NCSC Annual Review 2026

The NCSC has recently published the CAF Core Profile, setting out our recommended minimum benchmark for cyber resilience for essential services and other organisations that are critical to the UK's security and prosperity. Informed by our assessment of the cyber threats facing the UK today, it provides a common baseline of resilience designed to mitigate risks from moderately sophisticated attackers. As a starting point rather than an end state, the profile provides a shared reference point for strengthening cyber resilience across the UK.

The NCSC is also developing a clearer resilience pathway for organisations seeking to build cyber maturity over time. This brings together the Cyber Action Toolkit, Cyber Essentials and the CAF as complementary stages, from foundational controls through to outcome-focused resilience management.

Independent audit and testing are essential to prevent overconfidence in our defences and ensure that government, regulators and organisations themselves have a realistic picture of resilience. They also help organisations strengthen their cyber defences and demonstrate that they can withstand and recover from digital disruption.

The Cyber Resilience Audit Scheme enables trusted third parties to provide high-quality independent audits based on the CAF, boosting confidence in declared resilience levels. It is aimed primarily at operators overseen by regulators or other oversight bodies, but can also support any organisation seeking an independent assessment of its cyber resilience.

Adversary simulation, sometimes referred to as red teaming, tests an organisation's ability to prevent, detect and respond to realistic cyber attacks. It is particularly suitable for organisations with mature cyber security processes and technical controls that want to understand how their defences would perform against a determined adversary.

Later this year, the NCSC will launch the Cyber Adversary Simulation (CyAS) Scheme as an MVP, providing assurance of suppliers delivering these services. The scheme, which has been developed in partnership with Cyber Oversight Bodies, is designed around realistic, reconnaissance-led testing and reflects how adversaries operate in practice, rather than relying on fixed or scripted approaches. 

Even with stronger regulation, clearer benchmarks and improved assurance, resilience cannot be delivered through regulatory frameworks alone. Critical organisations must also be able to adapt quickly, learn from emerging threats and work together to strengthen collective resilience.

The NCSC increasingly focuses on building trusted communities of defenders, enabling organisations to share knowledge, expertise and operational experience. By bringing together organisations facing similar risks, these communities help strengthen collective defence and improve the UK's ability to respond to evolving threats.

Some risks, however, require more focused intervention. For a small number of the UK's most important critical systems, the NCSC is undertaking a multi-year programme of enhanced support designed to reduce risk and improve preparedness for severe cyber attacks, major disruption and periods of heightened national tension.

The resilience frameworks, benchmarks and assurance approaches described earlier are supported by a range of practical tools and services. Designed for critical, complex and nationally significant organisations, they strengthen cyber defences and demonstrate that they can withstand and recover from digital disruption.

The NCSC’s Assured Cyber Security Consultancy scheme helps organisations with complex, high-risk, or nationally significant cyber security needs identify trusted, independent consultancy providers. It provides assurance that participating consultancies meet our standard for delivering high-quality cyber security consultancy in accordance with the NCSC's advice and guidance.

Through the scheme, organisations can access expert support across a range of specialist areas including  risk management, security architecture, and ‘audit & review’ services. Following updates to the scheme standard, including requirements for consultants to hold professional titles awarded by the UK Cyber Security Council, the scheme saw significant growth.

We know that many large organisations want Cyber Essentials Plus certification, but the way they operate does not always align with the technical controls required. Complex architectures, legacy systems, and layered security requirements mean that a purely prescriptive approach can sometimes feel more like a constraint than something that enables better security outcomes.

Cyber Essentials Pathways was designed to respond to this challenge, providing a way for organisations to demonstrate that their controls deliver equivalent (or better) protection, even where they differ from the standard Cyber Essentials model. Essentially, Pathways introduces flexibility without weakening the scheme’s rigour.

Cyber Essentials Pathways is all about giving organisations more than one way to demonstrate that they are achieving the same overall outcome. It effectively provides an ‘alternative pathway’ to achieving Cyber Essentials Plus certification, without compromising the integrity of the scheme. Cyber Essentials works because it is clear, accessible, trusted and remains just as relevant when countering today’s attacks.

Attackers have demonstrated both the intent and ability to exploit weaknesses in suppliers, recognising that a vulnerability in one organisation can provide access to many others. Supply chain security is therefore an essential part of organisational resilience and the NCSC publishes a range of guidance on managing cyber risk across complex supply chains.

To help organisations implement Cyber Essentials throughout their supply chains, the NCSC launched the Cyber Essentials Supply Chain Playbook. The Playbook provides practical guidance on embedding cyber security requirements into procurement and supplier management processes.

Alongside this, the Supplier Check Tool has been created to allow organisations to check the Cyber Essentials and Cyber Essentials Plus certification of large numbers of their suppliers and contractors. Over the past year:

• 797 large organisations registered to use the tool
• 123 demonstrations were delivered by mid-July 2026
• More than 1.5 million supplier searches were completed

Together, these tools provide practical ways for organisations to identify gaps in supplier assurance and reduce cyber risk across complex supply chains.

Technology and digital systems are at the heart of modern business, driving innovation, growth, and competitiveness. As organisations adopt emerging technologies, they also introduce new risks - cyber risk being one of the most significant.

The NCSC’s Cyber Security Toolkit for Boards remains the UK government’s key resource to enable Boards to govern cyber risks with confidence. It helps members to ensure that cyber resilience and risk management are embedded throughout an organisation, including its people, systems, processes and technologies. Additionally, our Cyber Governance Training supports boards and directors in understanding the principles of the Toolkit and putting its recommended actions into practice without delving into the technical detail. These resources are supported by the government’s Cyber Governance Code of Practice which shows boards and directors how to manage digital risks and protect their organisations from cyber attacks.

The NCSC is constantly updating its offerings to board members so that senior leaders can stay ahead of the threat. This includes:

Artificial Intelligence (AI) is no longer a distant or speculative issue for cyber security. The most advanced AI tools, often referred to as frontier AI, make it easier, faster and cheaper for even low-skilled hackers to carry out sophisticated cyber attacks.

The NCSC’S Frontier AI resources include key messages for leaders and board members as well as resources to share with your technical experts.

A highly disruptive incident can feel overwhelming. The NCSC’s new guidance on Recovering from a highly disruptive cyber attack provides a framework for response and recovery. It’s been created for organisations where the loss of critical digital systems would have significant operational consequences.

It will be particularly useful for:

• executive leaders, boards and senior decision-makers
• CISOs and cyber security teams
• CIOs, CTOs and technology leaders
• service owners
• business continuity, resilience and risk professionals

Whether they are technology producers and vendors, or consumers and operators, all organisations have ‘technical debt’; a backlog of technical issues – that is both expensive and time-consuming –  as a result of prioritising short-term gains over building resilient products. AI, when used by sufficiently-skilled and knowledgeable individuals, is showing the ability to exploit this technical debt at scale and at pace across the technology ecosystem.

This is why we are encouraging all organisations to prepare now for when a ‘patch wave’ arrives; a rush of software updates that will need to be applied across the technology stack to address the disclosure of new vulnerabilities. Organisations should make plans to deploy software security updates quickly, more frequently, and at scale, including across their supply chains. We are expecting an influx of updates to address vulnerabilities across all severities, and expect a number to be critical. A good place to start is by reading the NCSC’s updated Vulnerability Management guidance.

The transition to post-quantum cryptography (PQC) will be one of the largest technology migration challenges over the coming decade. For operators of critical services, organisations holding sensitive information, and those managing complex technology environments, preparation should begin now.