diff --git a/plat/arm/board/juno/juno_security.c b/plat/arm/board/juno/juno_security.c
index 1de38c3..f9386ca 100644
--- a/plat/arm/board/juno/juno_security.c
+++ b/plat/arm/board/juno/juno_security.c
@@ -29,6 +29,7 @@
  */
 
 #include <mmio.h>
+#include <nic_400.h>
 #include <plat_arm.h>
 #include <soc_css.h>
 #include "juno_def.h"
@@ -48,12 +49,25 @@
 }
 
 /*******************************************************************************
+ * Program CSS-NIC400 to allow non-secure access to some CSS regions.
+ ******************************************************************************/
+static void css_init_nic400(void)
+{
+	/* Note: This is the NIC-400 device on the CSS */
+	mmio_write_32(PLAT_SOC_CSS_NIC400_BASE +
+		NIC400_ADDR_CTRL_SECURITY_REG(CSS_NIC400_SLAVE_BOOTSECURE),
+		~0);
+}
+
+/*******************************************************************************
  * Initialize the secure environment.
  ******************************************************************************/
 void plat_arm_security_setup(void)
 {
 	/* Initialize the TrustZone Controller */
 	arm_tzc_setup();
+	/* Do ARM CSS internal NIC setup */
+	css_init_nic400();
 	/* Do ARM CSS SoC security setup */
 	soc_css_security_setup();
 	/* Initialize the SMMU SSD tables*/
diff --git a/plat/arm/soc/common/soc_css_security.c b/plat/arm/soc/common/soc_css_security.c
index 36f59ea..37fd37c 100644
--- a/plat/arm/soc/common/soc_css_security.c
+++ b/plat/arm/soc/common/soc_css_security.c
@@ -30,17 +30,10 @@
 
 #include <board_css_def.h>
 #include <mmio.h>
+#include <nic_400.h>
 #include <platform_def.h>
 #include <soc_css_def.h>
 
-/*
- * Address of slave 'n' security setting in the NIC-400 address region
- * control
- * TODO: Ideally this macro should be moved in a "nic-400.h" header file but
- * it would be the only thing in there so it's not worth it at the moment.
- */
-#define NIC400_ADDR_CTRL_SECURITY_REG(n)	(0x8 + (n) * 4)
-
 void soc_css_init_nic400(void)
 {
 	/*
@@ -70,13 +63,6 @@
 		NIC400_ADDR_CTRL_SECURITY_REG(SOC_CSS_NIC400_BOOTSEC_BRIDGE),
 		~SOC_CSS_NIC400_BOOTSEC_BRIDGE_UART1);
 
-	/*
-	 * Allow non-secure access to some CSS regions.
-	 * Note: This is the NIC-400 device on the CSS
-	 */
-	mmio_write_32(PLAT_SOC_CSS_NIC400_BASE +
-		NIC400_ADDR_CTRL_SECURITY_REG(CSS_NIC400_SLAVE_BOOTSECURE),
-		~0);
 }