scope:

This standard applies to information and IT networks that are owned, operated or supported by, or on behalf of, TfL.

'Endpoints' or 'devices' are physical equipment or virtual machines that use or store digital information to provide a service. This includes:

a) Servers, both physical and virtual b) Desktop devices including 'thick' and 'thin' clients

c) Portable devices including laptop and tablet computers (full OS)

d) Mobile devices including tablet computers and smartphones (lite OS)

e) Wearable devices including smart-watches and smart-glasses

f) Printers and multifunction devices that are connected to TfL's systems and networks

g) Removable media including USB, CDs or portable hard drives

h) Any peripherals and accessories used with any of the above that can store or process data including sensors, CCTV or devices that make up the Internet of Things (IoT)

i) Operational technology devices including intelligent electronic devices, remote terminal units, programmable logic controllers, sensors, actuators and meters.

Purpose

The purpose of this standard is to detail the security controls that must be in place to establish secure builds and configurations on all endpoints or devices used on TfL networks and how they must be implemented in line with the Secure builds and configurations policy.