GRC

NCSC launches CyAS scheme to assure red teams for CNI and government

The NCSC’s new CyAS scheme assures red team providers, giving regulators a tool to test CNI resilience ahead of the Cyber Security and Resilience Bill.

Shield graphic with the headline NCSC launches assured red team scheme

The NCSC has opened its Cyber Adversary Simulation (CyAS) scheme, giving regulators and critical national infrastructure operators an assured route to commission realistic red team testing. It arrives as the Cyber Security and Resilience Bill nears the statute book, and it changes what “evidence of resilience” is likely to mean for overseen sectors.

What happened

On 11 November 2026 the National Cyber Security Centre formally launched CyAS, a new Industry Assurance scheme for companies that sell adversary simulation, the discipline most of us still call red teaming. Commercial providers are assessed against a standard written by the NCSC, and those that pass are listed on a “Find a Provider” page so that buyers can choose from a vetted pool. NCC Group is among the firms already shown as meeting the standard.

The NCSC published introductory guidance, a scheme Standard and a Working Practices Document on 17 September, and law firm A&O Shearman noted at the time that a minimum viable product was pencilled in for November. That has now happened. The NCSC says the MVP phase should last roughly 18 months while it gathers feedback from buyers, providers and regulators and refines the model.

Launching the scheme, NCSC Chief Technology Officer Ollie Whitehouse put the rationale bluntly: “You cannot improve what you do not know.” Deputy Director Chris Ensor positioned CyAS as a step beyond conventional penetration testing and controls auditing, aimed at proving whether organisations can actually protect, detect and respond.

How it works

CyAS is built around a defined NCSC methodology rather than a script. Assured providers begin with reconnaissance into the customer’s technology, internet exposure and threat landscape, then build attack plans specific to that organisation and work towards objectives agreed in advance. Crucially, the NCSC says testers should not be boxed in by off-the-shelf threat intelligence or by a catalogue of documented techniques. A&O Shearman’s summary describes this as “capability-led”, in contrast to schemes that replay fixed attacker behaviours. The scheme guidance suggests a typical engagement runs for eight to twelve weeks depending on scope.

The Standard, now at version 1.1, has four parts: a Company Standard, a Technical Standard covering the methodology, a Report Writing Standard and an Individual Competency Framework covering roles such as the CyAS Engagement Manager. Provider obligations buyers should know include:

  • Board or senior management must commit to the scheme in a signed letter, with named accountable individuals.
  • Systems holding customer engagement data must carry in-date Cyber Essentials Plus certification.
  • Firms must complete at least one CyAS engagement every 12 months, and named engagement managers and lead operators must each take part in one over the same period.
  • Teams must cover capabilities including detection evasion, persistence, privilege escalation in Active Directory, lateral movement, phishing and simulated data exfiltration.
  • Command and control tooling must include safeguards, such as environmental keying, so implants only run inside the agreed target estate.

In scope are customers such as regulated operators of essential services, the regulators themselves, bodies overseen by a lead government department, and central government departments, agencies and arm’s length bodies.

Checklist of six steps UK organisations should take before commissioning an NCSC CyAS adversary simulation engagement

Why it matters for UK organisations

The governance angle is the real story. CyAS was designed with what the NCSC calls Cyber Oversight Bodies, meaning sector regulators and lead government departments, and it sits beside the Cyber Assessment Framework (CAF) and the Cyber Resilience Audit scheme that already underpin NIS oversight. Regulators that adopt it become Scheme Partners, and the NCSC is explicit that a Scheme Partner may recommend assured providers, add sector-specific requirements, or require an organisation to undergo a CyAS engagement.

That last option matters because of timing. The Cyber Security and Resilience Bill finished its Lords stages on 2 November and is waiting for the Commons to consider the Lords amendments, with no date yet set. A carry-over motion means it now has until 29 April 2027 to receive Royal Assent. Once it does, regulators will want a consistent way to test what CAF self-assessments claim, and CyAS gives them a ready-made, NCSC-backed instrument.

Financial services firms will see the parallel with CBEST, the Bank of England’s threat-led framework, and with TIBER-EU on the continent. CyAS offers a comparable assured route to the other overseen sectors and to central government.

Expert view

I welcome this, with caveats. For years I have watched “red team” used as a label for anything from a scoped internal pen test with phishing bolted on to a genuine multi-month covert operation. Buyers, particularly in the public sector, struggled to tell the difference until the report landed. A published standard with competency requirements for named individuals, a defined methodology and reporting rules gives procurement teams something concrete to hold suppliers to.

The NCSC is also right to warn that this is not for everyone. Its own scheme page says organisations still building their foundations should consider other assurance first. If you have little identity logging, no tested incident response plan and a patch backlog measured in months, a covert simulation will mostly confirm what you already suspect, expensively. In my experience the most valuable red team findings are about process: alerts that fire but nobody triages, escalation paths that stall out of hours, or a third party with more access than anyone realised.

Two points of friction to watch. First, the acronym clash: the NCSC’s Cyber Resilience Audit shares its initials with the EU Cyber Resilience Act, which will confuse board papers. Second, an 18-month MVP means the rules may shift under early adopters, so contracts signed now should anticipate changes to the Standard.

What to do now

  1. Ask your regulator. If you are an operator of essential services or a public body, find out whether your oversight body has become, or intends to become, a Scheme Partner and whether it will set sector requirements.
  2. Map your CAF position first. Use your latest CAF self-assessment or Cyber Resilience Audit results to decide whether you are mature enough for adversary simulation, or whether purple teaming and control testing would be better value this year.
  3. Fix the basics that testers will exploit. Accurate external asset inventory, enforced MFA, secure configuration and timely patching map directly to the Cyber Essentials controls, and they stop an engagement being wasted on easy wins.
  4. Write business objectives. Define outcomes the board understands, such as altering a supplier payment run or reaching an operational technology network, rather than simply “obtain domain admin”.
  5. Use the Standard in procurement. Even if you buy outside the scheme, cite the CyAS Standard as a benchmark for provider competence, reporting and tooling safeguards.
  6. Plan for remediation. Budget for retesting and track findings with named owners. Detection and response timings are the metric regulators will care about.

Bottom line

CyAS turns red teaming from a loosely defined service into an assured, regulator-ready instrument. For critical national infrastructure and government bodies, it is a strong signal that oversight is moving from paperwork towards practical proof that defences hold up under realistic attack. Prepare now, before a Scheme Partner tells you to.

Sources

Related Posts