NCSC handing over the baton of smart meter security: a decade of progress
In September 2025, after more than 10 years of ownership, the National Cyber Security Centre (NCSC) formally handed over the smart meter Commercial Product Assurance (CPA) scheme to the Smart Energy Code (SEC) Security Sub-Committee, with operation of the scheme contracted to CyTAL, under the stewardship of Department for Energy Security and Net Zero (DESNZ).
As we celebrate the beginning of a new chapter, I’d like to share reflections on our achievements and some of the challenges faced in securing the UK’s smart metering infrastructure.
Empowering industry
Since the handover process began in 2024, we have worked closely with the new operators, under the stewardship of DESNZ, to ensure a smooth transition, sharing knowledge and supporting onboarding activities.
This transition empowers industry to take on ownership of risk and assurance and is in line with our strategy to enable others to help build a resilient UK. There are several benefits to doing this. It enables greater scaling and innovation, allowing us to focus our resources on the challenges which we are uniquely placed to tackle.
Why the NCSC got involved
In 2012, DESNZ (then DECC) identified the need for security assurance in the rollout of the next generation of Smart Metering Equipment Technical Specifications (SMETS2) smart meters. Our CPA scheme was selected to provide that assurance. Together with industry, we developed Smart Metering-specific security characteristics – technical standards that defined how devices should behave and how they should be protected against commodity cyber threats. When applied, the standards ensured the integrity and security of the devices, leading to a CPA certification.
What we achieved
Since 2012 we as NCSC (and the Communications and Electronics Security Group – CESG – before that) played a pivotal role in securing the UK’s smart metering infrastructure by helping to shape a robust assurance framework. Since the first evaluations in 2015 – working alongside DESNZ, the SEC Security Sub-Committee and a range of evaluation partners – the CPA scheme enabled the following:
-
Completion of around 150 CPA evaluations, covering full assessments, assurance maintenance, risk reviews, and build standards.
-
Certification of devices from 14 different manufacturers against CPA.
-
Deployment of more than 32 million CPA-certified devices to UK homes, including electricity and gas meters, communications hubs, and auxiliary control devices.
-
Involvement of 3 evaluation partners - CyTAL, KPMG, and NCC Group - in key roles of testing and reporting.
Thanks to the CPA certifications, the security and integrity of products has consistently improved as manufacturers have improved their engineering practices. And, as many manufacturers delivering into the UK are international, the CPA scheme has likely influenced global standards.
Overcoming challenges
The journey wasn’t without its hurdles. Early on, while manufacturers were adjusting to the scheme requirements, we provided mentoring and support and worked closely with labs and manufacturers to raise the bar for security and engineering maturity.
The scheme also supported the challenge of sustainability by enabling device refurbishment, allowing meters to be reused once securely refurbished. In collaboration with other smart metering stakeholders, we also developed the Risk Review process to understand how older devices measure up against the latest standard. This was key to enabling relevant, risk-based decisions to be taken in the ongoing management of the deployed estate.
Looking ahead
As the NCSC steps back, we are confident that industry will carry the baton forward. The smart metering assurance landscape has matured, and the foundations we laid will continue to support secure, resilient energy infrastructure for years to come.
It only remains for me to thank everybody that has been involved in the journey that started in 2012. This is a celebration of what’s been achieved together, and a recognition that the future of assurance lies in empowered, capable hands.
Anne W, Head of Industry Assurance, NCSC
Share and print this article
Written by
