NCSC to retire Web Check and Mail Check
By 31 March 2026, organisations should have alternatives to Mail Check and Web Check in place.
Strengthening national cyber resilience through observability and threat hunting
How organisations can improve their ability to both detect and discover cyber threats.
Creating the right organisational culture for cyber security
Calling cyber security professionals, culture specialists and leaders to drive uptake of new Cyber security culture principles.
Software Code of Practice: building a secure digital future
New voluntary code of practice for technology providers defines a market baseline for cyber security.
Advanced Cryptography: new approaches to data privacy
A new NCSC paper discusses the suitability of emerging Advanced Cryptography techniques.
Cyber Resilience Audit scheme open to applications
A new NCSC scheme assuring providers of CAF-based audits is now open for potential members.
Watch all the plenaries from CYBERUK 2024 live, and for free
Key talks from the UK government’s flagship cyber security event will be livestreamed from Birmingham’s ICC.
Interactive administration in the cloud: managing the risks
Tips to help you secure and reduce interactive access to your cloud infrastructure.
Cyber security is business survival
The NCSC co-signs Ministerial letter to major British businesses including FTSE 350 companies.
There’s a hole in my bucket
…or ‘Why do people leave sensitive data in unprotected AWS S3 buckets?’
Moving your business from the physical to the digital
Security questions to ask your IT service providers when considering a digital transition
Strengthening national cyber resilience through observability and threat hunting
How organisations can improve their ability to both detect and discover cyber threats.
Phishing attacks: defending your organisation
How to defend your organisation from email phishing attacks.
Maintaining a sustainable strengthened cyber security posture
How organisations can avoid staff burnout during an extended period of heightened cyber threat.
RFC 9794: a new standard for post-quantum terminology
The NCSC’s contribution to the Internet Engineering Task Force will help to make the internet more secure.
Putting staff welfare at the heart of incident response
Guidance for staff responsible for managing a cyber incident response within their organisation.
Understanding your OT environment: the first step to stronger cyber security
If you can’t see your entire operational technology environment, you can’t defend it. New guidance from the NCSC will help you gain that visibility.
Early Years practitioners: using cyber security to protect your settings
How to protect sensitive information about your setting and the children in your care from accidental damage and online criminals.
Products on your perimeter considered harmful (until proven otherwise)
As attackers’ tactics change, so must network defenders’.
New online training helps board members to govern cyber risk
The NCSC’s CEO, Richard Horne on the new cyber governance resources giving Boards the tools they need to govern cyber security risks.
Setting direction for the UK’s migration to post-quantum cryptography
Why the key milestones for PQC migration are part of building and maintaining good cyber security practice.
Navigating the different cyber services from the NCSC
If you don’t have the inhouse expertise to keep your organisation cyber secure, the NCSC offers services and tools to help organisations guard against commodity threats.
RITICS: Securing cyber-physical systems
Discover the Research Institute in Trustworthy Inter-connected Cyber-physical Systems.
NCSC’s Cyber Advisor scheme milestone
Cyber Advisor scheme for small organisations welcomes its 100th advisor, but more still needed!
EASM buyer’s guide now available
How to choose an external attack surface management (EASM) tool that’s right for your organisation.
External attack surface management (EASM) buyer’s guide
A guide to choosing the right EASM product for your organisation, and the security features you need to consider.
Buying, selling and donating second-hand devices
How to erase the personal data from your phone, tablets, and other devices (and why it’s important when you’re buying and selling them).
Cyber resilience matters as much as cyber defence
Why planning and rehearsing your recovery from an incident is as vital as building your defences
“If you have knowledge, let others light their candles in it.”
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
Protecting internet-facing services on public service CNI
How operators of critical national infrastructure (CNI) can use NCSC guidance and blogs to secure their internet-facing services.
ACD 2.0: Insights from the external attack surface management trials
We publish the results of our ACD 2.0 external attack surface management (EASM) trials
Cyber Essentials Plus is for charities too!
Sara Ward, the CEO of Black Country Women’s Aid, discusses her organisation’s experience of gaining Cyber Essentials Plus certification.
From bugs to bypasses: adapting vulnerability disclosure for AI safeguards
Exploring how far cyber security approaches can help mitigate risks in generative AI systems
Social Media: how to use it safely
Use privacy settings across social media platforms to manage your digital footprint.
So long and thanks for all the bits
Ian Levy, the NCSC’s departing Technical Director, discusses life, the universe, and everything.
TLS 1.3: better for individuals – harder for enterprises
The NCSC’s technical director outlines the challenges that TLS 1.3 presents for enterprise security.
NCSC IT: There’s confidence and then there’s SaaS
Raising a cheer for SaaS vendors who respond to our cloud security principles.
Pathways: exploring a new way to achieve Cyber Essentials certification
For large, complex firms struggling with the prescriptiveness of Cyber Essentials, ‘Pathways’ will provide a new route to certification.
New techniques added to the NCSC’s ‘risk management toolbox’
Refreshed guidance published to help practitioners manage cyber risk.
“If you have knowledge, let others light their candles in it.”
Why sharing lessons learned from cyber security incidents and ‘near misses’ will help everyone to improve
Why more transparency around cyber attacks is a good thing for everyone
Eleanor Fairford, Deputy Director of Incident Management at the NCSC, and Mihaela Jembei, Director of Regulatory Cyber at the Information Commissioner’s Office (ICO), reflect on why it’s so concerning when cyber attacks go unreported – and look at some of the misconceptions about how organisations respond to them.
Cyber security for high profile conferences
Managing the cyber security of high profile events in the real and virtual worlds.
Actions to take when the cyber threat is heightened
When organisations might face a greater threat, and the steps to take to improve security.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
Cyber Assessment Framework v4.0 released in response to growing threat
Updates to the CAF helps providers of essential services to better manage their cyber risks.
The problems with patching
Applying patches may be a basic security principle, but that doesn’t mean it’s always easy to do in practice.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
The problems with forcing regular password expiry
Why the NCSC decided to advise against this long-established security guideline.
Smart devices: using them safely in your home
Many everyday items are now connected to the internet: we explain how to use them safely.
The cyber threat to Universities
Assessing the cyber security threat to UK Universities
Securing your devices
How to ensure your devices are as secure as possible.
What is an antivirus product? Do I need one?
Detect and prevent malicious software and viruses on your computer or laptop.
Active Cyber Defence (ACD) – the fourth year
The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.
Active Cyber Defence (ACD) – The Third Year
The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programe.
The logic behind three random words
Whilst not a password panacea, using ‘three random words’ is still better than enforcing arbitrary complexity requirements.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Cyber Essentials: are there any alternative standards?
Can an equivalent cyber security standard deliver the same outcomes as the NCSC’s Cyber Essentials scheme?
Configuring Microsoft Outlook 365’s ‘Report Phishing’ add-in
How to report emails to the NCSC’s Suspicious Email Reporting Service (SERS) using the ‘Report Phishing’ add-in for Microsoft Outlook 365.
How the NCSC thinks about security architecture
Richard C explains how an understanding of vulnerabilities – and their exploitation – informs how the NCSC assesses the security of computer systems.
The future of Technology Assurance in the UK
Chris Ensor highlights some important elements of the NCSC’s new Technology Assurance strategy.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Reducing data exfiltration by malicious insiders
Advice and recommendations for mitigating this type of insider behaviour.
What is an antivirus product? Do I need one?
Detect and prevent malicious software and viruses on your computer or laptop.
Summary of the NCSC analysis of May 2020 US sanction
A summary of the NCSC’s analysis of the May 2020 US sanction which caused the NCSC to modify the scope of its security mitigation strategy for Huawei.
‘NCSC Cyber Series’ podcast now available
Listen to all five episodes now, covering a wide range of cyber security topics.
Getting your organisation ready for Windows 11 upgrade before Autumn 2025
Why you should act now to ensure you meet the new hardware standards, and prioritise security.
The Cyber Assessment Framework 3.1
Latest version of the CAF focusses on clarification and consistency between areas of the CAF.
Thanking the vulnerability research community with NCSC Challenge Coins
Reflecting on the positive impact of the Vulnerability Reporting Service – and introducing something new for selected contributors.
Motivating developers to write secure code
The ‘Motivating Jenny’ project is helping to change the conversation about security in software development.
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups…
Smart devices: new law helps citizens to choose secure products
Download the NCSC’s point-of-sale leaflet explaining how new PSTI regulation affects consumers and retailers.
Trusting the tech: using password managers and passkeys to help you stay secure online
How today’s secure tools simplify your digital life, and reduce login stress and password fatigue
Have you got what it takes to be a ‘Cyber Advisor’?
We need more cyber professionals to join our scheme providing hands-on advice to SMEs.
Mitigating malware and ransomware attacks
How to defend organisations against malware or ransomware attacks.
The future of telecoms in the UK
NCSC Technical Director Dr Ian Levy explains how the security analysis behind the DCMS supply chain review will ensure the UK’s telecoms networks are secure – regardless of the vendors used.
The strength of the ICS COI is the team
Join the Industrial Control System Community of Interest (ICS COI), and help build CNI expertise across the UK.
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
How Rebellion Defence used NCSC For Startups to accelerate product development
Unparalleled access to skilled users transformed Rebellion Defence’s product roadmap.
The rise of ransomware
Toby L, Technical Lead for Incident Management, explains how modern-day ransomware attacks are evolving.
‘PDNS for Schools’ to provide cyber resilience for more institutions
The NCSC’s ‘Protective Domain Name Service for Schools’ scaled-up to protect a wider range of organisations.
The strength of the ICS COI is the team
Join the Industrial Control System Community of Interest (ICS COI), and help build CNI expertise across the UK.
The security benefits of modern collaboration in the cloud
By exploiting cloud services, organisations no longer have to choose between ‘more security’ and ‘better usability’.
Studies in secure system design
Worked examples for Operational Technology and Virtualised systems, using the NCSC’s secure design principles
Authentication methods: choosing the right type
Recommended authentication models for organisations looking to move ‘beyond passwords’.
Telling users to ‘avoid clicking bad links’ still isn’t working
Why organisations should avoid ‘blame and fear’, and instead use technical measures to manage the threat from phishing.
Tackling the ‘human factor’ to transform cyber security behaviours
ThinkCyber’s CEO Tim Ward reflects on the challenges that startups face when developing innovative products.
Supplier assurance: having confidence in your suppliers
Questions to ask your suppliers that will help you gain confidence in their cyber security.
NCSC For Startups diaries: PORGiESOFT
We caught up with George Brown, founder of PORGiESOFT, about his first few weeks in NCSC For Startups…
Introducing the guidelines for secure AI
New guidelines will help developers make informed decisions about the design, development, deployment and operation of their AI systems.
NCSC For Startups: the feedback loop
How startups can make the most of their time when pitching to cyber security experts.
Products on your perimeter considered harmful (until proven otherwise)
As attackers’ tactics change, so must network defenders’.
Sausages and incentives: rewarding a resilient technology future
Why ‘thinking big’ is required to shift the dynamics of the technology market.
Creating the right organisational culture for cyber security
Calling cyber security professionals, culture specialists and leaders to drive uptake of new Cyber security culture principles.
New ETSI standard protects AI systems from evolving cyber threats
The NCSC and DSIT work with ETSI to ‘set a benchmark for securing AI’.
Facing the cyber threat behind the headlines
NCSC CEO urges all businesses to face the stark reality of the cyber threat they face, whether in the spotlight or not.
Decommissioning assets
How to retire digital assets (such as data, software, or hardware) from operation.
Data breaches: guidance for individuals and families
How to protect yourself from the impact of data breaches
SBOMs and the importance of inventory
Can a Software Bill of Materials (SBOM) provide organisations with better insight into their supply chains?
Our Collaborations With