NCSC scheme will help critical organisations test their cyber defences

New NCSC Cyber Adversary Simulation scheme will help critical organisations strengthen their resilience through rigorous, real-world testing by trusted providers.

The NCSC has launched a new Cyber Adversary Simulation (CyAS) scheme.

The scheme is designed to help strengthen national cyber resilience, supporting the UK's most critical organisations, as well as overseeing bodies.

The scheme assures suppliers of cyber adversary simulation services, helping organisations identify trusted providers to test their defences and their ability to prevent, detect and respond to realistic simulated cyber attacks.

Like all NCSC Industry Assurance schemes, CyAS draws on the NCSC’s expertise as the UK’s National Technical Authority for cyber security. Commercial providers are assessed against an NCSC-defined standard, giving organisations confidence that they are buying services that meet recognised requirements.

A key feature of the CyAS methodology is that providers conduct reconnaissance to understand the customer’s technology, exposure and threat landscape. This is then used to develop realistic, customer-specific attack plans. Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures (TTPs).

The scheme complements other NCSC frameworks that support cyber regulation, including the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA) scheme. Together, these frameworks will help organisations - particularly larger organisations, those operating in critical national infrastructure and government - build a clearer picture of their cyber security and resilience.

They also give Cyber Oversight Bodies a trusted way to gather evidence of resilience across the sectors they oversee. This supports consistency, shared learning and a stronger understanding of cyber risk.

Speaking at the launch, the NCSC’s Chief Technology Officer Ollie Whitehouse said:

You cannot improve what you do not know. That is why I am delighted to see the launch of the Cyber Adversary Simulation scheme. By enabling rigorous, realistic end to end assessments by the very best adversary simulation experts, CyAS will help organisations build a clearer picture of how they would stand up to genuine cyber attacks and take action to strengthen their security and resilience.

“Ultimately, stronger resilience across the UK helps prepare the country for crisis by protecting the essential services we all rely on every day from the most pressing threats.

 

NCSC Deputy Director Chris Ensor added:

Moving beyond traditional pen testing and auditing of controls, the CyAS service enables organisations to practically test their cyber defences, ensuring they are able to protect, detect and respond to cyber attacks.

 

CyAS has been developed in partnership with Cyber Oversight Bodies, including regulators and Lead Government Departments, to establish a common core standard and a more consistent approach to demonstrating cyber resilience.

The scheme will initially operate as a Minimum Viable Product (MVP), enabling the NCSC to test demand, refine the methodology and build confidence before moving towards a fuller operating model.

You can find a full list of assured service providers on the schemes ‘Find a Provider’ page.

Organisations must act now to prepare for a wave of patches that will address decades of technical debt.

How to ensure the ‘organisational memory’ of past vulnerabilities is not lost.

Research from the NCSC designed to eradicate vulnerability classes and make the top-level mitigations easier to implement.