Introduction
Published guidance from GDS around the PSN can be found here.
In this document, we’ll take you through the necessary steps, and provide templates to make the process as simple as possible.
Cloud Gateway holds PSN service code SRV_0454 and carries out annual IT Health Checks under CHECK conditions as part of its own PSN certification. Customers connecting via the Cloud Gateway platform can reference this as part of their own submission.
Compliance Steps
Step 1: PSN Code of Connection (CoCo)
This document enables you to provide details about your organisation, the infrastructure you want to connect to the PSN, and outlines the Information Assurance (IA) requirements you need to meet and commitments you need to make.
- Locate the PSN Code of Connection form on the gov.uk website, linked here.
- Download the form and open it in MS Word / TextEdit
- Complete the Organisation Details and Point of Contact Details fields at the top of the form:
- Read and understand the PSN Terms and Conditions linked here
- Complete the Your PSN environment fields halfway down the form:
- Under Environment Name, provide a name for the network environment or endpoint(s) that you are connecting to the PSN. For example:
- “XXX Council – London Site”
- “XXX Authority – Remote User Base”
- “XXX limited – Azure Cloud Environment”
- “Department for XXX – WAN Architecture”
- Under Size Estimates, provide an overview of the expected number of sites, users and IP address endpoints that will be connected to the PSN. Note, these figures don’t constitute an order, it is purely for capacity planning and risk assessment purposes.
- ‘Number of users’ means the number of users who you would expect to be accessing information and services within your specified infrastructure
- ‘Number of sites’ means the number of physical locations (such as office locations or data centres) over which your users are spread
- ‘Number of internal IP addresses’ means the number of IP addresses within the scope of the infrastructure, not the externally-presentable IP addresses
- Under Unique Identifying Codes, add Cloud Gateway’s service code SRV_0454
- Complete the Authorised signatory fields at the bottom of the document:
- By signing this form, you are agreeing to the obligations spelled out in the CoCo document including Information Assurance and Operational Security policies. Go to Step 3 for more information about this.
- Save the Code of Connection form and prepare the other artefacts detailed in the following steps.
Step 2: Network Diagram
To accompany the CoCo form, you’ll need to provide an up-to-date diagram of the network infrastructure being connected to the PSN. The network diagram must be less than 6 months old at the time you submit your application.
- To help you create a suitable network diagram for our PSN services, we have created some simple templates. If you’d like to use these templates as a base for your submission, please do get in touch with us.
- For more complex architectures, we can assist you to draw up a suitable network diagram, including your interactions with Cloud Gateway and the PSN. Please note, that this time may incur professional services charges, depending on the complexity of your network.
- PSN assessors do not expect your diagram to include every single device or user. However, the diagram should include:
- Your organisation’s name
- The date the diagram was created
- Local connections with approximate number of users, and details the PSN services and non-PSN services remote connections/remote access
- All external and third-party connections (with names of organisations, business reason for connection and boundaries of responsibility)
- The location of security devices, such as gateways
- Wireless network devices
- Infrastructure and connections that are off-shored
Step 3: Information Assurance and IT Health Check (ITHC)
- The Code of Connection document states that you should maintain policies, procedures and processes that comply with a number of Information Assurance criteria. You do not need to provide evidence of this, but by signing the CoCo, you are agreeing that you meet these requirements.
- Cloud Gateway maintains these policies and procedures as an assured PSN connectivity provider. This is stated in our network diagram templates, and is intended to provide GDS with additional reassurance.
- PSN compliance guidance states that you should provide evidence of an ITHC, including any remediation plans in the event of a ‘critical’ or ‘high’ risk issue being found. GDS will engage with you to assess the state of your organisation’s network and processes, including regularity of security scans, and whether you have a SIEM/SOC in place.
- Cloud Gateway carries out annual IT Health checks under CHECK conditions, which we submit as part of our own PSN and CNSP certification/assurance. The tests (both internal and external) are performed on the core systems that make up the base infrastructure used to deliver PSN design patterns. These tests assess the network for vulnerabilities and ensure that their solution does not provide any unauthorised entry points into systems that consume PSN services.
- A copy of Cloud Gateway’s latest ITHC is held by Government Digital Services as part of our own PSN compliance under our service code SRV_0454. As you are utilising Cloud Gateway’s infrastructure to connect to the PSN, it may assist your application to inform GDS of this.
Step 4: Operational Contact Details
Sharing your operational contact details helps GDS reach the right teams quickly in the event of a problem.
- Download and fill out the form linked here
Step 5: Submission
Collate together your completed artefacts (ensuring they are dated for today’s date) and submit them to GDS here:
public-services-network@digital.cabinet-office.gov.uk
If you like, you can also copy-in your Cloud Gateway account manager or technical contact.
Remember, you will need:
- Your Code of Connection form
- Your network diagram document
- Your operational contact details form
What next?
The time it takes to obtain your compliance certificate is dependent on the GDS assessment team, and their capacity to check your submission. Once you have your certificate, and any other technical gives/gets to deploy your solution, we can commence service onboarding and get you connected to the PSN.
