Secure by Design for Public Services: The Cyber Skills Behind G-Cloud Delivery

Secure by Design is the Cabinet Office's set of ten principles for building cyber-resilient government digital services, mandatory for central government departments and arm's-length bodies delivering new or significantly changed services subject to spend controls. It isn't a direct legal mandate on suppliers, but departments can only meet their own obligation if the supplier building or operating the service can evidence the same principles, so it becomes a practical requirement for winning and delivering government work. 

Cyber Essentials proves a baseline security posture. Secure by Design's ten principles go further, requiring threat modelling, security-aware service design, detect-and-respond capability, cloud and security architecture, continuous assurance and testing, and secure change management. In certification terms, that maps to CompTIA Security+ and CySA+, EC-Council's network defence and penetration testing credentials, AWS and Microsoft cloud security pathways, and ITIL 5 Foundation for the governance layer.

The plan, published 6 January 2026 with £210 million behind it, is building government's own cyber workforce through a new Government Cyber Profession, resourcing hub and Cyber Academy. That machinery trains civil servants, not supplier delivery teams, but it signals how closely government now scrutinises cyber capability, including the capability of the suppliers it buys from. Departments under pressure to close their own gap are less likely to accept a Cyber Essentials certificate as sufficient evidence from a supplier.