Cyber Assessment Framework

NCSC Guidance

• Introduction to Security Governance
• Board Toolkit
• Cyber security design principles - establish the context

External resources

• NPSA secure business
• NPSA Good Governance
• ISO/IEC 27001
• ISO/IEC 27002
• ISO/IEC 27019
• IEC 62443-2-1:2010
• NIST SP800-53
• NIST SP800-82  

NCSC Guidance

• Risk management guidance
• NCSC Risk Management, Threat Modelling
• Penetration testing guidance
• Cloud security guidance
• Technology assurance guidance
• NCSC certification
• NCSC Assured Cyber Security Consultancy
• NCSC The near-term impact of AI on the cyber threat

External resources

• NPSA Protective Security Risk Management
• ISO/IEC 27005
• Civil Contingencies Secretariat’s 2011 guidance on resilience of critical infrastructure and essential services (.pdf)
• NIST SP800-53
• NIST SP800-82
• IEC 62443-2-1
• IEC 62443-3-3
• ISO 31000
• UK Government Performing threat modelling
• CISA Identifying and Mitigating Living Off the Land Techniques
• NIST AI 100-1
• NIST Adversarial Machine Learning a Taxonomy and Terminology of Attacks and Mitigations

NCSC Guidance

• Asset management
• 10 Steps to Cyber Security – Asset management
• Asset management list of guidance

External resources

• NPSA Identify your Most Valuable Assets
• RITICS Asset management within ICS / OT environments
• RITICS Visibility for ICS / OT environment asset management
• RITICS A manual approach to asset management in ICS / OT environments
• RITICS Resolving anti-patterns in ICS / OT environments
• ISO/IEC 27001
• ISO 55001 (to be replaced by ISO/FDIS 55001)
• ITIL
• NIST SP800-82
• ISO/IEC 27019

NCSC Guidance

• Supply chain security guidance
• Cloud security guidance. Principle 8: Supply chain security
• Supply chain guidance
• How to assess and gain confidence in your supply chain cyber security guidance
• NCSC Secure development and deployment guidance
• NCSC Vulnerability Disclosure Toolkit
• NCSC A method to assess 'forgivable' vs 'unforgivable' vulnerabilities
• NCSC Raising software cyber resilience 'at scale'
• NCSC Guidelines for secure AI system development

External resources

• Cloud security alliance. Security, Trust, Assurance and Risk (STAR)
• NPSA Supply Chain Guidance
• Embedding cyber resilience in local government supply chains
• NIST SP800-53
• NIST SP800-82
• IEC 62443
• ISO/IEC 27001
• UK Government Software Security Code of Practice
• UK Government AI Cyber Security Code of Practice 
• ISO/IEC 29147:2018Information technology - Security techniques - Vulnerability disclosure
• NIST Secure Software Development Framework
• Microsoft Security Development Lifecycle (SDL)
• ETSI Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems

NCSC Guidance

• You shape security guidance

External resources

• NPSA Embedding Security Behaviour Change
• NPSA's Personnel and People Security
• SANS Security Policy Templates
• NIST SP800-82
• IEC 62443 / ISA99 2-1
• ISO/IEC 27001/27002

NCSC guidance

• Introduction to identity and access management guidance
• Access control list of guidance
• Device Security Guidance
• NCSC Authentication methods: choosing the right type
• Multi-factor authentication for your corporate online services
• NCSC Principles for secure privileged access workstations (PAWs)

External resources

• NPSA Control Access
• RITICS Management of ICS / OT field devices
• NIST SP800-82
• IEC 62443 / ISA 99 3-3
• ISA 62443-2-1
• ISA 99 (Part 4)
• ISO/IEC 27001 / 27002
• CISA Identifying and Mitigating Living Off the Land Techniques
• CISA Implementing Phishing-Resistant MFA

NCSC Guidance

• Protecting bulk personal data
• Using TLS to protect data
• Cloud security guidance Principle 1: Data in transit protection
• 10 Steps to Cyber Security Data security
• Device Security Guidance
• Secure sanitisation of storage media 
• NCSC Ransomware-resistant backups

External resources

• RITICS The management of removable media within ICS / OT environments
• NIST 800-82
• IEC 62443-2-1
• IEC 62443-3-3 
• NIST 800-53
• ISO/IEC 27001 

NCSC Guidance

• Vulnerability management
• Secure design principles
• 10 Steps to Cyber Security - Architecture and configuration
• Pattern: Safely Importing Data
• Mitigating malware and ransomware attacks
• Penetration testing
• Device Security Guidance - Obsolete products
• NCSC Secure by default principles
• NCSC Principles for the security of machine learning
• NCSC Security principles for cross domain solutions

External resources

• UK Government Security Secure by Design Approach
• Ministry of Defence Industry Security Notice - Secure by Design Requirements
• RITICS The management of removable media within ICS / OT environments
• RITICS Management of ICS / OT field devices
• RITICS Resolving anti-patterns in ICS / OT environments
• NIST SP800-82
• IEC 62443 / ISA99 3-3
• ISO/IEC 27001
• CISA Secure by Design
• UK Government AI Cyber Security Code of Practice
• ETSI Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems

NCSC Guidance

• Exercising list of guidance
• Principles for ransomware-resistant cloud backups
• Cloud security guidance - Principle 2: Asset protection and resilience
• Secure design principles - 5. Reduce the impact of compromise
• 10 Steps to Cyber Security - Data Security
• Small Business Guide: Cyber Security. Step 1 - Backing up your data
• Using online services safely. Back up your organisation's critical data
• Actions to take when the cyber threat is heightened
• Denial of Service (DoS) guidance
• NCSC Ransomware-resistant backups

External resources

• RITICS Resolving anti-patterns in ICS / OT environments
• The Business Continuity Institute has some freely available introductory business continuity guidance and members can access more detailed resources
• Civil Contingencies Secretariat’s 2011 guidance on resilience of critical infrastructure and essential services (pdf)
• NIST SP800-53
• NIST SP800-82
• IEC 62443 / ISA99 2-1
• IEC 62443-1-1
• IEC 62443-3-3
• ISO/IEC 27001
• NCSC Ransomware-resistant backups

NCSC Guidance

• 10 Steps to Cyber Security
• NCSC Cyber Security Culture Principles
• NCSC Certified Training
• Putting staff welfare at the heart of incident response

External resources

• NPSA Passport to Good Security - 8. Create a Strong Security Culture - Soft Measures
• NPSA Passport to Good Security - 8. Create a Strong Security Culture - Hard Measures
• The UK Cyber Security Council
• NIST SP800-82
• ISO/IEC 27001
• UK Government Security Improving security culture

NCSC Guidance

• Introduction to logging for security purposes
• Building a Security Operations Centre (SOC)
• 10 Steps to Cyber Security - Logging and monitoring
• Device Security Guidance - Logging and protective monitoring

External resources

• RITICS Why you need to undertake cyber security logging and monitoring in an ICS / OT environment
• RITICS ICS / OT Logging and Monitoring
• NIST SP 800-82
• NIST SP 800-137 
• NIST SP 800-94
• IEC 62443-3-3
• IEC 62443-2-1 
• ISO/IEC 27001
• CISA Identifying and Mitigating Living Off the Land Techniques
• MITRE 11 Strategies of a World-Class Cybersecurity Operations Center

NCSC Guidance

• Intelligent security tools

External resources

• NIST SP 800-82
• IEC 62443-1-1
• UK Government Detecting the Unknown: A Guide to Threat Hunting
• MITRE TTP-Based Hunting

NCSC Guidance

• 10 Steps to Cyber Security – Incident Management
• Incident Management
• Categorising UK cyber incidents
• Effective steps to cyber exercise creation
• Putting staff welfare at the heart of incident response
• Cyber Incident Response Assurance Scheme

External resources

• NPSA Incident Management
• ISO/IEC 27035-1
• NIST SP 800-61 Computer Security Incident Handling Guide
• CREST Cyber Security Incident Response Guide
• CREST Cyber Security Incident Response Maturity Assessment [Model]
• CREST Cyber Security Incident Response Supplier Selection Guide  

NCSC Guidance

• Incident management

External resources

• NIST SP 800-61 Computer Security Incident Handling Guide
• ISO/IEC 27035-1