UK public sector and critical national infrastructure (CNI) buyers are told to use "NCSC-assured" providers for penetration testing, incident response, consultancy, audit and training, but the schemes behind that label differ in who they apply to, how strongly they are expected and what they actually assure. This map sets out each NCSC assured service scheme, what NCSC says about when to use it, the personnel and standards behind it and its current status. It is written for security, procurement and risk teams in government, the wider public sector, regulated sectors and their suppliers. Status was checked on NCSC pages on 27 October 2026; schemes are revised often, so confirm details on the scheme page before you procure. This is a map of assurance schemes, not of statutory duties: the schemes themselves are not legislation, although regulators and departments can make them a requirement in their sector.
Key takeaways
- NCSC assures providers, not engagements. Across the schemes NCSC states it is not a party to contracts; buyers contract directly and keep responsibility for scoping and due diligence.
- CHECK is the one scheme with a firm government expectation. NCSC says central government systems processing OFFICIAL and above should be tested by CHECK companies, and strongly recommends CHECK for the rest of the public sector.
- Pick the incident response level by risk. NCSC strongly recommends Enhanced Level CIR providers for regulated sectors, multinationals, likely nation-state targets, CNI and central government.
- Sector regulators can turn a scheme into a requirement. The Cyber Resilience Audit and Cyber Adversary Simulation schemes use Scheme Partners, oversight bodies that may encourage, recommend or require their use.
- Personnel titles now carry the weight. CHECK and CRA tie team roles to UK Cyber Security Council professional titles, which buyers can verify.
Regulations and frameworks at a glance
| Scheme | What it assures | Primary audience (per NCSC) | Expectation level |
|---|---|---|---|
| CHECK | Companies carrying out authorised penetration tests | Central government, public sector bodies, CNI | "Should" for central government systems at OFFICIAL and above; strongly recommended for other public sector |
| Cyber Incident Response (CIR), Standard and Enhanced | Providers that help victims recover, investigate and prevent recurrence | All UK organisations; Enhanced for higher-risk organisations | Recommended |
| Assured Cyber Security Consultancy (ACSC) | Independent consultancy in risk management, security architecture, audit and review (post-quantum cryptography in pilot) | OES, regulators, government bodies, organisations with elevated threat profiles | Recommended |
| Cyber Resilience Audit (CRA) | Companies delivering independent cyber audits, initially against the CAF | Organisations overseen by Cyber Oversight Bodies, mainly OES | Set by Scheme Partners: encouraged, recommended or required |
| Cyber Adversary Simulation (CyAS) | Providers of capability-led adversary simulation | Mature organisations running critical services | Minimum viable product; aim to launch to buyers by end of 2026 |
| Cyber Incident Exercising (CIE) | Providers of scenario-based exercises that test incident response plans | Organisations that already have response plans | Recommended |
| NCSC Assured Training | Course content and delivery quality (Awareness, Application, Courseware) | Individuals and organisations choosing training | Voluntary |
| Cyber Advisor | Advisors who help small organisations implement Cyber Essentials controls | Small and medium-sized organisations | Voluntary |
| Cyber Essentials | Organisation-level certification of five technical controls | All organisations | Voluntary unless a contract requires it |
| CAPS (technology) | High Grade cryptographic products and cross-domain solutions | HMG and other appropriate organisations | Product assurance for classified data |
Scope: who and what is covered
NCSC groups its assured services into professional services assurance (the people and companies you hire) and technology assurance (products such as CAPS, TEMPEST and the Cyber Resilience Test Facilities). NCSC describes its role as the national technical authority that sets a standard and assesses industry offerings against it. This guide concentrates on the professional services schemes, since those are the ones most buyers procure.
- Central government departments and agencies: CHECK is the expected route for penetration testing of systems at OFFICIAL and above (up to TOP SECRET, excluding STRAP systems, per NCSC).
- Wider public sector: NCSC strongly recommends CHECK for all systems unless the system risk owner advises otherwise, and points public sector buyers to the government's dynamic purchasing system for consultancy, CIR and CRA services.
- CNI and operators of essential services: CHECK is intended to give CNI operators confidence in testers; ACSC is aimed at OES and regulated organisations; CRA and CyAS are used through sector oversight bodies.
- Private sector outside CNI: NCSC states penetration testing does not need to be done by a CHECK provider; CIR, CIE, Cyber Advisor and Cyber Essentials remain available and recommended.
- Suppliers to government: testing, consultancy and audit firms bidding for public sector work should expect buyers to ask which scheme they hold and to verify individual credentials.
Key obligations
The obligations fall on two parties: providers, who must meet the scheme standard to stay assured, and buyers, who are expected (or in some sectors required) to choose assured providers and run the engagement properly.
Provider requirements stated by NCSC
| Scheme | Personnel and standard requirements |
|---|---|
| CHECK | Team Leaders hold at least the UK Cyber Security Council Principal Cyber Security Professional (Security Testing) title; Team Members hold at least the Practitioner (Security Testing) title; both hold at least SC clearance. NCSC audits CHECK reports against CHECK standards. |
| CRA | Head Consultant holds Chartership in the Cyber Audit and Assurance specialism and has attended NCSC CAF training; Team Leader holds at least Principal registration; provider meets the CRA Scheme Standard and Scheme Partner requirements. |
| CIR | Provider assured at Standard or Enhanced Level; Enhanced providers show experience of APT attacks, regulated and multinational clients, incidents involving legal counsel or law enforcement, and advanced malware and log analysis on large estates. |
| ACSC | Provider meets the NCSC standard for consultancy and delivers advice aligned to NCSC guidance, in the specialisms it is assured for. |
| CIE | Provider conforms to the CIE Technical Standard (v1.4, September 2023); exercises cover nationally categorised Category 3, 4 and 5 incidents. |
| CyAS | Provider meets the CyAS Scheme Standard (membership, methodology, reporting) and the Working Practices document. |
| Assured Training | Courses assessed for content and delivery by APMG, the certification body NCSC approved for the scheme. |
Buyer responsibilities
- Choose the right scheme and level: CHECK for in-scope government systems; Enhanced Level CIR where NCSC's risk criteria apply; ACSC rather than Cyber Advisor for complex or nationally significant needs.
- Contract directly: NCSC is not a party. For CIR, NCSC asks buyers to require that work is done under the scheme's terms and conditions.
- Verify the people: check that the named team members hold the required titles and clearance on the day of the engagement.
- Meet sector requirements: where an oversight body is a Scheme Partner, its requirements apply in addition to the scheme standard.
- Use the feedback route: CHECK has a customer feedback form and a complaints route; using them is how weak providers come to NCSC's attention.
Timeline and current status
| Date | Event (source: NCSC scheme pages) |
|---|---|
| March 2019 | NCSC Assured (Certified) Training information page first published; last reviewed 25 November 2025 |
| September 2023 | CIE Technical Standard v1.4 issued |
| July 2024 | CRA Scheme Standard v1.0 published |
| 15 August 2024 | CRA applications opened |
| 30 October 2024 | CRA scheme launched with CAF-based audits |
| Summer 2026 | CyAS initial cohort of providers being assessed |
| Rest of 2026 | CRA provider applications closed while the standard is updated; new dates to be announced in December |
| End of 2026 (aim) | CyAS launch to the buyer community |
Two items are in development: ACSC's Cross Domain Advice sub-offering, and the post-quantum cryptography specialism (in pilot). For technology assurance, CAPS no longer evaluates products at the legacy Baseline and Enhanced grades.
Wider context: the Cyber Security and Resilience (Network and Information Systems) Bill was before the House of Lords at the time of writing with no Royal Assent shown (Parliament bill page, checked 27 October 2026). If enacted, it would bring more organisations under regulation, and their regulators may adopt assured schemes such as CRA. See the UK Cyber Security and Resilience Bill Guide.
Enforcement and penalties
The assured service schemes are not statutory regimes, and none of the NCSC scheme pages reviewed describes legal penalties. Their force comes from three places:
- Government policy and procurement: for central government, CHECK is the stated expectation for in-scope systems, and departmental assurance programmes such as GovAssure (a CRA Scheme Partner) can require assured audits. Non-compliance shows up as an assurance or audit finding, not a fine.
- Sector regulators: where a regulator is a Scheme Partner, it can require an audit by an assured provider as part of its oversight. Consequences then follow that regulator's own powers, for example under the NIS Regulations 2018. See the UK NIS Regulations 2018 Guide.
- Scheme standards and provider oversight: providers must keep meeting the scheme standard and working practices; NCSC audits CHECK reports and runs feedback and complaints routes. Buyers should treat the scheme terms as the baseline and write their own remedies into contracts.
The practical risk for a buyer is not a penalty but reliance on an unsuitable provider, or a test or audit that the oversight body later refuses to accept because the wrong scheme or level was used.
What it means for AI agents and non-human identities
None of the schemes has AI-agent or NHI-specific requirements today. They matter for NHI because the engagements they assure are where machine identity weaknesses are found and judged.
| Scheme | NHI and AI agent angle | What to put in the brief |
|---|---|---|
| CHECK | Tests routinely find hard-coded credentials, over-privileged service accounts and exposed API keys | Include service accounts, CI/CD credentials, cloud roles and agent integrations in scope; ask for findings tagged by identity type |
| CRA | CAF B2 covers access by automated functions and requires review of system-to-system access | Provide a machine identity inventory; expect sampling of service account reviews |
| CIR | Many incidents involve stolen tokens, OAuth grants or service account abuse | Ask how the provider investigates token and API key misuse and scopes revocation |
| CyAS | Adversary simulation can test whether stolen machine credentials are detected | Set objectives around credential theft and lateral movement through non-human accounts |
| ACSC | Architecture and risk advice for agent platforms, workload identity and secrets | Request advice aligned to NCSC guidance on identity and access |
| CIE | Exercises can rehearse a leaked-key or compromised-agent scenario | Include a non-human credential compromise inject and test revocation speed |
For identity-focused testing see the Red Teaming AI Agents for Identity Abuse guide and the Service Account Security Guide. Breaches such as the Marks and Spencer cyberattack, where attackers impersonated a third-party user, are good inputs for exercise scenarios.
Compliance steps
- Map your obligations. Record whether you are central government, wider public sector, CNI, an OES or private sector, and which oversight body or regulator applies.
- Ask your oversight body. Confirm whether it is a CRA or CyAS Scheme Partner and whether audits or simulations are encouraged, recommended or required.
- Set a scheme policy. Write a short procurement rule: CHECK for in-scope systems, Enhanced CIR where NCSC's criteria apply, ACSC for complex consultancy, CRA for regulator-facing audits.
- Use the official provider lists. Select from NCSC's search of assured providers rather than relying on a provider's own claim, and record the scheme, level and date checked.
- Verify individuals. Check UK Cyber Security Council titles and clearance for named staff before the engagement starts.
- Brief identity scope explicitly. Include service accounts, API keys, CI/CD and agent integrations in the statement of work for tests, audits and exercises.
- Arrange incident response in advance. Pre-select or retain a CIR provider at the right level so you are not choosing during an incident. See the Incident Response Retainer Buyer's Guide.
- Close the loop. Track findings to remediation and use NCSC feedback routes for poor engagements.
Choosing between overlapping schemes
| Need | Smaller or lower-risk organisation | Larger, regulated or nationally significant organisation |
|---|---|---|
| Basic security improvement | Cyber Essentials with help from a Cyber Advisor | ACSC (risk management or security architecture) |
| Technical testing | Any competent tester using NCSC guidance on commissioning a test | CHECK for government and CNI systems; CyAS for mature organisations once launched |
| Independent assurance for a regulator | Internal audit or ACSC audit and review | CRA where the oversight body is a Scheme Partner |
| Incident readiness | Standard Level CIR provider; CIE exercise of the response plan | Enhanced Level CIR retainer; CIE exercise at Category 3 to 5 scenarios |
Practitioner checklist
- Classify your organisation against the CHECK, ACSC and CIR audience criteria and write the result down.
- Confirm with your regulator or department whether CRA or CyAS applies in your sector.
- Require CHECK for government systems at OFFICIAL and above and record exceptions approved by the risk owner.
- Choose Enhanced Level CIR if you are regulated, multinational, CNI, central government or a likely nation-state target.
- Verify provider assurance on NCSC's provider search on the day you contract.
- Check named testers' and auditors' UK Cyber Security Council titles and clearance.
- Put non-human identities and AI agent integrations explicitly in every test, audit and exercise scope.
- Recheck scheme pages before each procurement: CRA, CyAS and ACSC are all changing in 2026.
Standards and references
- NCSC: Assured services
- NCSC: CHECK information for buyers
- NCSC: Cyber Incident Response information for buyers
- NCSC: Assured Cyber Security Consultancy
- NCSC: Cyber Resilience Audit
- NCSC: Cyber Adversary Simulation
- NCSC: Cyber Incident Exercising
- NCSC: Assured Training
This guide summarises the NCSC assured service schemes as published on NCSC pages on 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: Penetration Testing Provider Buyer's Guide · NCSC Cyber Resilience Audit Scheme Guide · NCSC Cyber Assessment Framework (CAF) Guide · Cyber Essentials Guide · Incident Response Guide