MOD Secure by Design Playbook

Guide Origin: Official | ArcKit Version: [VERSION]

/arckit:mod-secure generates a Ministry of Defence Secure by Design assessment using CAAT and continuous assurance methodology.

---

Inputs

Artefact	Purpose
Requirements (ARC-<id>-REQ-v1.0.md)	Security requirements and classification
Architecture diagrams	System boundaries and data flows
Risk register	Security risks identified
Data model	Data classification and handling

---

Command

/arckit:mod-secure Create MOD Secure by Design assessment for <system>

Output: projects/<id>/ARC-<id>-SECD-MOD-v1.0.md

Security content and model fallback: Claude Opus 5.5 and Sonnet 5.5 have cybersecurity safeguards, and a threat or attack discussion in this assessment can trip them. Claude Code then re-runs that request on an older model (Sonnet 5 from Sonnet 5.5, Opus 4.8 from Opus 5.5), tells you it has done so, and stays on that model until you switch back with /model. The assessment is still written; its Build Provenance names the model that wrote it.

---

Assessment Structure

Section	Contents
System Overview	Name, purpose, classification, boundaries
7 SbD Principles Assessment	Compliance against each MOD SbD principle
CAAT Summary	Continuous Assurance Assessment Tool results
Security Classification	Data classification and handling requirements
Threat Assessment	Threat actors, attack vectors, mitigations
Security Controls	Technical, procedural, and physical controls
Accreditation Status	Path to accreditation and outstanding actions
Risk Acceptance	Residual risks requiring SIRO acceptance

---

7 MOD Secure by Design Principles

#	Principle	Focus Area
1	Establish Context	Understand threats and business context
2	Make Compromise Difficult	Defense in depth, secure architecture
3	Make Disruption Difficult	Resilience and availability
4	Make Detection Easier	Logging, monitoring, alerting
5	Reduce Impact	Contain and limit damage
6	Secure Operations	Operational security processes
7	Enable Assurance	Evidence and continuous compliance

---

CAAT (Continuous Assurance Assessment Tool)

Aspect	Description
Purpose	Structured security assessment methodology
Scope	Covers all 7 SbD principles
Output	RAG status per principle with evidence
Integration	Feeds into accreditation documentation

---

Security Classifications

Classification	Handling	Examples
OFFICIAL	Standard controls	Most MOD business
OFFICIAL-SENSITIVE	Enhanced controls	Personnel data, commercial
SECRET	Accredited systems	Intelligence, operations
TOP SECRET	Highest controls	Most sensitive material

---

One-Page Workflow

Phase	Key Activities	ArcKit Commands
Discovery	Define requirements and classification	/arckit:requirements, /arckit:data-model
Risk	Identify security risks and threats	/arckit:risk
Assessment	Create MOD SbD assessment	/arckit:mod-secure
Accreditation	Progress through accreditation stages	Manual
Operations	Continuous assurance monitoring	/arckit:operationalize

---

Review Checklist

• System classification correctly determined.
• All 7 SbD principles assessed with evidence.
• Threat assessment covers relevant threat actors.
• Security controls mapped to threats and risks.
• JSP 440 requirements addressed for classification.
• CAAT assessment completed and documented.
• Residual risks documented for SIRO acceptance.
• Accreditation pathway and timeline defined.

---

JSP 440 Alignment

JSP 440 Requirement	SbD Principle
Protective Marking	Establish Context
Access Control	Make Compromise Difficult
Audit and Accountability	Make Detection Easier
Incident Response	Reduce Impact
Configuration Management	Secure Operations

---

Key Principles

1. Classification Drives Controls: Security controls match data classification.
2. Continuous Assurance: Security is ongoing, not a one-time assessment.
3. Evidence-Based: All claims supported by documented evidence.
4. Risk-Informed: Accept risk consciously through SIRO process.
5. Defence in Depth: Multiple layers of security controls.