill of materials are published for every component.	General criterion G6; CycloneDX or SPDX
SE-6	Security controls are mapped to the UK’s own guidance, not only to a vendor’s framework.	NCSC Cyber Assessment Framework

Already adopted in UK government

The Open Standards Board has adopted STIX and TAXII for exchanging cyber threat intelligence (Open standards for government); the NCSC Cyber Assessment Framework is the reference control set across critical sectors. No profile covers telemetry, key management or endpoint protection, so SE-1, SE-2 and SE-4 go beyond the adopted set.

3. Open-source solutions that meet the profile

Not yet assessed. Candidates: OpenTelemetry collectors, Wazuh, open SIEM stacks.

4. Public services implementing the standard

Not yet recorded. Candidates: Jisc’s security operations centre; NCSC services.

5. Skills and horizon

Horizon 1 onward. Shared security operations are a skills multiplier for small organisations. See the roadmap.

What this section rests on 24 findings

Every published finding in the Body of Knowledge for the layers this section covers. The Handbook recommends; the Findings show where we are. Open any row in the Stack Playground to see its sources.

Published findings for the layers covered by Security
Finding	Organisation	Product	Vendor	Owner country	Index
DEF-066	Defence	Elastic SIEM licences and support for Defensive Cyber Operations big-data analytics	Elastic (via Centerprise International)	United States	43 · Dependent
DEF-067	Defence	Access to Microsoft Threat Analysis Centre (MTAC) nation-state threat intelligence	Microsoft	United States	44 · Dependent
DEF-068	Defence	AWE cyber security services	BT	United Kingdom	77 · Sovereign
DEF-069	Defence	Support for the DE&S Security Operations Centre	Accenture	Ireland	63 · Partly sovereign
DEF-070	Defence	Ultra Cyber Multi Link Encryptor (MLE) family – NCSC CAPS-certified SECRET tactical data link crypto	Ultra Cyber	United States	59 · Partly sovereign
DEV-025	Devolved Governments	Windows Advanced Threat Protection (Microsoft Defender ATP) used by national SOC	Microsoft	United States	25 · Dependent
DEV-026	Devolved Governments	National SOC (Dundee) delivery partner	Systal	Unknown	81 · Sovereign
GOV-085	Central Government	NCSC Active Cyber Defence services (PDNS, Mail Check, Web Check)	NCSC (GCHQ) with suppliers	United Kingdom	76 · Sovereign
GOV-086	Central Government	Managed detection & response (Expel) - QEII Centre	Expel	United States	44 · Dependent
HE-058	Higher Education	CrowdStrike Falcon (Jisc sector agreement)	CrowdStrike	United States	31 · Dependent
HE-060	Higher Education	Jisc Security Operations Centre (shared sector SOC)	Jisc (tooling: Splunk, Microsoft Defender, CrowdStrike, Cortex XSOAR)	United Kingdom	69 · Partly sovereign
LG-066	Local Government	Microsoft 365 E5 security (identity, advanced threat protection, information governance) plus Copilot	Microsoft (via Phoenix Software)	United States	31 · Dependent
LG-067	Local Government	Managed SOC (manage, detect, respond)	NCC Group	United Kingdom	85 · Sovereign
LG-068	Local Government	Microsoft Sentinel SIEM (in Azure renewal)	Microsoft	United States	33 · Dependent
LG-069	Local Government	MHCLG Cyber Support programme and Cyber Assessment Framework for local government	MHCLG (Local Digital)	United Kingdom	96 · Sovereign
NHS-057	NHS	Microsoft Defender for Endpoint (centrally funded national licence)	Microsoft	United States	39 · Dependent
NHS-058	NHS	CrowdStrike Falcon (EDR used in EMIS-hosted / some GP and trust estates)	CrowdStrike	United States	26 · Dependent
NHS-059	NHS	NHS England Cyber Security Operations Centre (CSOC) – national monitoring (originally IBM partnership)	NHS England; IBM (2018 partner); Microsoft Sentinel/Defender XDR telemetry	United Kingdom	65 · Partly sovereign
NHS-061	NHS	NHS PKI (NHS Root Authority G2 etc.) for smartcards, signing and Spine TLS	NHS England (operator); HSM vendor not disclosed	United Kingdom	94 · Sovereign
POL-068	Policing	Microsoft Defender (M365 E5 Security) endpoint protection	Microsoft	United States	26 · Dependent
POL-069	Policing	Policing National Management Centre (NMC) - national cyber monitoring/SOC	Police Digital Service (BT SOC at launch)	United Kingdom	90 · Sovereign
POL-070	Policing	Encryption keys for DESC evidence held by Axon	Axon	United States	15 · Exposed
SCH-050	Schools	Smoothwall filtering and monitoring	Smoothwall Ltd (Qoria)	United States	46 · Dependent
SCH-052	Schools	MSP- and consortium-provided monitoring (no national school SOC); RPA cyber cover	Managed service providers; DfE Risk Protection Arrangement	United Kingdom	87 · Sovereign

Change this section

The recommendations in this section are made by The Sovereign Stack Consortium, now forming.

Sections are Markdown in a public repository. Propose a change as a pull request, or open a discussion first. Contributions are reviewed by the section's maintainers under the Handbook governance. Text is licensed CC BY 4.0.