Security & governance
NCSC (National Cyber Security Centre)
The NCSC (National Cyber Security Centre) is the United Kingdom's national technical authority for cyber security. Part of GCHQ and operating since 2016, it responds to significant incidents, advises government and industry, and publishes the guidance and assessment frameworks that UK regulators and buyers rely on. Several other countries use the same name for their own agencies.
What does the NCSC publish?
Three outputs matter most for infrastructure teams. Cyber Essentials is the baseline certification scheme. The Cyber Assessment Framework (CAF), currently at version 4.0, is an outcomes-based framework used by regulated essential services, wider critical national infrastructure and government; it is organized around four objectives: managing security risk, protecting against cyber attack, detecting cyber security events, and minimizing the impact of incidents. The third is topic guidance, including specific documents on backups.
What does the NCSC say about backups?
Within the CAF, the principle on resilient networks and systems expects organizations to maintain secured offline, potentially off-site, backups of operational data and to test them routinely. For small organizations, the guidance is simpler: back up all important data, keep a copy that is not permanently connected, consider holding two backups, and test that a restore contains what is needed.
What are the NCSC principles for ransomware-resistant backups?
In November 2024 the NCSC published five principles for cloud backup services that are meant to survive a ransomware attack. They are written for cloud services but describe properties any backup store can be measured against.
| Principle | What it asks for | Storage reading |
|---|---|---|
| Resilience to destructive actions | Backups cannot be deleted or altered by an attacker with stolen credentials | Immutability or delayed deletion enforced by the platform |
| Access cannot be fully denied | No configuration lets every customer route be locked out | Separate recovery access path |
| Restore from earlier versions | A clean version remains even if later ones are corrupted | Versioning with protected retention |
| Robust key management | Keys protecting data at rest are themselves protected | Keys held apart from the data, see KMS |
| Alerts on significant changes | Privileged actions and policy changes raise alerts | Audit logs forwarded to monitoring |
Is NCSC guidance mandatory?
The NCSC is an advisory body, not a regulator. Its guidance becomes binding through others: sector regulators assess essential services against the CAF, the health service aligns its data security assurance to it, and public buyers reference NCSC guidance and Cyber Essentials in contracts. For most organizations the practical question is which regulator or customer has adopted which document.
Frequently asked questions
Is the NCSC part of GCHQ?
Yes. The UK NCSC is a part of GCHQ and acts as the national technical authority for cyber security.
What is the Cyber Assessment Framework?
It is an NCSC framework for assessing cyber resilience against defined outcomes. It is not a certification scheme, and regulators use it to assess essential services.
Does the NCSC recommend offline backups?
Yes. The Cyber Assessment Framework expects secured offline, potentially off-site, backups of operational data that are tested routinely.
Related terms
- Cyber Essentials: the NCSC baseline certification scheme.
- UK GDPR: the UK data protection regime.
- Breach containment: limiting the spread of an attack.
- Object versioning: keeping earlier versions restorable.
- Key management service (KMS): protecting the keys that protect data.