Connected Places Cyber Security Principles

Throughout your connected place system's life cycle, its security and technology requirements will evolve. This requires a sustainable engineering approach to continuously develop its underpinning infrastructure for security purposes. There should also be consideration of any evolving interoperability requirements to enable continued development of the connected place's services. This needs to include maintaining your operational security by fixing bugs or dealing with functionality issues as technology evolves. Alongside this, assets need to be reviewed and monitored constantly, which will help to identify end of life/legacy components.

This needs to include:

• how components are to be decommissioned and replaced by new technology without increasing the risk to confidentiality, integrity, availability, and the quality of the service that the connected place provides
• how components can be securely disposed of so not to expose any sensitive data if the hardware was recovered
• ensuring there are clear responsibilities, processes, and procedures in place throughout the connected place's life cycle to assist stakeholders, vendors and integrators in delivering these evolving requirements

You need to understand the impact of the components to your connected place, and that you have effective assurance in place that components are still meeting the required security levels needed to protect the system. You can do this by testing your system throughout its life cycle. This can be done through health checks, penetration testing, and continual review of risks and procedures. If you identify that the level of security has dropped below the required levels, appropriate mitigations need to be in place to reduce any risks in the short term. For the long-term support of the connected place system, you should be making arrangements to replace these legacy components as soon as possible.