Skip to main content
Policy paper

Software security ambassadors: group 1 signatories

Updated 3 November 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/software-security-ambassadors-scheme/software-security-ambassadors-group-1-signatories

The Department for Science, Innovation and Technology was replaced by the Department for Digital, Media, Culture and Sport.

Organisations that sign up to this scheme are committing to become ambassadors of the Software Security Code of Practice. They will role model the implementation of the code, champion awareness of the code, encourage its adoption, and showcase and exchange information on their real-world success stories and use cases.

The commitment

My organisation makes a public commitment to achieve the following objectives in one year: 

All signatories

  • promote the Software Security Code of Practice on our social media, websites and, where possible, at National Cyber Security Centre and /or Department for Science, Innovation and Technology events.
  • endeavour to showcase real-world success stories and use cases on our journey to achieve the below objectives and implementing the Software Security Code of Practice in our organisation and supply chains.
  • reflect on incidents and lessons-learned to inform continuous improvement of organisational practices and government policy (where appropriate).

Software suppliers

  • appoint a Senior Responsible Owner to hold accountability for the implementation of the Software Security Code of Practice. 
  • complete and publish the self-assessment form or third party verification to demonstrate compliance with the principles of the Software Security Code of Practice. 
  • put in place measures to ensure relevant teams develop the necessary skills and expertise on secure software development and provide access to appropriate learning and development opportunities.
  • [If a DSP/ consultant] encourage clients and collaborators to adopt the Software Security Code of Practice and embed the principles of the code into software developed collaboratively.

Software buyers

  • incorporate the Software Security Code of Practice into procurement policies and procedures for supplier management of our software suppliers.

Expert advisors

  • promote the Software Security Code of Practice through advisory/ educational services and other business.
  • if applicable, incorporate the Software Security Code of Practice into requirements for relevant partner organisations.

Signatories

  • Department for Science, Innovation and Technology
  • National Cyber Security Centre
  • Accenture
  • Cisco
  • Hexiosec
  • ISACA
  • ISC2
  • Lloyds Banking Group
  • NCC Group
  • Nexor
  • Palo Alto Networks
  • Sage
  • Salus
  • Santander
  • Zaizi

Important: If you want to refer to UK government software security policy requirements when assessing suppliers, procurement and commercial teams should use the Software Security Code of Practice Self-Assessment. It gives a suitable way to check how well a supplier follows the code.

The Software Security Ambassador scheme is not an assessment scheme. It only aims to raise awareness of the Software Security Code of Practice and encourage people to use it. Do not use membership of the scheme as a criterion in procurement or tendering

Back to top