IT Health Check

As defined by the Cabinet Office, the National Archives (TNA) requires an annual IT health check to be carried out as part of the accreditation process to the PSN. CHECK scheme certified testers, cleared to SC level, will be required to test TNA’s internal and external facing systems. The testing should commence as soon as possible.

External testing must comprise

• Testing of our VPN (Juniper) and mobile device solutions (AirWatch and Blackberry)
• Internet facing web servers
• Perimeter firewalls (1 HA firewall pair)

Internal testing must comprise

• Desktop and server build and configuration, and network management security (our builds include Windows 7, Server 2008 and 2012 R2)
• Patching at operating system, application and firmware level
• Configuration of remote access solutions (as before, Juniper, Blackberry and AirWatch)
• Build and Configuration of laptops and other mobile devices such as phones and tablets used for remote access
• Internal security gateway configuration (2 HA firewall pairs)
• Wireless network configuration

We intend to provide access to around 120 devices covering our entire estate, this will include Desktops, servers, thin clients, iPads and Blackberrys.

The report provided to TNA must meet the following criteria

• It should provide details of the individuals involved in the ITHC
• The report should communicate the background, scope and context of the health check in full
• Vulnerabilities should be accurately identified and explained
• Each identified vulnerability should be associated with a remedial solution. The remedial solution should not be seen as the sole method for reducing the risk - a short-term remedial action may be appropriate until such time that a strategic fix can be put in place.