Early Warning on MyNCSC - information for existing MyNCSC users

Early Warning is a threat-notification service that tells you about potentially suspicious activity on your network from a variety of open source, commercial and private data sources.

Please see the Early Warning information page for further information.

The NCSC will migrate your organisation's use of Early Warning to MyNCSC. The process is automated and you should not need to do anything. If, in specific cases, we need to vary the approach outlined here, we will contact your organisation.

Migration timing

Organisations are being migrated in batches, starting now. The existing grouping of Early Warning users within organisations allows for a relatively straightforward approach, with the overall set of migrations expected to take weeks, not months, to complete.

The migration of each organisation should be completed within seconds. Your Early Warning users and existing Org Admins will be emailed immediately to advise that migration has taken place.

Migration

Your organisation’s use of Early Warning will be migrated onto your existing organisation within MyNCSC.

• For transparency, assets previously registered for use in Early Warning, along with Early Warning users, will be automatically added to a team created within your organisation. The role of the team will be evident from its name. Your organisation can then choose to either maintain this team or manage the assets in a different way.
• Additional contacts for receiving Early Warning findings will be moved to MyNCSC, either as members of the organisation and team if they have a Sign In account, or as Early Warning contacts for the organisation.

Notifications associated with actions used by our migration scripts, e.g. for team creation, will be triggered in the normal way, so please do not be surprised when you see these.

Accessing Early Warning

Prior to migration Early Warning users should continue to access the service directly.

Following migration, users continue to use their existing Sign In account to access the service, but will do so via MyNCSC.

All UK organisations with a static IP address or domain name are eligible to use Early Warning.

In line with the common platform vision for MyNCSC, Early Warning is operated in an equivalent manner to Mail Check and Web Check in many respects. This is the case for use of Sign In accounts, collaborative working within organisations and teams and registration of assets. However, a few distinctions exist.

Asset types

The asset types used by Early Warning are IP (v4 and v6) and domain.

Service selection

In normal use, registration of assets for use in Early Warning is select by default. For example, if you register a new domain to be checked by Mail Check you will need to actively select Mail Check in the usual way, but Early Warning will also be automatically selected for that domain unless you actively deselect it.

Please note: by contrast, Assets registered within MyNCSC ahead of Early Warning migration, will not be automatically selected for use within Early Warning, unless they were already in use by Early Warning ahead of the migration. Where you wish to also select Early Warning for these assets, you will need to do so manually.

Asset verification

Early Warning does not require verification of assets (in line with Web Check but in contrast with Mail Check).

Findings

Currently, Early Warning findings will not be presented via MyNCSC. They will continue to be emailed out by the Early Warning service.

We are planning for the migration process to be completed in a smooth and timely manner.

However, should anything occur which concerns you, please feel free to email us at [email protected]