Browse Definitions :
Definition

CESG Good Practice Guides (GPG)

Contributor(s): Tracey Caldwell

Good Practice Guides (GPG) are documents created by the CESG to help organisations manage risk effectively. CESG is the UK government's national technical authority for information assurance (IA).

CESG Good Practice Guides (GPGs) are supplemented by CESG Developers’ Notes, Cryptographic Standards and Implementation Manuals. Guides may be accessed only by suppliers working with a government department that sponsors the supplier to access one or more of the guides. 

The GPGs were originally written as a set of 35 guides. Some are no longer available because they have become obsolete. Others, which address currently critical topics, are offered on the CESG website.

Some of the Good Practice Guides that have received recent attention are:

  • GPG number 6, which provides guidance on managing the risks of offshoring.
  • GPG number 13, which describes a framework for addressing risks to government systems and includes protective monitoring controls for collecting information and communications technology (ICT) log information and configuring ICT logs in order to produce an audit trail.
  • GPG number 8, which focuses on protecting external connections to the Internet. 
  • GPG number 10, which addresses the risks of remote working.
  • GPG number 12, which provides guidance on managing the security risks of virtualisation for data separation.
  • GPG number 13 forms part of the Code of Connection (CoCo), a prescriptive technical standard that public-sector organizations must meet in order to gain access to the UK Government Connect Secure Extranet.
  • GPG number 18, which describes principles for security forensics.
This was last updated in May 2012

Continue Reading About CESG Good Practice Guides (GPG)

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • PCI DSS (Payment Card Industry Data Security Standard)

    The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to ...

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance framework

    A compliance framework is a structured set of guidelines that details an organization's processes for maintaining accordance with...

SearchSecurity

  • Trojan horse (computing)

    In computing, a Trojan horse is a program downloaded and installed on a computer that appears harmless, but is, in fact, ...

  • identity theft

    Identity theft, also known as identity fraud, is a crime in which an imposter obtains key pieces of personally identifiable ...

  • DNS over HTTPS (DoH)

    DNS over HTTPS (DoH) is a relatively new protocol that encrypts domain name system traffic by passing DNS queries through a ...

SearchHealthIT

  • telemedicine (telehealth)

    Telemedicine is the remote delivery of healthcare services, such as health assessments or consultations, over the ...

  • Project Nightingale

    Project Nightingale is a controversial partnership between Google and Ascension, the second largest health system in the United ...

  • medical practice management (MPM) software

    Medical practice management (MPM) software is a collection of computerized services used by healthcare professionals and ...

SearchDisasterRecovery

SearchStorage

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification and is used in internally mounted ...

  • kilobyte (KB or Kbyte)

    A kilobyte (KB or Kbyte) is a unit of measurement for computer memory or data storage used by mathematics and computer science ...

  • virtual memory

    Virtual memory is a memory management capability of an operating system (OS) that uses hardware and software to allow a computer ...

Close