The National Cyber Security Centre’s 10 Steps to Cyber Security remains one of the clearest UK references for structuring organisational defence. It is guidance for medium to large organisations that have someone accountable for cyber security. It is not a product you buy, a badge you hang on the website, or a substitute for Cyber Essentials, ISO 27001 or sector rules. Boards that want a shared agenda still find the ten themes useful because they force conversations about identity, assets, suppliers and recovery rather than only about tools.
This guide uses the official NCSC step names and shows where independent testing and evidence habits fit. Attack Vector identifies weaknesses. Your organisation owns remediation and ongoing control operation. Use the Steps to organise work; use testing to check selected controls, not to claim the whole programme is finished.
At a glance
- Official home: ncsc.gov.uk/collection/10-steps.
- Ten components: risk management, engagement and training, asset management, architecture and configuration, vulnerability management, identity and access management, data security, logging and monitoring, incident management, supply chain security.
- Aimed at medium to large organisations; NCSC points smaller firms toward lighter toolkits while still treating the principles as useful.
- Following the Steps reduces likelihood and impact. It does not create a certificate by itself.
- Penetration testing supports several Steps with evidence. It does not complete the whole programme.
Context: resilience as a management problem
Cyber resilience is the ability to anticipate, withstand, recover from and adapt to attacks and failures. The NCSC 10 Steps break that into manageable themes so boards and security leads can ask coherent questions. Published and reviewed material on the NCSC site (collection version commonly dated May 2021 for the core pages) is still the authoritative wording. Do not invent newer “mandated” versions that the NCSC has not published.
Attack Vector is UK-based. Lead consulting credentials include CSTL (The Cyber Scheme) and ChCSP (UK Cyber Security Council).
The ten steps in practice
1. Risk management
Identify what matters, who threatens it, and which controls are proportionate. Embed cyber risk in the same decision forums as other business risk. Seek confidence that chosen controls actually work. Continual improvement beats a one-off register that nobody opens.
2. Engagement and training
People detect many incidents first. Policies that block real work get bypassed. Tailor training to roles, make reporting safe, and keep leadership visible. Generic annual videos rarely change behaviour on their own.
3. Asset management
You cannot protect what you cannot name. Maintain inventories of hardware, software, cloud services and data stores. Classify by business value and sensitivity. Retire systems deliberately rather than leaving forgotten exposure.
4. Architecture and configuration
Design for least privilege, segmentation and secure defaults. Review configurations as systems change. Administration paths deserve special attention: how privileged work is done often decides whether a foothold becomes a domain-wide incident.
5. Vulnerability management
Find weaknesses, prioritise, patch or mitigate, and verify. Scanning supports this Step. So does knowing which internet-facing edge devices and crown-jewel apps need deeper testing. Cadence should match exposure and change rate.
6. Identity and access management
Know who (and what) can access which systems. Prefer MFA for online accounts, tighter controls for privileged roles, and regular access reviews. Service accounts and machine identities belong in the same conversation as human users.
7. Data security
Protect data in transit and at rest where risk warrants it. Control sharing, retention and disposal. Backups only help if they restore under pressure and resist the same ransomware path that hit production.
8. Logging and monitoring
Generate useful logs, retain them long enough, and alert on signals someone will act on. Detection without ownership is decoration. This Step also underpins later forensic and regulatory needs.
9. Incident management
Plan, practise, contain, recover, learn. Tabletop exercises expose gaps cheaper than the first real crisis. Links to legal, communications and supplier notification should be written before you need them.
10. Supply chain security
Suppliers and connectivity introduce risk you do not control directly. Understand dependencies, set contractual expectations, and monitor what connected parties can reach. Software supply-chain issues and third-party SaaS both sit here in spirit, even when other frameworks name them differently.
Where testing and assurance fit
Independent penetration testing is one way to gain confidence in controls under Steps such as architecture and configuration, vulnerability management, identity paths and internet-facing data exposure. A scoped test can show whether segmentation holds, whether a missing patch is reachable, or whether an application’s access control fails under real roles.
It does not replace:
- Board risk appetite decisions (Step 1)
- Culture and training (Step 2)
- Complete asset inventories (Step 3)
- Day-to-day monitoring operations (Step 8)
- Supplier contract management (Step 10)
Treat scanning and testing as complementary. Frequent scanning supports hygiene. Periodic human-led tests support assurance conversations. See penetration testing vs vulnerability scanning.
Attack Vector engagements start from £1,500 for tightly defined work. Infrastructure and web scopes are described under infrastructure and web application testing.
A practical 90-day order of work
NCSC does not require you to finish all ten before any value appears. A pragmatic sequence for many UK mid-market organisations:
- Confirm ownership and a living risk view (Step 1).
- Lock down identity basics and privileged access (Step 6).
- Know internet-facing assets and crown jewels (Step 3).
- Establish vulnerability triage and patch SLAs (Step 5).
- Prove backups and a draft incident plan (Steps 7 and 9).
- Commission scoped testing where exposure or buyers demand evidence.
- Widen logging, training and supplier work as capacity allows.
This is implementation sequencing advice for readers, not a claim that NCSC published a mandatory 90-day programme.
Posters without evidence
Printing the infographic and calling the organisation “aligned to the 10 Steps” changes nothing. The common failure modes are incomplete asset lists, MFA gaps on privileged paths, unowned alerts, untested backups, and suppliers connected with standing privilege. Another failure mode is buying annual “penetration testing” that is only unauthenticated scanning, then claiming Step 5 is complete.
What the 10 Steps are not
- The NCSC 10 Steps are guidance, not a certification scheme and not a substitute for Cyber Essentials or ISO 27001.
- Smaller organisations may start with NCSC’s lighter toolkits; the principles still apply.
- We identify weaknesses. Remediation ownership stays with you.
- A penetration test does not “complete” the 10 Steps.
- No assessment guarantees you will avoid incidents or satisfy every insurer or customer questionnaire.
If you need independent testing to support vulnerability management or architecture assurance, use the instant quote calculator or email [email protected]. For pricing shape, read the UK penetration test cost guide. Broader options sit on penetration testing services.
FAQ
Are the NCSC 10 Steps mandatory?
They are government guidance, not a universal legal mandate. Sector regulators, contracts or insurers may still expect comparable controls.
How do the 10 Steps relate to Cyber Essentials?
Different jobs. Cyber Essentials is a certification scheme with a defined control set. The 10 Steps are broader organisational guidance. Many organisations use both.
Which Steps benefit most from penetration testing?
Often architecture and configuration, vulnerability management, identity and access paths, and data exposure on internet-facing systems. Exact value depends on scope.
Does following the 10 Steps mean we are “cyber resilient”?
It means you are working a recognised structure. Resilience still depends on execution, testing, supplier reality and recovery practice.
Should SMEs ignore this collection?
No. NCSC notes smaller organisations may prefer lighter starting points, but the ten themes remain useful as a checklist of conversations to have.
Will Attack Vector implement the 10 Steps for us?
Attack Vector’s testing work identifies and evidences weaknesses. Implementing policies, training, monitoring and supplier management remains your programme. Consultancy questions: [email protected].
Suggested Resources
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.