Cyber Adversary Simulation (CyAS)

If your organisation is considering a CyAS engagement, it is likely because:

• your sector's Cyber Oversight Body recommends or requires the use of the scheme, or
• you want independent assurance of your organisation's cyber resilience.

A buyer is any organisation that procures services from a CyAS Assured Service Provider.

All providers listed under the scheme have been assessed against the scheme Standard and are capable of delivering cyber adversary simulation engagements using the NCSC methodology.

You should still carry out your own commercial and procurement due diligence when selecting a provider.

A CyAS engagement may be appropriate once you:

• understand your key business services and cyber risks
• have mature preventative and detective security controls
• operate security monitoring capabilities
• have established incident response processes
• want to validate your ability to respond to realistic cyber attacks

CyAS may not be the right starting point if you:

• have not identified your critical assets or services
• have limited monitoring or detection capability
• are still implementing foundational cyber security controls
• need to establish a baseline understanding of cyber risk

You can find a list of CyAS assured providers on this website, here.

Government and public sector buyers can invite suppliers to bid for working using the Government Commercial Agency’s (formerly Crown Commercial Service) Dynamic Purchasing System: Government Commercial Agency website - Cyber Security Services 3.

Organisations in other sectors should use their normal procurement route, process or framework to select and contract with a CyAS assured provider, contacting providers directly where appropriate to discuss their requirements.

Before selecting a provider, check whether your sector has any additional requirements and ensure the provider can meet them.