Early Warning on MyNCSC - information for users new to MyNCSC

MyNCSC is a platform used for hosting the NCSC’s Active Cyber Defence services. Early Warning is the third of these to be added, following Mail Check and Web Check. MyNCSC is designed to offer a number of benefits to our users, including:

• a common portal for accessing the hosted services
• the ability (where possible) to configure multiple services once, rather than repeatedly for each

For information about how to operate features for the key points below, please refer to the Getting Started guide from the MyNCSC help centre.

Migrated users will find that essential setup operations (including obtaining membership of your organisation on MyNCSC and registration of assets) have been completed for you during migration. However, you will need to make any subsequent changes via the MyNCSC portal.

Join your organisation on MyNCSC

Early Warning users act on behalf of the organisations they represent. Each user therefore needs to join their organisation. Colleagues within the same organisation are then able to collaborate in their use of Early Warning.

Register digital assets

The organisation needs to register its assets:

• Early Warning operates on IPs (v4 or v6) and domain asset types
• IPs can be registered as single IPs, IP ranges or CIDR blocks
• Early Warning will be selected for any IPs or domains registered, unless proactively deselected

You will be notified of any concerns by email

Where Early Warning becomes aware of concerns relating to registered assets, it will alert users within the relevant organisation by email.

Option to use Teams

Larger organisations may wish to create teams within the organisation on MyNCSC, assigning assets and users to appropriate teams to give each user a more focussed view (listed assets and resultant email alerts) of the area of the organisation’s digital estate within their responsibility. By contrast, assets registered at the ‘Entire Organisation’ level, along with resultant email alerts, will be seen by all users within the MyNCSC organisation.

User roles

Each user within an organisation on MyNCSC has one of the following roles:

• A Member can add and remove assets and receive email alerts.
• A Team Admin can additionally manage the membership of their team.
• An Org Admin acts as a superuser. They can additionally manage the membership of the organisation, create teams and appoint Team Admins. We recommended organisations have more than one Org Admin wherever possible, to give cover should one of the Org Admins be unavailable.

Additional email recipients are nominated to receive all email alerts raised for the organisation (for example, the group email address of a SOC might be used to ensure alerts are picked up ‘out of hours’ when the normal Early Warning users are unavailable).

To check eligibility, please refer to the Web Check and Mail Check information pages.

If using these services, please note the following key differences to the method of using Early Warning outlined above:

• Mail Check operates on the domain asset type; Web Check operates on the domain and URL asset types
• use of these services has to be proactively selected for the desired assets
• asset verification is required to enable a fuller set of checks on Mail Check
• findings resulting from the checks performed on assets are presented via the MyNCSC interface

Please feel free to email us at to [email protected]