The National Cyber Security Centre (NCSC) is launching its new Cyber Incident Exercising scheme, making professional cyber-incident preparation services available to UK organisations for the first time.
In August, the NCSC revealed CREST and IASME as key partners to assist in the management of the scheme, including the onboarding of Assured Service Providers. With an established number of such providers, the scheme is taking off.
The innovative CIE Scheme enables businesses to access NCSC assured CIE service providers who are capable of creating customised, structured tabletop or live-play cyber-incident exercises.
Assured Cyber Incident Exercising companies will work intimately with businesses, presenting challenges and collaboratively developing robust responses to simulated cyber incidents. This approach provides organisations with a secure environment to test and perfect their cyber protection strategies, according to a statement.
This service accompanies the NCSC's free 'Exercise in a Box' tool that allows businesses to further examine their incident response against a myriad of common cyber incident scenarios.
The scheme offers businesses the choice of two types of cyber exercises; Table-Top exercises which are discussion-based, with participants analysing their roles and responsibilities, strategies and key decision-making within the context of a pre-agreed scenario, and Live-Play exercises, allowing participants to execute their roles and responsibilities in real-time, responding to controlled information feeds representing a previously agreed upon scenario. Live-Play is ideal for mature organisations seeking in-depth validation of their plans.
Paul Chichester, NCSC Director of Operations, champions the new scheme: "I've often said the first time you try out your cyber incident response plan shouldn't be on the day you are attacked. So, if you do only one thing on a regular basis, incident exercising should be it."
He further affirmed the high value of companies fully understanding and realising their roles, underlining this as key to maximising effectiveness during an incident, minimising harm, and increasing overall UK resilience.
CREST's Head of Accreditation, Jonathan Armstrong, added to the praise, confirming CREST's dedication to maintaining high standards across the cybersecurity sector and lending support to buyers through the NCSC's scheme. "Using Assured Providers will ensure they are getting services from credible suppliers who meet both ours and NCSC's high standards," Armstrong said.
Dr Emma Philpott MBE, CEO of IASME, echoed the benefits of working with trusted providers, "Practising what you would do in the event of a cybersecurity incident with the support of an experienced, expert team significantly enhances the resilience of any business. This initiative helps organisations of all sizes to identify the most suitable provider to work with, knowing that they are assured under the NCSC scheme."
Those offering exercising services can also participate in the new Cyber Incident Exercising scheme, options for which can be found along with the CIE scheme standard and fee structure details on the delivery partners' websites. In addition, potential service providers may directly consult the NCSC website for information about the Cyber Incident Exercising scheme.
The NCSC currently boasts over 400 companies offering services on its behalf. The new scheme is aimed at continually raising the standard and reach of cybersecurity measures throughout the UK. Expectations are high, and a rapid uptake of these services is anticipated.