GDPR security outcomes
This guidance describes a set of technical security outcomes that are considered to represent appropriate measures under the GDPR.
Design Pattern: Safely Exporting Data
How to implement a secure end-to-end data export solution
Reducing data exfiltration by malicious insiders
Advice and recommendations for mitigating this type of insider behaviour.
Scam ‘missed parcel’ SMS messages: advice on avoiding malware
How to avoid malware sent using scam âmissed parcelâ SMS messages, and what to do if your phone is already infected.
Zero trust: building a mixed estate
Two ways organisations can enable access and maintain the security benefits of zero trust even when parts of the infrastructure can’t implement the zero trust principles.
Transaction Monitoring for online services
This guidance is aimed at service owners and security specialists involved in the provision of online services.
Macro Security for Microsoft Office
Why macros are a threat, and the approaches you can take to protect your systems.
Private Branch Exchange (PBX) best practice
Protecting your organisationâs telephony systems from cyber attacks and telecoms fraud.
Mapping your supply chain
How organisations can map their supply chain dependencies, so that risks in the supply chain can be better understood and managed.
Check your email security, and protect your customers
Free online tool from the NCSC prevents cyber criminals using your email to conduct cyber attacks.
Cyber Security Toolkit for Boards: updated briefing pack released
New presentation includes voiceover and insights on ransomware attack on the British Library.
‘NCSC Cyber Series’ podcast now available
Listen to all five episodes now, covering a wide range of cyber security topics.
Making Principles Based Assurance a reality
An update on the work to make Principles Based Assurance (PBA) usable in practice.
Network security fundamentals
How to design, use, and maintain secure networks.
Secure sanitisation and disposal of storage media
How to ensure data cannot be recovered from electronic storage media.
Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances
Outlining the expectations for the minimum requirement for forensic visibility, to help network defenders secure organisational networks both before and after a compromise.
Business communications – SMS and telephone best practice
How to ensure your organisation’s SMS and telephone messages are effective and trustworthy.
Penetration testing
How to get the most from penetration testing
Preserving integrity in the age of generative AI
New âContent Credentialsâ guidance from the NSA seeks to counter the erosion of trust.
A method to assess ‘forgivable’ vs ‘unforgivable’ vulnerabilities
Research from the NCSC designed to eradicate vulnerability classes and make the top-level mitigations easier to implement.
Eradicating trivial vulnerabilities, at scale
A new NCSC research paper aims to reduce the presence of âunforgivableâ vulnerabilities.
ACD 2.0 exploration into attack surface management completed
We thank participants and look forward to sharing what we’ve learned
Passkeys: they’re not perfect but they’re getting better
Passkeys are the future of authentication, offering enhanced security and convenience over passwords, but widespread adoption faces challenges that the NCSC is working to resolve.
Passkeys: the promise of a simpler and safer alternative to passwords
The merits of choosing passkeys over passwords to help keep your online accounts more secure, and explaining how the technology promises to do this
Revolutionising identity services using AI
The âNCSC for Startupsâ alumnus giving identity verification the ‘Trust Stamp’
Applying the Cloud Security Principles in practice: a case study
Using the Cloud Security Principles to evaluate the suitability of a cloud service.
âOur Collaborations With