Back to Guides

/gcloud-kit:security

Generate security assertions and evidence document for a G-Cloud service.

Overview

Creates a comprehensive security document mapping your service against the NCSC 14 Cloud Security Principles, documenting certifications, security testing, clearances, and building an evidence register. This is a critical submission document — most buyers require ISO 27001 and Cyber Essentials Plus.

Usage

/gcloud-kit:security My Cloud Platform

Arguments: Service name (must match an existing service directory).

Prerequisites

  • Supplier profile (services/supplier/supplier-profile.md)
  • Service design (services/{name}/service-design.md)
  • SDD (services/{name}/sdd.md)

Output

services/{name}/security.md

Template used: .gcloud/templates/security-template.md

What it does

  1. Loads context from supplier profile, service design, and SDD
  2. Reads the security template
  3. Documents each of the NCSC 14 Cloud Security Principles:
    1. Data in transit protection
    2. Asset protection and resilience
    3. Separation between consumers
    4. Governance framework
    5. Operational security
    6. Personnel security
    7. Secure development
    8. Supply chain security
    9. Secure consumer management
    10. Identity and authentication
    11. External interface protection
    12. Secure service administration
    13. Audit information provision
    14. Secure use of the service
  4. Documents certifications (ISO 27001, Cyber Essentials, SOC 2, CSA STAR, PCI DSS)
  5. Records security testing regime (penetration testing, vulnerability scanning)
  6. Lists security clearances held
  7. Creates an evidence register with certificate numbers and expiry dates

Related commands