What NCSC announced
The National Cyber Security Centre has launched a new assurance scheme called Cyber Adversary Simulation, or CyAS. The scheme is aimed at the UK’s most critical organisations and the bodies that oversee them, giving them a way to identify trusted suppliers of services that simulate real cyber attacks against their networks and systems.
Rather than running simulations itself, NCSC’s role is to assure the commercial providers that offer this kind of testing. Suppliers are assessed against a standard defined by NCSC, which the organisation says draws on its position as the UK’s National Technical Authority for cyber security. CyAS sits alongside NCSC’s other Industry Assurance schemes, which already cover a range of cyber security services and products.
What this means in practice
Adversary simulation, sometimes called red teaming, involves hired specialists attempting to breach an organisation’s defences using the same techniques a real attacker might use. The aim is to test not just whether systems can be broken into, but whether an organisation can detect an intrusion in progress and respond to it effectively.
By assuring providers of this service, NCSC is giving critical organisations a shortcut: instead of vetting a simulation firm’s credentials from scratch, they can choose from suppliers that have already met a government-defined bar. For sectors where the consequences of a successful cyber attack are severe, such as energy, water, telecoms and other critical national infrastructure, that assurance is intended to raise confidence that testing exercises are rigorous and realistic rather than a box-ticking exercise.
Who is affected
The scheme is targeted at the UK’s most critical organisations and their overseeing bodies, rather than the general public or small businesses. In practice this points to operators of essential services and the regulators and government departments that supervise them. For these organisations, the launch of CyAS adds a new, government-backed route to commissioning adversary simulation work, alongside NCSC’s existing suite of assured services such as Cyber Essentials.
Commercial providers of cyber adversary simulation services are also directly affected: those wanting to be recognised under the scheme will need to be assessed against NCSC’s defined standard before they can describe themselves as assured.
What to watch next
NCSC has not published a date for when the first assured providers will be listed, nor set out the detail of its assessment standard beyond confirming its existence. Organisations that could fall within scope of the scheme, and suppliers considering seeking assurance, should watch for further detail from NCSC on eligibility, the assessment process and the list of assured providers as the scheme becomes operational.