Secure by Design
W.O.L.F applies security controls across managed devices, private access, administrative services, lifecycle actions, recovery and evidence capture.
The current pilot contains working and technically demonstrated controls. Formal classification, independent assurance, residual-risk acceptance and authority to operate remain decisions for the appropriate Defence authorities.
Assurance pendingWorking pilot
10
Functional dashboard
One active project
In development
The pilot has demonstrated a functioning managed-device and service environment, but technical implementation does not itself constitute formal assurance or permission for wider use.
Continue as a controlled pilot while priority governance, assurance, monitoring, recovery and evidence actions are completed.
W.O.L.F is being developed against the seven Secure by Design principles. The current position is a working technical pilot with partial evidence; formal governance, assurance and approval remain outstanding.
Current: The capability, users, Key User Requirements, assets and current VPS boundary are documented.
Outstanding: Confirm classification, approved operating context, risk appetite and formal registration.
Current: Security objectives, priority actions and trial activities are recorded.
Outstanding: Appoint suitably qualified personnel and approve resources, milestones and the assurance plan.
Current: Technical, operational, hosting and through-life risks are recorded.
Outstanding: Approve the risk method, owners, treatment dates, escalation criteria and decisions.
Current: Device, VPN, identity, Guardian, administrative and change controls are demonstrated in the pilot.
Outstanding: Complete requirement-to-risk-to-control-to-evidence traceability and independent effectiveness review.
Current: Principal software, hosting, hardware and support dependencies are known.
Outstanding: Complete the SBOM, support and end-of-life register, provider-access assessment, contractual review and exit plan.
Current: Build, isolation, MFA, revoke, wipe and network evidence has been recorded.
Outstanding: Complete independent architecture review, penetration testing, phased load testing and full recovery exercises.
Current: Support, training, infrastructure, hosting, recovery and disposal needs are recognised.
Outstanding: Approve funding, ownership, support depth, training, spares, migration, disposal and service-exit arrangements.
These eight areas translate the seven Secure by Design principles into the practical assurance work required for W.O.L.F.
Named ownership, risk responsibility, security leadership and approval routes must be established.
Permitted uses, prohibited uses, classification, retention and information-handling rules require formal decisions.
Managed devices, private connectivity, application services, administration and lifecycle-command flows require maintained and independently reviewed boundaries.
Managed identities, MFA, administrative separation, account lifecycle, key rotation and periodic access review are required.
Device preparation, registration, check-in, access removal, lock or wipe, recovery, rebuild and disposal require controlled procedures.
Controlled changes, component inventory, open-source review, vulnerability management, patching and obsolescence must be managed through life.
Audit, central monitoring, alerting, incident procedures, backups, restoration and disaster recovery require defined ownership and testing.
Requirements, risks, controls, test results, independent review and residual-risk decisions must remain traceable.
Security evidence and approval apply to a specific hosting model and scale. Approval of one environment does not automatically approve another.
The commercially hosted VPS is the only hosting model with current implementation evidence. W.O.L.F controls the guest operating system, services, accounts, VPN and backup processes, while the provider retains control of the underlying infrastructure.
Boundary: Controlled pilot only, subject to an approved VPS hosting profile and conditions of use.
A separate assessment is required for provider or datacentre access, remote-management interfaces, hardware failure, disk handling, recovery and provider exit.
Boundary: Do not migrate until the hosting profile, testing and risk decision are approved.
A separate assessment is required for physical security, network separation, power, cooling, environmental monitoring, support, spares, off-site recovery and secure disposal.
Boundary: Do not install or operate until the site and hosting profile are approved.
A secondary environment may support backup, restoration or migration but requires isolated recovery credentials, integrity checks, tested restore and activation authority.
Boundary: Use only following an approved recovery design and exercise.
Progression from the current pilot would use staged gates of approximately 10–20, 40–50 and up to 100 phones.
Boundary: Progress only when capacity, monitoring, support, recovery, security and governance gates are met.
The strongest current controls reduce public exposure, protect administrative access, maintain device accountability and support controlled recovery.
Selected application services are reached through restricted private access rather than direct public exposure.
Administrative access to the dashboard uses multi-factor authentication.
Project-specific SSH keys, administrative access and isolated workspaces reduce cross-project access.
Unsafe or ambiguous administrative access paths are intended to stop rather than silently fall back.
Phones use a defined security baseline, application controls and restricted service access.
Destructive actions are guarded, confirmed and audited, with destructive capability disabled by default.
Private and application access can be removed from a lost, returned or compromised device.
Controlled Android lock and wipe behaviour has been demonstrated in testing.
Changes use inspected source, backups, hashes, validation and rollback preparation.
Build and backup workflows support restoration and repeatable recovery, although full resilience evidence remains incomplete.
Partial evidenceThe current risk position remains provisional. The following areas require treatment, evidence and accountable decisions before wider use.
The formal risk ratings, ownership and acceptance decisions remain part of the controlled assurance record.
Loss or exposure of several hosted services through a common infrastructure failure.
Loss of privileged credentials or administrative control.
Unauthorised administration through compromised project access.
Unintended access between project workspaces, keys or state.
Disclosure of communications, files, locations or credentials.
Accidental or unauthorised device lock or wipe.
Compromise through vulnerable, unsupported or poorly governed dependencies.
Security events may not be detected or investigated promptly.
Extended outage or unrecoverable loss following compromise or error.
Use before classification, assurance and operating limits are formally decided.
Provider access, platform compromise or service failure affecting the VPS environment.
On-premises physical security, power, cooling or environmental failures affecting a future deployment.
Unauthorised access through a future dedicated-hosting remote-management interface.
Loss of control, availability or separation when moving between hosting models.
Data left behind after provider closure, hardware replacement or decommissioning.
Insufficient hardware, spares or local competence to sustain a future hosting model.
Capacity, monitoring, support or recovery may not keep pace with a larger trial.
Operational dependence on commercial mobile connectivity for the pilot service.
The following actions are required to progress the capability from an individual working pilot towards a governed and supportable evaluation.
Appoint the SRO or equivalent, Information Owner, Security Lead or SAC, service owners and risk owners.
Complete the applicable Secure by Design, CAAT, Vigilant or DART registration process.
Define permitted information, handling rules, operational boundaries and review conditions.
Confirm the operational requirement, success measures, staged scale gates and evidence route.
Define the VPS boundary, provider responsibility, access controls, recovery and exit arrangements.
Complete separate hosting profiles and risk decisions before any future migration.
Maintain an SBOM, support status, patch cycle, severity-based treatment and end-of-life register.
Introduce central security monitoring, alert use cases, protected retention and accountable review.
Complete restore, server-loss and provider-account recovery exercises.
Demonstrate live-project isolation, role isolation and phased 100-device load behaviour.
Define incident, lost-device, evidence-preservation, access-removal and destructive-action procedures.
Complete independent architecture, hosting and penetration testing, followed by tracked remediation.
Define funding, support depth, training, infrastructure, spares and ownership arrangements.
Define migration, secure disposal and service-exit arrangements for each hosting model.
The accountable authority must decide the residual risk and authorisation position for each hosting model.
Evidence must be understood according to what it can legitimately support. A working control is not automatically an independently assured or formally authorised control.
A stated approach, configuration, procedure or reported position exists.
A controlled test or observed action has been recorded.
The control has been demonstrated in the current pilot environment.
Independent assessment or formal authority evidence has been commissioned, completed and accepted.
W.O.L.F cannot approve or authorise itself. Formal permission, conditions, accepted risks and validity must be recorded by the appropriate accountable authorities.
Not formally accepted. Material governance, monitoring, recovery, supply-chain and independent-assurance gaps remain.
The accountable authorities must decide whether to:
Controlled pilot only within approved information and operating limits.
Not authorised until separately assessed, tested and approved.
Not authorised until the site, infrastructure, support, recovery and disposal arrangements are approved.
Proposed phased trial, subject to scale gates.
Review quarterly and after significant change, migration, scale change or security incident.