CREST and IASME are delighted to announce their partnership with the NCSC to help deliver its new Cyber Incident Exercising scheme. The NCSC (National Cyber Security Centre) has created the scheme to help organisations find high quality providers that can advise and support them to effectively practise their cyber incident response plan.

The benefits of exercise are clear, and this extends to practising a cyber incident response plan. While practise might not make perfect, it does build resilience. An organisation that rehearses their incident response plan is better placed to respond to cyber attacks and can get back up and running again quicker than those who don’t.

Organisations wishing to join the CIE scheme will be assessed against the NCSC CIE Standard. CREST and IASME will both manage the assessment, onboarding, monitoring and offboarding of providers assured under the Cyber Incident Exercising scheme on behalf of the NCSC. The organisations were selected for this role because they both meet the NCSC’s high standards and offer a choice for potential providers and different routes into the scheme.

Dr Emma Philpott MBE, CEO of IASME says, “We are really looking forward to working with companies of all sizes and in all areas of the UK to deliver this important scheme. We feel strongly about ensuring that the scheme is accessible for smaller cyber security companies to become assured providers and we encourage you to contact us to discuss becoming a provider if this is something that interests you.”

Rowland Johnson President at CREST explains “We are delighted to be helping deliver this important new scheme for the NCSC by assessing and onboarding Assured Service Providers.  With rising cyber attacks on enterprises of all types, effective cyber incident response is one of the most important parts of building cyber resilience. This will give all organisations who want to test their incident response, access to Assured Service Providers who can support them.”

The Cyber Incident Exercising scheme provides assurance of companies which deliver two types of cyber exercises to organisations that want to test their existing cyber incident response plans:

Table-Top - discussion-based sessions where participants talk about their roles and responsibilities, activities and key decision points (following their organisation’s incident response plan) in relation to a pre-agreed scenario. 

Live-Play – more in-depth sessions in which participants execute their roles and responsibilities to respond to events in a real world cyber scenario. Activities are tailored to the organisation and take place in close to real-time, providing a realistic simulation of a cyber event. Live play exercises are best suited to mature organisations looking for in-depth validation of plans. 

The scope of the CIE standard covers exercises designed to simulate incidents which have a significant impact on a single client organisation. It does not cover incidents spanning multiple organisations or Category 1 and Category 2 incidents as defined by the UK’s Cyber Attack categorisation system.

The new CIE scheme will launch officially later this year when exercising providers have been assured and on-boarded, ready to offer services.

Notes for editors

For more information from the NCSC go to CIE Scheme standard

For more information about the scheme and how to apply go to:

https://iasme.co.uk/cyber-incident/

https://www.crest-approved.org/membership/ncsc-cyber-incident-exercise-scheme/

The first Assured Service Providers for the scheme will be available soon. They will be listed on the website of the relevant Delivery Partner and on the NCSC website once they are available.

About NCSC

The NCSC supports the most critical organisations in the UK, the wider public sector, industry, SMEs as well as the general public. When incidents do occur, we provide effective incident response to minimise harm to the UK, help with recovery, and learn lessons for the future. More specifically, the NCSC:

• understands cyber security, and distils this knowledge into practical guidance that we make available to all
• responds to cyber security incidents to reduce the harm they cause to organisations and the wider UK
• uses industry and academic expertise to nurture the UK's cyber security capability
• reduces risks to the UK by securing public and private sector networks

About IASME

IASME is a UK-wide organisation that breaks down barriers to accessing cyber security skills and expertise. With a network of more than 300 cyber security companies, IASME advise and certify organisations of all sizes in cyber security. IASME is the sole delivery partner for the UK Government’s Cyber Essentials scheme.

About CREST

CREST is an international not-for-profit, membership body that represents the global cyber security industry. CREST has over 300 accredited member companies and certifies thousands of professionals across the globe. CREST is working with governments, regulators, academia, training partners, professional bodies and many other stakeholders to build and raise standards in the global cyber security industry.