Revamped Cyber Security: The 10 Steps You Need to Know

The '10 Steps to Cyber Security' guidance, originally crafted in 2012 by CESG, the predecessor of the National Cyber Security Centre (NCSC), has undergone significant updates to remain relevant in today's rapidly changing technological landscape. With the rise of cloud services and the shift towards remote work, the nature of cyber threats has also evolved, necessitating a fresh look at how organizations can protect themselves.

The Need for Updated Guidance

Since its inception, the guidance has seen a dramatic shift in the types of threats organizations face. Ransomware attacks, which can impact any sector regardless of size, have become increasingly prevalent. As our understanding of technology and human behavior has advanced over the past nine years, the NCSC recognized the importance of refreshing the '10 Steps to Cyber Security' guidance ahead of its 10th anniversary.

Key Updates in the Guidance

While the core structure of the guidance remains intact with ten steps, several updates have been made to ensure its relevance:

• Incident Management and Secure Configuration are still key topics but have been updated to align with the latest guidance, including the 'Cloud Security Principles' and strategies for 'Mitigating Malware and Ransomware Attacks'.
• The steps have been restructured to provide more detailed information on topics that users frequently inquire about, such as Data Protection.
• A new section on Supply Chain Security has been introduced, reflecting the increasing number of cyber incidents related to supply chains.

Target Audience

The revised '10 Steps to Cyber Security' is specifically aimed at security professionals and technical staff working for or supporting medium to large organizations. This guidance allows technical staff to delve deeper into specific areas by following links to more detailed NCSC resources. Additionally, it can be used in conjunction with the NCSC's 'Cyber Security Toolkit for Boards', published in 2019, which assists board members in discussions with technical experts about cyber security.

The 10 Steps to Cyber Security

The updated guidance outlines the following ten steps:

1. Risk Management: Adopt a risk-based approach to securing data and systems.
2. Engagement and Training: Collaboratively build security measures that work for the people in your organization.
3. Asset Management: Understand what data and systems you possess and the business needs they support.
4. Architecture and Configuration: Design, build, maintain, and manage systems securely.
5. Vulnerability Management: Ensure systems are protected throughout their lifecycle.
6. Identity and Access Management: Control access to systems and data.
7. Data Security: Protect data in vulnerable states.
8. Logging and Monitoring: Design systems to detect and investigate incidents effectively.
9. Incident Management: Prepare a response plan for cyber incidents in advance.
10. Supply Chain Security: Work collaboratively with suppliers and partners to enhance security.

Conclusion

The NCSC welcomes feedback on the updated guidance to ensure it remains relevant and useful for organizations. As we look forward to another decade of cyber security advancements, it is crucial for organizations to stay informed and proactive in their security measures. By following these ten steps, organizations can better protect themselves against the evolving landscape of cyber threats.