Policy paper

Software security ambassadors: group 2 signatories

Updated 3 November 2026

Organisations that sign up to this scheme are committing to become ambassadors of the Software Security Code of Practice. They will role model the implementation of the code, champion awareness of the code, encourage its adoption, and showcase and exchange information on their real-world success stories and use cases.

The commitment

My organisation makes a public commitment to achieve the following within one year of signing up to this scheme:

All signatories:

• promote the Software Security Code of Practice on social media, websites and, where possible, at National Cyber Security Centre (NCSC) or Department for Digital, Culture, Media and Sport (DCMS) events
• endeavour to share real-world success stories and use cases on our journey to achieve the objectives of this scheme and implement the code in our organisation and supply chains
• reflect on incidents and lessons learned to inform continuous improvement of organisational practices and government policy, where appropriate
• provide feedback on options for a DCMS and NCSC Software Security Certification Scheme

Software suppliers:

• appoint a Senior Responsible Owner to hold accountability for the implementation of the Software Security Code of Practice
• complete and publish the self-assessment form or third-party verification to demonstrate compliance with the principles of the code
• assist in the testing of a third-party assessment of compliance with the Software Security Code of Practice through the DCMS and NCSC pilot certification scheme
• put in place measures to ensure relevant teams develop the necessary skills and expertise on secure software development and provide access to appropriate learning and development opportunities
• where relevant, encourage adoption of the code’s principles in client organisations when developing software collaboratively

Software buyers:

• incorporate the code of practice into procurement policies and procedures for supplier management of our software suppliers
• encourage suppliers to complete the self-assessment form, share it with them and/or encourage suppliers to publish such form once completed

As an expert advisor, my organisation also commits to:

• promote the code of practice through advisory services and other business
• where applicable, incorporate the code of practice into requirements for relevant partner organisations

Signatories

• Department for Digital, Culture, Media and Sport
• National Cyber Security Centre
• Acubed IT Solutions Limited
• Capgemini
• CloudPeek
• Dot On
• Fortinet
• Hippo Digital
• Investec
• IoT M2M Council
• Nine23
• QinetiQ
• Risk Ledger
• SANS Institute
• Thales
• Zscaler

Important: If you want to refer to UK government software security policy requirements when assessing suppliers, procurement and commercial teams should use the Software Security Code of Practice Self-Assessment. It gives a suitable way to check how well a supplier follows the code.

The Software Security Ambassador scheme is not an assessment scheme. It only aims to raise awareness of the Software Security Code of Practice and encourage people to use it. Do not use membership of the scheme as a criterion in procurement or tendering.