PSN CoCo: UK Public Services Network Code of Connection

The Public Services Network (PSN) Code of Connection (CoCo) defines the security requirements that organizations must meet to connect to the UK's PSN — the government network that enables secure data sharing between public sector organizations. PSN connectivity is essential for local authorities, central government departments, NHS organizations, and their technology partners to access government services and share data securely.

What PSN CoCo Covers

The Code of Connection requires organizations to demonstrate adequate security controls across several domains. The cornerstone requirement is the IT Health Check (ITHC) — a comprehensive penetration test conducted by a CHECK-approved or CREST-certified tester that identifies vulnerabilities in the organization's network boundary and connected systems.

Beyond the ITHC, PSN CoCo requires evidence of patch management, network boundary protection, access control, user authentication, incident management, and compliance with PSN-specific connectivity and addressing requirements. Organizations must demonstrate that they have addressed all critical and high-severity findings from the ITHC before compliance is granted.

Who Needs PSN CoCo Compliance

Any organization that connects to the PSN must maintain annual CoCo compliance. This includes local councils, central government departments, NHS bodies, police forces, fire and rescue services, and their IT service providers and managed service partners. Technology vendors providing cloud services or managed IT to PSN-connected organizations must ensure their infrastructure meets PSN requirements.

Implementation Approach

Engage a CHECK-approved or CREST-certified tester to conduct the IT Health Check. The ITHC typically covers external network boundaries, internal network, wireless networks, and web applications connected to or accessible from the PSN. Remediate all critical and high-severity findings. Prepare the compliance submission documenting your security controls and ITHC results. Submit through the PSN compliance portal for review and approval.

Cost Considerations

PSN CoCo compliance costs $20,000 to $150,000 annually depending on network complexity and the number of connected sites. The ITHC alone typically costs $10,000 to $50,000 depending on scope. Remediation of findings can add significant costs if critical vulnerabilities are discovered. Organizations should budget for both the testing and remediation phases. The ongoing annual requirement means these costs are recurring.