Services

System Security & Secure by Design

System security and secure by design are critical in protecting critical infrastructure and data from cyber threats. AXIAH Ltd integrates security measures from the ground up, ensuring that systems are resilient against attacks and vulnerabilities. Our comprehensive approach includes regular assessments, secure design practices, and incident response planning to safeguard our clients’ assets.

System Security is a fundamental requirement for modern Defence and Government capabilities, where systems must be resilient to cyber threats, dependable in operation, and trusted to handle sensitive information. AXIAH provides specialist support aligned with the Ministry of Defence’s Secure by Design (SbD) approach and wider UK Government expectations, including JSP 440, JSP 543, Government Security Group guidance, and National Cyber Security Centre (NCSC) principles. We provide support to suppliers through alignment with the requirements of Defence Standard 05‑139 (Cyber Security for Defence Products, Systems and Services), which defines the activities, controls and assurance evidence needed to demonstrate that cyber security risks are identified, treated and governed through the lifecycle.

Our services include a comprehensive range of security engineering and cyber risk management activities, supporting capability teams as they define context, characterise risks, and design proportionate controls. We apply established public methodologies such as the NIST SP 800 37 Risk Management Framework (RMF) and NIST SP 800 30 for risk assessment, along with threat modelling techniques including MITRE ATT&CK, STRIDE, attack tree analysis, and LINDDUN for privacy related threat modelling. Threat and privacy risks are assessed and managed in accordance with the defined risk appetite, ensuring that security and data protection controls remain proportionate and evidence based.

AXIAH supports Secure by Design activities across the capability lifecycle, including understanding and defining context, planning security activities, managing risk continuously, selecting and implementing controls, securing the supply chain, and assessing security throughout integration, verification and validation. This includes facilitation of Security Working Groups, supporting risk reviews, conducting design and implementation reviews, and ensuring that cyber risk information remains decision ready for governance boards and Senior Responsible Owners (SROs). Our structured approach helps maintain consistent, auditable and proportionate risk management as systems evolve or new information emerges.

We also develop, review and maintain the security artefacts required to support MOD assurance. This includes Security Management Plans, security risk registers, Incident Response Plans, Verification & Validation (V&V) evidence, security compliance and achievement reports, In Service / Sustainment Plans, and Security Case Reports. Where appropriate, we support the development of structured security arguments using Claims Argument Evidence (CAE) reasoning in line with NCSC Technology Assurance and Principles Based Assurance (PBA) aspirations. These artefacts and analyses provide the traceability, justification and assurance evidence needed to demonstrate robust security engineering and risk treatment.

Our through life security support ensures secure capability is maintained as systems, threats and missions evolve. This includes assessing the security impact of change, supporting vulnerability management activities, helping maintain configuration and control of security relevant design elements, and advising on secure integration, deployment, operation and disposal. Throughout, AXIAH focuses on enabling customers to maintain a clear view of their security posture and to meet the expectations defined by MOD, UK Government and industry recognised security standards.

Get in Touch