Cyber Adversary Simulation (CyAS)
Companies assured under the Cyber Adversary Simulation scheme deliver services to test an organisation’s cyber resilience, including their ability to prevent, detect and respond to simulated cyber attacks.
In this scheme
What is the Cyber Adversary Simulation (CyAS) Scheme?
The Cyber Adversary Simulation (CyAS) scheme helps organisations find NCSC-assured providers who can test their ability to prevent, detect and respond to realistic cyber attacks.
Providers approved under the scheme have been assessed as capable of delivering cyber adversary simulation engagements following the NCSC methodology defined in the scheme Standard.
Cyber adversary simulation is a realistic test of an organisation's cyber resilience. It safely replicates the techniques and behaviours a capable attacker may use to achieve agreed objectives. The exercise helps organisations understand how well their security controls, monitoring capabilities and incident response processes perform under realistic conditions.
A CyAS engagement can help you:
- test your ability to prevent, detect and respond to cyber attacks
- identify weaknesses in security controls and processes
- validate monitoring and detection capabilities
- improve incident response arrangements
- support cyber risk management and investment decisions
Who is it for?
The CyAS scheme is intended for organisations that:
- understand their key business functions and services
- have identified and assessed their cyber risks
- have established security controls and monitoring capabilities
- have incident response arrangements in place
- want to test their resilience against realistic cyber attacks
Cyber adversary simulation is particularly valuable for large organisations, operators of critical national infrastructure (CNI) and government organisations. However, any organisation with a mature understanding of the cyber risks they face may benefit from a CyAS engagement.
If your organisation is still developing its cyber security foundations, other assessment or assurance activities may be more appropriate before undertaking adversary simulation.
For more information, see the NCSC guidance on adversary simulation.
Scheme Partners
The scheme has been developed with Cyber Oversight Bodies, such as regulators and government departments that have responsibility for understanding and improving cyber resilience within their sectors.
Organisations that use the scheme in their sectors are known as Scheme Partners.
A Scheme Partner may:
- encourage organisations to use the scheme
- recommend the use of assured providers
- require organisations to undertake a CyAS engagement
- define additional sector-specific requirements
If your organisation, or an organisation for which you are carrying out work, is regulated or overseen by a Scheme Partner, you should check whether any additional requirements apply.
Minimum Viable Product (MVP)
The CyAS scheme is currently operating as a Minimum Viable Product (MVP).
The MVP phase allows the NCSC to work with buyers, providers and Scheme Partners to evaluate the scheme and identify areas for improvement before wider adoption.
During this phase we will:
- gather feedback from participants
- monitor how the scheme is used in practice
- refine guidance, processes and documentation
- improve the assurance model where necessary
We expect the MVP phase to run for approximately 18 months. The scheme may evolve during this period as we learn from early engagements and user feedback.