GovAssure is the UK central Government cyber security assurance scheme for assessing  public body critical information systems. Launched in April 2023, it replaced cyber security elements of the Departmental Security Health Check (DSHC). GovAssure is designed to provide NCSC and Government Security Group (GSG) with a strategic view of public sector cyber resilience.

The scheme is currently designed for assessing systems classified up to OFFICIAL (caveated SENSITIVE), it is not suitable for SECRET and above systems.

 GovAssure is aligned to the NCSC Cyber Assurance Framework (CAF) and is delivered in five distinct stages:

• Stage 1. Describe Context and Services. Clearly describes the organisation’s context including mission, objectives, priorities, threats, cyber risk appetite and determines the organisation’s essential services.

• Stage 2. Identify In-Scope Systems and CAF Profile. Document the links between the essential services and IT systems to identify and prioritise critical systems that directly impact the organisation’s outputs. This stage establishes boundaries for the review and identifies the relevant CAF profile (Enhanced or Baseline) for Stage 3.

• Stage 3. CAF Self-Assessment. A self assessment for each system is completed by the organisation using the WebCAF, an online tool delivered via a secure web portal.

• Stage 4. Independent Assurance Review. The self-assessment is reviewed by an independent peer organisation or contracted GovAssure accredited independent assessor. If the CAF profile for target systems is enhanced, designated CNI, a critical system for a tranche 1 lead government department, or an ALB put forward by their parent department, an independent contracted assessor must be used. A final assessor report is delivered as part of this stage.

• Stage 5. Targeted Improvement Plan. The outcome of the final report identifies gaps in conformity with the target CAF profile. Actions required by the organisation to close these gaps will be included in a targeted improvement plan (TIP). Each system that fails to achieve the target CAF profile requires a clear remediation plan to achieve conformity (in line with the organisation’s available resources). TIPs will be regularly re-assessed in line with evolving cyber security threats and organisational priorities.

GovAssure is intended to provide public bodies with an accurate assessment of their level of conformity with the NCSC CAF, improving network and information security system maturity, in line with the Government Cyber Security strategy.

Amethyst have a proven track record of supporting public sector bodies through the GovAssure process. Our teams have conducted independent GovAssure assessments, and have worked with clients to support stages 1-3, ensuring that organisations are fully aligned to the framework to provide the best chance of a successful stage 4 GovAssure audit.