NCSC
UK national cyber agency within GCHQ; advisories, attribution, and the GDPR Article 32 standard.
NCSC chief executive Dr Richard Horne told RUSI on 17 June 2026 that his agency handled over 200 cyber incidents against UK critical infrastructure in the past year, about 75% traced to Russia, China or Iran, as the Cyber Security and Resilience Bill that would put NCSC guidance on a statutory footing moved to The House of Lords.
Last refreshed: 3 August 2026 · Appears in 1 active topic
Will the Cyber Security and Resilience Bill give NCSC guidance the force of statute on 10 June?
Timeline for NCSC
Co-signed the advisory and published the UK release on 8 October
Cybersecurity: Threats and Defences: Ten agencies name Beijing firm in hacksTold every ASOS customer to assume they are affected
Cybersecurity: Threats and Defences: ASOS app pushes rogue alert to customersMentioned in: Star Blizzard lures think tanks by invite
Cybersecurity: Threats and DefencesTold UK organisations on 28 September to mitigate
Cybersecurity: Threats and Defences: Citrix replaces its own NetScaler fixExposed CHOSEN BRICK with the FBI and AIVD
Cybersecurity: Threats and Defences: UK, US and Dutch expose Iranian spywareBackground
The National Cyber Security Centre is the UK's national cybersecurity authority, operating as part of GCHQ. It provides threat advisories, Incident Response support, and guidance to UK industry and government on cybersecurity standards. NCSC's advisory outputs are informed by GCHQ's signals intelligence collection, giving them a higher attribution-confidence basis than purely commercial threat intelligence. NCSC works in formal partnership with the Five Eyes CERTs and regularly co-issues advisories with the US CISA, FBI, and the Dutch AIVD.
NCSC guidance carries regulatory weight beyond best-practice status: the UK ICO has established in both the Capita (£14m) and Advanced Computer Software (£3.07m) monetary penalty notices that NCSC cyber hygiene guidance, specifically Active Directory tiering and Privileged Access Management, constitutes the GDPR Article 32 technical standard.
On 23 July, NCSC was one of fifteen co-sealing agencies on advisory AA26-204A, led by CISA and the NSA. Its own advisory role was translating the Coalition's Zimbra webmail finding, that the exploited chain hands an attacker a victim's last 90 days of mail from a single preview, into guidance for UK operators to patch or isolate exposed instances. A CISA alert on water and wastewater plant controllers, published 30 July, separately cited NCSC's Secure Connectivity Principles for Operational Technology; that guidance dates to March 2024, so the citation reuses an existing standard rather than reflecting new or newly coordinated NCSC action.
Its guidance is becoming statutory law
The UK Cyber Security and Resilience Bill passed its third reading in the Commons on 10 June 2026 and advanced to the Lords, adding ransomware and attacker pre-positioning to the incidents organisations must report, with fines reaching £17 million or 4 per cent of global turnover; a proposed ransomware-payment disclosure requirement did not make the published text.
On the same day the Bill moved to the Lords, 17 June, NCSC chief executive Dr Richard Horne told the RUSI security conference his agency had handled over 200 cyber incidents against UK critical infrastructure in the past year, about 75 per cent traced to state actors in Russia, China or Iran, giving peers a concrete incident count to frame their scrutiny of a Bill that will convert NCSC's own guidance into a legal standard.
It keeps naming Russian router hijackers
NCSC assessed with 'almost certain' confidence on 7 April 2026 that GRU Unit 26165 ran a SOHO router DNS-hijacking campaign harvesting Microsoft 365 OAuth tokens, an attribution it reached jointly with the FBI.
NCSC returned to router hijacking on 9 July, this time naming FSB Centre 16 as part of a Coalition of 18 partner agencies, over a separate campaign exploiting decades-old default settings rather than a new software flaw; NCSC's own advice to UK operators was to change default credentials and disable remote management immediately, since no patch closes a configuration weakness.
What has NCSC warned about in 2026?
Does NCSC guidance have legal force in the UK?
What is the NCSC's role in the Cyber Security and Resilience Bill?
How is NCSC connected to GCHQ?
How many cyber attacks hit UK critical infrastructure in 2026?
What is the FortiBleed Fortinet credential leak?
When does NCSC expect AI to enable large-scale cyber attacks?
What did NCSC's July 2026 LAUNDRY BEAR advisory warn about?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 3 August 2026. Editorial standards.