<div data-id="2-2.1" style="text-align: left">2.1 DIP landscape</div>

<html><head></head><body><div data-id="the-admin-portal-is-the-dip-managers-means-of-administering-the-dip-the-user-portal-is-for-dip-users" style="margin-left:0.5in;text-align:justify"><i>The Admin Portal is the <u class="defined-term">DIP Manager</u>’s means of administering the DIP, the user portal is for <u class="defined-term">DIP User</u>s</i></div></body></html>

<html><head></head><body><div data-id="2-2.2" style="text-align: left">2.2 <u class="defined-term">DIP Core Services</u></div></body></html>

<div data-id="2-2.3" style="text-align: left">2.3 DIP Connections</div>

<html><head></head><body><div data-id="2-2.4-2.4.1" style="text-align:justify">2.4.1 There are primarily three different types of <u class="defined-term">DIP User</u>s:</div></body></html>

<div data-id="2-2.5" style="text-align: left">2.5 Active Market Participant</div>

<div data-id="2-2.6" style="text-align: left">2.6 Non-active Market Participant</div>

<html><head></head><body><div data-id="2" style="text-align: left">2 DIP <u class="defined-term">Interface</u>s</div></body></html>

<html><head></head><body><div data-id="3-3.1" style="text-align: left">3.1 The <u class="defined-term">DIP Portal</u></div></body></html>

<div data-id="3-3.2" style="text-align: left">3.2 Registration</div>

<div data-id="3-3.3" style="text-align: left">3.3 PKI Role Governance</div>

<div data-id="3-3.4" style="text-align: left">3.4 Interfacing with the DIP</div>

<div data-id="3" style="text-align: left">3 DIP Access and participant engagement</div>

<div data-id="4-4.1" style="text-align: left">4.1 Overview</div>

<div data-id="4-4.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">4.2 DIP Certificate Authority</div>

<div data-id="4-4.3" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">4.3 Chain of trust</div>

<html><head></head><body><div data-id="digital-certificate-path" style="text-align:justify"><b><u class="defined-term"><u class="defined-term">Digital Certificate</u> Path</u></b></div></body></html>

<html><head></head><body><div data-id="4-4.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">4.4 <u class="defined-term">Digital Certificate</u> usage</div></body></html>

<div data-id="4-4.5" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">4.5 Key management</div>

<html><head></head><body><div data-id="4-4.6" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">4.6 <u class="defined-term">Digital Certificate</u> <u class="defined-term">Revocation</u></div></body></html>

<html><head></head><body><div data-id="4" style="text-align:justify">4 <u class="defined-term">Public Key</u> Infrastructure</div></body></html>

<html><head></head><body><div data-id="the-security-requirements-in-the-dip-rules-are-based-on-national-cyber-security-centre-cyber-assessment-framework-ncsc-caf-recommendations-that-organisations-adopt-a-recognised-baseline-of-security-controls-such-as-those-prescribed-in-iso-27001-or-equivalent-eg-nist-800--53-supplemented-with-a-set-of-enhanced-level-controls-on-which-dip-users-are-reliant-to-protect-the-dip-ecosystem" style="text-align:justify">The security requirements in the <u class="defined-term"><u class="defined-term">DIP Rules</u></u> are based on National Cyber Security Centre Cyber Assessment Framework (NCSC CAF) recommendations that organisations adopt a recognised baseline of security controls such as those prescribed in ISO 27001 (or equivalent, e.g., NIST 800- 53), supplemented with a set of enhanced level controls on which <u class="defined-term"><u class="defined-term">DIP User</u></u>s are reliant to protect the <u class="defined-term">DIP Ecosystem</u>.</div></body></html>

<div data-id="5-5.1" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">5.1 Security requirements</div>

<html><head></head><body><div data-id="the-dip-manager-is-responsible-for-ensuring-the-dip-is-certified-against-iso-27001-certification-shall-be-provided-by-a-ukas-certified-auditing-body" style="text-align:justify">The <u class="defined-term">DIP Manager</u> is responsible for ensuring the DIP is certified against ISO 27001. Certification shall be provided by a UKAS-certified auditing body.</div></body></html>

<html><head></head><body><div data-id="dip-users-shall-carry-out-regular-risk-assessments-of-their-systems-and-interfaces-details-of-how-to-conduct-risk-assessments-can-be-found-in-well-established-assessment-models-such-as-iso-27005-or-hmgs-information-assurance-standards-1-amp-2" style="text-align:justify"><u class="defined-term">DIP User</u>s shall carry out regular risk assessments of their systems and interfaces. Details of how to conduct risk assessments can be found in well-established assessment models, such as ISO 27005 or HMG’s Information <u class="defined-term">Assurance</u> Standards 1 &amp; 2.</div></body></html>

<div data-id="5-5.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">5.2 Information Security Management System certification</div>

<div data-id="5-5.3" style="text-align:justify">5.3 TLS requirements and configuration</div>

<div data-id="5-5.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">5.4 TLS key generation and Certificate Signature Requests</div>

<div data-id="5" style="text-align:justify">5 DIP Security Requirements</div>

<html><head></head><body><div data-id="6-6.1" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.1 <u class="defined-term">DIP User</u>s responsibilities</div></body></html>

<div data-id="6-6.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.2 DNS Domain creation/verification</div>

<html><head></head><body><div data-id="6-6.3" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.3 DIP <u class="defined-term">Digital Certificate</u> requirements</div></body></html>

<html><head></head><body><div data-id="6-6.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.4 <u class="defined-term">Certificate Subscriber</u> obligations</div></body></html>

<html><head></head><body><div data-id="6-6.5" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.5 <u class="defined-term">Relying <u class="defined-term">Party</u></u> Obligations</div></body></html>

<html><head></head><body><div data-id="6-6.6" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.6 Certificate <u class="defined-term">Revocation</u> Request</div></body></html>

<html><head></head><body><div data-id="6-6.7" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.7 <u class="defined-term">Digital Certificate</u> renewal</div></body></html>

<html><head></head><body><div data-id="6-6.8" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.8 <u class="defined-term">Private Key</u>s</div></body></html>

<div data-id="6-6.9" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">6.9 Encryption Secrets/Password Guidance</div>

<html><head></head><body><div data-id="6" style="text-align:justify">6 Managing <u class="defined-term">Digital Certificate</u>s</div></body></html>

<html><head></head><body><div data-id="7-7.1" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.1 DIP <u class="defined-term">Message</u> pattern</div></body></html>

<html><head></head><body><div data-id="7-7.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.2 <u class="defined-term">Message</u> Architecture</div></body></html>

<html><head></head><body><div data-id="7-7.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.4 <u class="defined-term">Message</u>/event channels</div></body></html>

<div data-id="7-7.5" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.5 MPAN Address Maintenance Service</div>

<html><head></head><body><div data-id="7-7.6" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.6 <u class="defined-term">Message</u> structure</div></body></html>

<html><head></head><body><div data-id="7-7.7" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.7 <u class="defined-term">Message</u> routing</div></body></html>

<html><head></head><body><div data-id="7-7.8" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.8 <u class="defined-term">Message</u>/event obfuscation</div></body></html>

<html><head></head><body><div data-id="7-7.9" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.9 <u class="defined-term">Message</u> Compression Handling</div></body></html>

<html><head></head><body><div data-id="7-7.10" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.10 <u class="defined-term">Message</u> De-compression Handling</div></body></html>

<html><head></head><body><div data-id="7-7.11" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.11 <u class="defined-term">Message</u> configuration requirements</div></body></html>

<html><head></head><body><div data-id="7-7.12" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.12 <u class="defined-term">Message</u> Egress</div></body></html>

<html><head></head><body><div data-id="7-7.13" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.13 <u class="defined-term">Message</u> Ingress</div></body></html>

<div data-id="7-7.14" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.14 Capacity Management</div>

<html><head></head><body><div data-id="7-7.15" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.15 <u class="defined-term">Message</u> Security</div></body></html>

<html><head></head><body><div data-id="7-7.16" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">7.16 <u class="defined-term">Message</u> Alarms</div></body></html>

<div data-id="7" style="text-align:justify">7 DIP Messaging</div>

<html><head></head><body><div data-id="8-8.1" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.1 <u class="defined-term">Message</u> choreography</div></body></html>

<html><head></head><body><div data-id="8-8.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.2 Simple <u class="defined-term">Message</u> Exchange</div></body></html>

<div data-id="8-8.3" style="text-align:justify">8.3 Level 1 validation - DIP Synchronous rejection</div>

<div data-id="8-8.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.4 Level 2 validation – DIP asynchronous rejection</div>

<html><head></head><body><div data-id="8-8.5" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.5 Level 3 response - <u class="defined-term">Recipient</u> Synchronous Error (with retry)</div></body></html>

<html><head></head><body><div data-id="8-8.6" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.6 Level 3 validation - <u class="defined-term">Recipient</u> Synchronous Response (no-retry)</div></body></html>

<html><head></head><body><div data-id="8-8.7" style="text-align:justify">8.7 Level 4 validation - <u class="defined-term">Recipient</u> validation response (asynchronous)</div></body></html>

<div data-id="8-8.8" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.8 Consumption Replay</div>

<html><head></head><body><div data-id="8-8.9" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.9 <u class="defined-term">Recipient</u> timeout and ‘Dead-Letter Queue’ handling</div></body></html>

<html><head></head><body><div data-id="8-8.10" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.10 Error Handling &amp; <u class="defined-term">Message</u> Distribution Patterns</div></body></html>

<html><head></head><body><div data-id="8-8.11" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">8.11 Batch <u class="defined-term">Message</u> Handling</div></body></html>

<div data-id="8-8.12" style="text-align:justify">8.12 Workflow message handling</div>

<html><head></head><body><div data-id="8" style="text-align:justify">8 <u class="defined-term">Message</u> choreography</div></body></html>

<html><head></head><body><div data-id="9-9.1" style="text-align:justify">9.1 Send <u class="defined-term">Message</u>s API</div></body></html>

<div data-id="9-9.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.2 Send message DIP Processing (Level 1 Validation)</div>

<html><head></head><body><div data-id="9-9.3" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.3 Receive <u class="defined-term">Message</u> <u class="defined-term">Webhook</u>s</div></body></html>

<html><head></head><body><div data-id="9-9.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.4 Receive <u class="defined-term">Message</u> Call back Request structure</div></body></html>

<html><head></head><body><div data-id="9-9.5" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.5 <u class="defined-term">Recipient</u> responsibilities</div></body></html>

<div data-id="9-9.6" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.6 Replay events</div>

<html><head></head><body><div data-id="9-9.7" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.7 <u class="defined-term">Message</u> return codes and response body</div></body></html>

<div data-id="9-9.8" style="text-align:justify">9.8 DIP API Actions</div>

<div data-id="9-9.9" style="text-align:justify">9.9 API Version Control</div>

<html><head></head><body><div data-id="9-9.10" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.10 <u class="defined-term">Message</u> channel versioning</div></body></html>

<div data-id="9-9.11" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.11 Multi-version support – API and message channels</div>

<html><head></head><body><div data-id="9-9.13" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">9.13 <u class="defined-term">API Key</u> rotation</div></body></html>

<html><head></head><body><div data-id="9" style="text-align:justify">9 Use of APIs and <u class="defined-term">Webhook</u>s</div></body></html>

<div data-id="10-10.1" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">10.1 Digital signatures</div>

<div data-id="10-10.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">10.2 Digital signature formats</div>

<html><head></head><body><div data-id="10-10.3" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">10.3 <u class="defined-term">Message</u> signing</div></body></html>

<div data-id="10-10.4" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">10.4 Verifying signatures</div>

<div data-id="10-10.5" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">10.5 Signature key generation and Certificate Signing Requests</div>

<div data-id="10" style="text-align:justify">10 Signatures</div>

<html><head></head><body><div data-id="11-11.1" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">11.1 Number of channels and <u class="defined-term">DIP User</u>s</div></body></html>

<div data-id="11-11.2" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">11.2 Transactional volumes</div>

<html><head></head><body><div data-id="11-11.3" style="margin-left:0.59in;text-indent:-0.59in;text-align: left">11.3 <u class="defined-term">Message</u> Latency</div></body></html>

<div data-id="11-11.4" style="text-align:justify">11.4 System availability</div>

<div data-id="11" style="text-align:justify">11 DIP capabilities</div>

<div data-id="amendment-record" style="text-align: center">Amendment Record</div>

CONTENTS

DSD002 Annex 2 - Detailed DIP Operational Requirements V1.0

Defined Terms

Cross-references