NCSC scheme will help critical organisations test their cyber defences
The UK’s National Cyber Security Centre (NCSC) has launched a new Cyber Adversary Simulation (CyAS) scheme to help critical organisations test their cyber defences.
The scheme is designed to strengthen national cyber resilience by helping the UK’s most critical organisations and oversight bodies identify trusted providers to test their defences.
Commercial providers are assessed against an NCSC-defined standard, giving organisations confidence that the services they buy meet recognised requirements.
A key feature of the CyAS methodology is that providers conduct reconnaissance to understand a customer’s technology, exposure and threat landscape.
This information is then used to develop realistic, customer-specific attack plans. Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives.
The scheme complements other NCSC frameworks that support cyber regulation, including the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA) scheme.
Together, these frameworks will help organisations, particularly larger ones and those operating in critical national infrastructure, build a clearer picture of their cyber security and resilience.
They also give Cyber Oversight Bodies a trusted way to gather evidence of resilience across the sectors they oversee, supporting consistency, shared learning and a stronger understanding of cyber risk.
You cannot improve what you do not know. That is why I am delighted to see the launch of the Cyber Adversary Simulation scheme. By enabling rigorous, realistic end to end assessments by the very best adversary simulation experts, CyAS will help organisations build a clearer picture of how they would stand up to genuine cyber attacks and take action to strengthen their security and resilience.
Moving beyond traditional pen testing and auditing of controls, the CyAS service enables organisations to practically test their cyber defences, ensuring they are able to protect, detect and respond to cyber attacks.
CyAS has been developed in partnership with Cyber Oversight Bodies, including regulators and Lead Government Departments, to establish a common core standard and a more consistent approach to demonstrating cyber resilience.
The scheme will initially operate as a Minimum Viable Product (MVP), enabling the NCSC to test demand, refine the methodology and build confidence before moving towards a fuller operating model.
A full list of assured service providers can be found on the scheme’s ‘Find a Provider’ page.
Related
