National Cyber Security Centre widens Cyber Incident Response scheme

The National Cyber Security Centre’s Cyber Incident Response scheme is well established and assists those organisations experiencing a cyber attack to quickly and easily identify trusted providers of commercial incident response services. These assured companies support organisations to investigate and recover from a cyber attack and advise on the prevention of future attacks.

Until now, the Cyber Incident Response scheme has focused on assuring companies that can provide incident response services to organisations running networks of national significance, such as central Government, Critical National Infrastructure organisations and regulated industries. These organisations are at particular risk of targeted and complex attacks organised by nation state actors.

All Level 1 Assured Service Providers are capable of dealing with all types of cyber incident for all types of organisations. The National Cyber Security Centre “strongly encourages” organisations running networks of national significance to contact a Level 1 company if they experience a cyber attack. It’s particularly important that all organisations use a Cyber Incident Response Level 1 provider if they think they’ve been the victim of a highly sophisticated attack episode.

Level 2 companies are assessed as being capable of supporting most organisations with common cyber attacks, such as those involving ransomware. This includes private sector organisations outside of Critical National Infrastructure sectors, charities, local authorities and smaller public sector organisations.

Sophisticated threat actors

Speaking about the new scheme, Chris Ensor (deputy director of cyber growth at the National Cyber Security Centre) said: “Falling victim to a cyber attack is really stressful. Finding someone with the skills and knowledge to help can also be a difficult task if, like many, the searching party is not familiar with the cyber security world.”

Ensor continued: “For many years now, we have assured Cyber Incident Response services for organisations targeted by the most sophisticated threat actors. I’m really pleased that we can now assure a similar service for any organisations affected by criminal threat actors. It’s a service that will be good enough for the majority of incidents facing smaller organisations. The National Cyber Security Centre ‘badge’ will afford confidence that the company whose services are employed has the right expertise in place to assist.”

If an organisation has been the victim of a cyber attack, the National Cyber Security Centre recommends that its management team should visit https://www.gov.uk/report-cyber to identify where that episode should be reported.

A list of National Cyber Security Centre assured Cyber Incident Response providers can be located via the Cyber Incident Response scheme Find a Provider page or the main Verify suppliers search on the organisation’s website.

Joining the Level 2 scheme

Cyber incident response companies interested in joining the new Level 2 of the Cyber Incident Response scheme should access the scheme’s Information for Service Providers page.

As the national technical authority for cyber security, the National Cyber Security Centre assists in defining Best Practice standards. Through industry assurance schemes like the Cyber Incident Response scheme, the organisation assesses industry services against its own standards.

At present, upwards of 400 companies offer services on behalf of the National Cyber Security Centre.

*Further information is available online at www.ncsc.gov.uk