The National Cyber Security Centre (NCSC) has announced two initiatives to help improve national cyber resilience at the CYBERUK conference.

The new Cyber Resilience Test Facilities (CTRFs) programme is developing a national network of assured facilities which will allow technology vendors to demonstrate the cyber resilience of their products in a consistent and structured way, enabling independent audits and assessments by public and private sector organisations, including the UK government.

The CRTFs will adopt a Principles-Based Assurance (PBA) methodology, moving away from traditional compliance-based schemes, to enhance consumer confidence in the cyber resilience of products and broaden the range of assured products.

The NCSC will also be launching a new scheme for Cyber Adversary Simulation (CyAS) in early summer. Companies assured under the Cyber Adversary Simulation Scheme will deliver services to test an organisation’s cyber resilience, including their ability to prevent, detect, and respond to simulated cyber-attacks.

These initiatives are the latest in the NCSC’s efforts to help organisations bolster resilience and work towards addressing issues raised by CEO Richard Horne towards the end of last year about the growing gap between cyber threats and existing defences.

“The Cyber Resilience Test Facilities and Cyber Adversary Simulation schemes mark a significant step forward in our mission to enhance the UK’s cyber resilience,” NCSC director for national resilience Jonathon Ellison said.

“The test facilities will allow consumers to be more confident in the security of connected products. And through testing their response to simulated cyber attacks, the UK’s most critical infrastructure will be further empowered to defend against evolving online threats.”

Recommended reading

• New Report Reveals AI Trust Divide in Cybersecurity
• AI Ushering in A “Digital Divide” in Cybersecurity, NCSC Warns
• Cyber-attacks Cost UK Businesses £64BN A Year

The CyAS scheme has been developed in partnership with cyber oversight bodies, cyber regulators and government, who are exploring the use of the scheme in their sectors.

It has been designed as a means for providing end-to-end assurance and evidence for any organisation of sufficient maturity and critically to test their cyber defences.

The scheme will launch as a Minimum Viable Product and is expected to evolve as the user community grows.