Cyber Security and Resilience Policy Statement to strengthen regulation of critical sectors
New proposals will combat the growing threat to UK critical national infrastructure (CNI).
Cyber Action Toolkit: breaking down the barriers to resilience
How the NCSC’s ‘Cyber Action Toolkit’ is helping small businesses to improve their cyber security.
NCSC to retire Web Check and Mail Check
By 31 March 2026, organisations should have alternatives to Mail Check and Web Check in place.
EASM buyer's guide now available
How to choose an external attack surface management (EASM) tool that’s right for your organisation.
Cyber security is business survival
The NCSC co-signs Ministerial letter to major British businesses including FTSE 350 companies.
There's a hole in my bucket
...or 'Why do people leave sensitive data in unprotected AWS S3 buckets?'
Getting your organisation ready for Windows 11 upgrade before Autumn 2025
Why you should act now to ensure you meet the new hardware standards, and prioritise security.
Strengthening national cyber resilience through observability and threat hunting
How organisations can improve their ability to both detect and discover cyber threats.
RFC 9794: a new standard for post-quantum terminology
The NCSC’s contribution to the Internet Engineering Task Force will help to make the internet more secure.
Understanding your OT environment: the first step to stronger cyber security
If you can’t see your entire operational technology environment, you can’t defend it. New guidance from the NCSC will help you gain that visibility.
Cyber resilience matters as much as cyber defence
Why planning and rehearsing your recovery from an incident is as vital as building your defences
From bugs to bypasses: adapting vulnerability disclosure for AI safeguards
Exploring how far cyber security approaches can help mitigate risks in generative AI systems
"If you have knowledge, let others light their candles in it."
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
Why more transparency around cyber attacks is a good thing for everyone
Eleanor Fairford, Deputy Director of Incident Management at the NCSC, and Mihaela Jembei, Director of Regulatory Cyber at the Information Commissioner’s Office (ICO), reflect on why it’s so concerning when cyber attacks go unreported – and look at some of the misconceptions about how organisations respond to them.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
Incidents impacting retailers – recommendations from the NCSC
A joint blog post by the NCSC’s National Resilience Director, Jonathon Ellison, and Chief Technology Officer, Ollie Whitehouse.
'NCSC Cyber Series' podcast now available
Listen to all five episodes now, covering a wide range of cyber security topics.
Creating the right organisational culture for cyber security
Calling cyber security professionals, culture specialists and leaders to drive uptake of new Cyber security culture principles.
Have you got what it takes to be a 'Cyber Advisor'?
Become a Cyber Advisor consultant and provide hands-on security advice tailored for SMEs.
Trusting the tech: using password managers and passkeys to help you stay secure online
How today’s secure tools simplify your digital life, and reduce login stress and password fatigue
Products on your perimeter considered harmful (until proven otherwise)
As attackers' tactics change, so must network defenders'.
Sausages and incentives: rewarding a resilient technology future
Why ‘thinking big’ is required to shift the dynamics of the technology market.
New ETSI standard protects AI systems from evolving cyber threats
The NCSC and DSIT work with ETSI to ‘set a benchmark for securing AI’.
Facing the cyber threat behind the headlines
NCSC CEO urges all businesses to face the stark reality of the cyber threat they face, whether in the spotlight or not.
Software Code of Practice: building a secure digital future
New voluntary code of practice for technology providers defines a market baseline for cyber security.
Advanced Cryptography: new approaches to data privacy
A new NCSC paper discusses the suitability of emerging Advanced Cryptography techniques.
Building Web Check using PaaS
How Platform as a Service (PaaS) can make good security easier to achieve.
New guidance on securing HTTP-based APIs
Why it’s essential to secure your APIs to build trust with your customers and partners.
New online training helps board members to govern cyber risk
The NCSC’s CEO, Richard Horne on the new cyber governance resources giving Boards the tools they need to govern cyber security risks.
CyberFirst Girls Competition: a proud milestone and exciting future
The future of the CyberFirst Girls Competition and reflecting on brilliant progress.
Privileged access workstations: introducing our new set of principles
Principles-based guidance for organisations setting up a PAW solution.
Passkeys: they're not perfect but they're getting better
Passkeys are the future of authentication, offering enhanced security and convenience over passwords, but widespread adoption faces challenges that the NCSC is working to resolve.
Passkeys: the promise of a simpler and safer alternative to passwords
The merits of choosing passkeys over passwords to help keep your online accounts more secure, and explaining how the technology promises to do this
Setting direction for the UK's migration to post-quantum cryptography
Why the key milestones for PQC migration are part of building and maintaining good cyber security practice.
A different future for telecoms in the UK
NCSC Technical Director Dr Ian Levy explains the technical impact of the recent US sanctions on the security of Huawei equipment in the UK.
Security, complexity and Huawei; protecting the UK's telecoms networks
With 5G set to transform mobile services, Ian Levy explains how the UK has approached telecoms security, and what that means for the future.
Use of Russian technology products and services following the invasion of Ukraine
Cyber security – even in a time of global unrest – remains a balance of different risks. Ian Levy, the NCSC's Technical Director, explains why.
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
So long and thanks for all the bits
Ian Levy, the NCSC’s departing Technical Director, discusses life, the universe, and everything.
TLS 1.3: better for individuals - harder for enterprises
The NCSC's technical director outlines the challenges that TLS 1.3 presents for enterprise security.
Thinking about the security of AI systems
Why established cyber security principles are still important when developing or implementing machine learning models.
The problems with patching
Applying patches may be a basic security principle, but that doesn't mean it's always easy to do in practice.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
The logic behind three random words
Whilst not a password panacea, using 'three random words' is still better than enforcing arbitrary complexity requirements.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC's new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Thanking the vulnerability research community with NCSC Challenge Coins
Reflecting on the positive impact of the Vulnerability Reporting Service – and introducing something new for selected contributors.
Terminology: it's not black and white
The NCSC now uses 'allow list' and 'deny list' in place of 'whitelist' and 'blacklist'. Emma W explains why...
Telling users to ‘avoid clicking bad links’ still isn’t working
Why organisations should avoid ‘blame and fear’, and instead use technical measures to manage the threat from phishing.
Tackling the 'human factor' to transform cyber security behaviours
ThinkCyber's CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
Supplier assurance: having confidence in your suppliers
Questions to ask your suppliers that will help you gain confidence in their cyber security.
Studies in secure system design
Worked examples for Operational Technology and Virtualised systems, using the NCSC’s secure design principles
Spotlight on shadow IT
New guidance to help organisations manage rogue devices and services within the enterprise.
Smart devices: new law helps citizens to choose secure products
Download the NCSC’s point-of-sale leaflet explaining how new PSTI regulation affects consumers and retailers.
SCADA 'in the cloud': new guidance for OT organisations
If migrating SCADA solutions to the cloud, cyber security must be a key consideration for operational technology organisations.
SBOMs and the importance of inventory
Can a Software Bill of Materials (SBOM) provide organisations with better insight into their supply chains?
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
Revolutionising identity services using AI
The ‘NCSC for Startups’ alumnus giving identity verification the 'Trust Stamp'
Researching the hard problems in hardware security
Introducing the next chapter of the NCSC research problem book, which aims to inspire research on the biggest impact topics in hardware cyber security.
Relaunching the NCSC's Cloud security guidance collection
Andrew A explains what's new in a significant update to the NCSC's flagship cloud guidance.
Refreshed 'cyber security toolkit' helps board members to govern online risk
Lindy Cameron, CEO, introduces changes to the NCSC’s cyber security resources specifically designed for board members.
Ransomware and the cyber crime ecosystem
A new white paper examines the rise of 'ransomware as a service' and extortion attacks.
Raising the cyber resilience of software 'at scale'
New ‘Code of Practice for Software Vendors’ will ensure that security is fundamental to developing and distributing products and services.
QR Codes - what's the real risk?
How safe is it to scan that QR code in the pub? Or in that email?
Protecting how you administer cloud services
New advice on implementing high-risk and ‘break-glass’ accesses in cloud services.
Protecting PBX from cyber attacks
Why small organisations need to manage their private branch exchange (PBX) telephone networks.
Protecting parked domains for the UK public sector
Non-email sending (parked) domains can be used to generate spam email, but they're easy to protect.
Protecting internet-facing services on public service CNI
How operators of critical national infrastructure (CNI) can use NCSC guidance and blogs to secure their internet-facing services.
Protect your management interfaces
Why it's important to protect the interfaces used to manage your infrastructure, and some recommendations on how you might do this.
Principles and how they can help us with assurance
Explaining the forthcoming NCSC Technology Assurance Principles.
Preparing for the long haul: the cyber threat from Russia
Although the UK has not experienced severe cyber attacks in relation to Russia’s invasion of Ukraine, now is not the time for complacency.
Post-quantum cryptography: what comes next?
Jeremy B explains how the NCSC will help organisations plan their migration to PQC.
Pathways: exploring a new way to achieve Cyber Essentials certification
For large, complex firms struggling with the prescriptiveness of Cyber Essentials, ‘Pathways’ will provide a new route to certification.
Our new principles to help make cloud backups more resilient
Introducing a new set of NCSC principles to strengthen the resilience of organisations' cloud backups from ransomware attackers.
Offline backups in an online world
How to protect your backups that are stored in the public cloud.
Not all types of MFA are created equal...
Our updated multi-factor authentication (MFA) guidance recommends organisations use techniques that give better protection against phishing attacks.
New techniques added to the NCSC’s ‘risk management toolbox’
Refreshed guidance published to help practitioners manage cyber risk.
New legislation will help counter the cyber threat to our essential services
The announcement of the Cyber Security and Resilience Bill is a landmark moment in tackling the growing threat to the UK's critical systems.
New cyber security training packages launched to manage supply chain risk
NCSC publishes free e-learning to help organisations manage the cyber security risks across their supply chains.
New cloud guidance: how to 'lift and shift' successfully
Henry O discusses the pitfalls of performing a basic ‘lift and shift’ cloud migration.
New 'Connected Places' infographic published
A new visual guide to the cyber security principles that are essential when developing and managing ‘smart cities’.
NCSC’s Cyber Advisor scheme milestone
Cyber Advisor scheme for small organisations welcomes its 100th advisor, but more still needed!
NCSC's cyber security training for staff now available
The NCSC’s e-learning package 'Top Tips For Staff' can be completed online, or built into your own training platform.
NCSC IT: There's confidence and then there's SaaS
Raising a cheer for SaaS vendors who respond to our cloud security principles.
NCSC For Startups: Vistalworks cracking down on illicit trade
Vicky Brock of Vistalworks describes how the 'NCSC For Startups' programme has helped her organisation develop solutions to tackle illicit online trade.
NCSC For Startups: the feedback loop
How startups can make the most of their time when pitching to cyber security experts.
NCSC for Startups: the case for collaboration
Saj Huq of Plexal explains why collaboration with the NCSC brings opportunities to the cyber security sector.
NCSC For Startups: taking on malvertising
Can your startup help counter the rise of malicious advertising?
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups...
How Rebellion Defence used NCSC For Startups to accelerate product development
Unparalleled access to skilled users transformed Rebellion Defence’s product roadmap.
NCSC for Startups: an ecosystem-based approach to cyber security
Andrew Roughan, CEO of the NCSC’s innovation partner Plexal, explains why a whole-of-society approach is vital for cyber security innovation.
Mythbusting cloud key management services
Why trying to avoid trusting the KMS doesn't make sense (and other common misconceptions).
Motivating developers to write secure code
The 'Motivating Jenny' project is helping to change the conversation about security in software development.
Migrating to post-quantum cryptography
New guidance from the NCSC helps system and risk owners plan their migration to post-quantum cryptography (PQC).
Mastering your supply chain
A new collection of resources from the NCSC can help take your supply chain knowledge to the next level
Market incentives in the pursuit of resilient software and hardware
A new paper from the ONCD explores how metrics can influence markets to improve the cyber security ecosystem.
Making the UK the safest place to live and do business online
The NCSC's Chief Executive Ciaran Martin outlines why the UK needs a National Cyber Security Centre.
Making Principles Based Assurance a reality
An update on the work to make Principles Based Assurance (PBA) usable in practice.
Machine learning security principles updated
Revised principles will help people make the right security decisions when developing systems with AI/ML components.
Looking back at the ballot – securing the general election
NCSC CEO Felicity Oswald shares reflections on keeping the 2024 General Election safe.
Leveraging NCSC’s national insight to strengthen the fight against mobile threats
Traced Mobile Security co-founder Benedict Jones describes how 'NCSC for Startups' helped evolve his business.
Introducing the guidelines for secure AI
New guidelines will help developers make informed decisions about the design, development, deployment and operation of their AI systems.
Introducing Cyber Advisors...
Launching a new Industry Assurance scheme aimed at helping the UK’s small organisations.
Introducing Active Cyber Defence 2.0
ACD 2.0 aims to build the next generation of services in partnership with industry and academia.
Interactive administration in the cloud: managing the risks
Tips to help you secure and reduce interactive access to your cloud infrastructure.
Intelligent security tools: are they a smart choice for you?
What you need to know before buying artificially intelligent security products
Identifying suspicious credential usage
How NCSC guidance can help organisations detect and protect themselves from credential abuse.
How to talk to board members about cyber
New guidance helps CISOs communicate with Boards to improve oversight of cyber risk.
How the NCSC thinks about security architecture
Richard C explains how an understanding of vulnerabilities - and their exploitation - informs how the NCSC assesses the security of computer systems.
How CyberFish's founder got hooked on Cheltenham
Berta Pappenheim, CEO and co-founder of CyberFish, explains how the NCSC For Startups programme has transformed her professional and personal life.
Helping banish malicious adverts – and drive a secure advertising ecosystem
If your brand uses digital advertising, the NCSC has new guidance to help you choose a security-minded partner.
Funded cyber certification helps small charities to provide legal aid to vulnerable citizens
How the funded Cyber Essentials Programme helped the ‘Law Centres Network’ protect its IT estate - and client data - from cyber attacks.
From the cyber proliferation threat all the way to Pall Mall
The first dedicated conference on this topic – and an insight into the NCSC assessment work behind it.
Exercise caution when building off LLMs
Large Language Models are an exciting technology, but our understanding of them is still 'in beta'.
Eradicating trivial vulnerabilities, at scale
A new NCSC research paper aims to reduce the presence of ‘unforgivable’ vulnerabilities.
Equities process
Publication of the UK’s process for how we handle vulnerabilities.
Early Warning is joining MyNCSC
Early Warning, one of the NCSC’s flagship ACD services, will be soon be migrated to the MyNCSC platform. Here we explain the background and what users can expect.
Drawing good architecture diagrams
Some tips on good diagram drafting and pitfalls to avoid when trying to understand a system in order to secure it.
Digital twins: secure design and development
How existing NCSC guidance can assist those looking to develop and deploy ‘digital twins’.
Defending software build pipelines from malicious attack
Compromise of your software build pipeline can have wide-reaching impact; here's how to tackle the problem.
Data-driven cyber: empowering government security with focused insights from data
How 'small but actionable' insights can improve behaviours and decision making.
New interactive video - and related downloads - to help secondary school kids stay safe online
A new initiative, aimed at 11 to 14-year-olds, that helps them navigate the risks of online life.
Cyber Security Toolkit for Boards: updated briefing pack released
New presentation includes voiceover and insights on ransomware attack on the British Library.
Cyber security for schools
New NCSC training package to help schools improve their cyber security.
Cyber Resilience Audit scheme open to applications
A new NCSC scheme assuring providers of CAF-based audits is now open for potential members.
Cyber Resilience Audit (CRA) scheme launches for assured CAF-based audits
NCSC-assured CRA service now offering Cyber Assessment Framework based audits and more applications invited from potential service providers.
Cyber Essentials: are there any alternative standards?
Can an equivalent cyber security standard deliver the same outcomes as the NCSC’s Cyber Essentials scheme?
Cyber Essentials Plus is for charities too!
Sara Ward, the CEO of Black Country Women's Aid, discusses her organisation's experience of gaining Cyber Essentials Plus certification.
Cyber Essentials 'Pathways': From experiment to proof of concept
We are encouraging large organisations to help us develop an alternative route to certification.
Cyber Assessment Framework 3.2
Latest version of the CAF reflects the increased threat to critical national infrastructure
CNI system design: Secure Remote Access
A Critical National Infrastructure (CNI)-specific look at NCSC guidance on remote access architecture design
Check your email security, and protect your customers
Free online tool from the NCSC prevents cyber criminals using your email to conduct cyber attacks.
ChatGPT and large language models: what's the risk?
Do loose prompts* sink ships? Exploring the cyber security issues of ChatGPT and LLMs.
Bring Your Own Device: How to do it well
Updated NCSC guidance on enabling your staff to use their own devices for work.
Business email compromise: new guidance to protect your organisation
How to disrupt targeted phishing attacks aimed at senior executives or budget holders.
Building on our history of cryptographic research
The NCSC has published new cryptographic research on robust cryptography – we explain its significance and how the ideas could support research to inform future global standards.
Building a nation-scale evidence base for cyber deception
The NCSC is inviting UK organisations to contribute evidence of cyber deception use cases and efficacy to support our long-term research goals.
Are you hungry? A two-part blog about risk appetites
Risk appetites; what are they, what’s their purpose, how do organisations go about defining them?
Applying the Cloud Security Principles in practice: a case study
Using the Cloud Security Principles to evaluate the suitability of a cloud service.
Announcing IASME as our second Delivery Partner for Cyber Incident Response Level 2
Both CIR Delivery Partners are now accepting enquiries and applications.
An RFC on IoCs – playing our part in international standards
The NCSC has published a new RFC on Indicators of Compromise to support cyber security in protocol design - and hopes to encourage more cyber defenders to engage with international standards.
AIT fraud: what you need to know
SMS and telephone guidance updated to address the rise in Artificial Inflation of Traffic (AIT).
Artificial Intelligence: 'call for views' on the cyber security of AI closes soon
Businesses, academia and international partners invited to respond to the UK government's ‘call for views’ on the security of AI.
Advanced Mobile Solutions (AMS) guidance trailer
Chris P explains how AMS will enable high-threat organisations to stay connected ‘on the go'.
Active Cyber Defence: Sixth annual report now available
New ACD services developed to help protect SMEs from the harms caused by cyber attacks.
ACD 2.0: Insights from the external attack surface management trials
We publish the results of our ACD 2.0 external attack surface management (EASM) trials
ACD 2.0 exploration into attack surface management completed
We thank participants and look forward to sharing what we've learned
Accessibility as a cyber security priority
Want security that works better for people? Make it accessible.
A problem shared is . . . in the research problem book
Introducing the new NCSC research problem book and find out how you can get involved.
A decade of Cyber Essentials: the journey towards a safer digital future
The 10-year anniversary of Cyber Essentials is not just a celebration of past achievements but a call to action for the future.
'PDNS for Schools' to provide cyber resilience for more institutions
The NCSC’s ‘Protective Domain Name Service for Schools’ scaled-up to protect a wider range of organisations.
"Winning trust, and making powerful connections"
Chris Wallis, CEO of Intruder, explains how completing the NCSC's Startup Programme was a turning point for his organisation.
"What's happened to my data?"
Irrespective of whether the ransom is paid, a ransomware attack means organisations have lost control of their information.
Vulnerability Scanning: Keeping on top of the most common threats
Vulnerability Scanning solutions offer a cost-effective way to discover and manage common security issues.
Zero trust 1.0
Zero trust architecture design principles 1.0 launched.
Why cloud first is not a security problem
Using the cloud securely should be your primary concern - not the underlying security of the public cloud.
Protecting system administration with PAM
Remote system administration provides powerful and flexible access to systems and services.
What exactly should we be logging?
A structured look at what data to collect for security purposes and when to collect it.
Preserving integrity in the age of generative AI
New ‘Content Credentials’ guidance from the NSA seeks to counter the erosion of trust.
Assured Cyber Incident Response scheme – important updates
We’ve updated the CIR 'Enhanced Level' scheme standard and will be ready to accept applications in the new year.
Three random words or #thinkrandom
Ian M discusses what makes a good password
What does the NCSC think of password managers?
Emma W discusses the question everyone keeps asking us.
Celebrating eight years of being the NCSC – a part of GCHQ
As Felicity Oswald hands over to the new NCSC CEO, she reflects on why cyber security and intelligence are so connected.
Navigating the different cyber services from the NCSC
If you don’t have the inhouse expertise to keep your organisation cyber secure, the NCSC offers services and tools to help organisations guard against commodity threats.
Introducing the NCSC's ‘Share and Defend’ capability
Join the community of service providers helping to protect the UK from cyber attacks.
Watch all the plenaries from CYBERUK 2024 live, and for free
Key talks from the UK government’s flagship cyber security event will be livestreamed from Birmingham’s ICC.
Unleashing the power of cloud with containerisation
New NCSC guidance describes how organisations can make the most of containerisation.
NCSC for Startups: Playing cyber criminals at their own game
CounterCraft's co-founder, Dan Brett, explains how they turn the tables so that social engineering can be used to protect organisations from attackers.
Landing at the NCSC (glad I brought my towel)
Ollie Whitehouse, the NCSC’s new Chief Technology Officer, outlines the cyber security challenges he’ll be prioritising.
Logging Made Easy with CISA
The US Cybersecurity and Infrastructure Security Agency have relaunched an updated version of LME.
To SOC or not to SOC ?
For environments that are secure by design, a 'full-fat SOC' is not always required.
Zero trust migration: How will I know if I can remove my VPN?
In our third blog about migrating to a zero trust architecture, we consider the security properties of an Always On VPN, and the factors to consider when deciding if you no longer need one.
Using MSPs to administer your cloud services
Andrew A explains what you must check before giving Managed Service Providers (MSPs) the keys to your kingdom.
'WannaCry' ransomware: guidance updates
Jon L provides an update on the NCSC's guidance on the 'WannaCry' ransomware.
We think Cyber Essentials is, well, still essential ...
...and that's why we are making some changes. Anne W summarises what they are, and explains the thinking behind them.
Zero Trust migration: where do I start?
How to start the journey to zero trust architecture once you have decided it meets your business requirements.
Why vulnerabilities are like buses
How organisations can address the growing trend in which multiple vulnerabilities within a single product are exploited over a short period.
Serving up some server advice
Highlighting guidance which will help you secure your servers
What is OT malware?
How malware works on Operational Technology (OT) and how to stop it.
The elephant in the data centre
A new white paper from the NCSC explains the potential benefits of adopting a cloud-system.
