The National Cyber Security Centre (NCSC) is the UK government's authority on cyber security. Their "10 Steps to Cyber Security" provides organizations with actionable guidance to protect against the most common cyber threats.
Unlike some frameworks that focus on achieving certification, the NCSC 10 Steps is designed to be implemented piece by piece. You don't need to complete all 10 steps before seeing value - each step independently strengthens your security posture.
How This Guide Works
For each of the 10 steps, we provide three implementation layers: Implementations (practical actions to put in place), Upgrades (enhancements to existing systems), and Protocols (ongoing processes and policies). This structure lets you progress from basic compliance to sophisticated security as your business matures.
Why Follow NCSC Guidance?
Government-backed: Developed by the UK's national authority, aligned with Cyber Essentials requirements
Insurance-friendly: Insurers recognize NCSC frameworks when assessing cyber policies
Scalable: Works for businesses of any size, from startups to enterprises
Practical: Focuses on controls that actually prevent real-world attacks
Continuously updated: Updated for current threats and technology changes
1
Risk Management Foundation
Take a risk-based approach to securing your data and systems. Understand what you're protecting, from what threats, and prioritize accordingly.
Implementations
Conduct comprehensive risk assessments identifying threats to systems and data
Create inventory of critical assets mapped to potential vulnerabilities
Integrate cyber risk into business decision-making processes
Establish risk register documenting identified risks and mitigations
Upgrades
Adopt automated risk management tools for continuous monitoring
Implement threat intelligence platforms for real-time analysis
Transition to integrated GRC systems aligned with ISO 27001
Deploy risk visualization dashboards for leadership
Protocols
Establish formal risk management framework with quarterly reviews
Embed risk considerations into supplier contracts and cloud agreements
Document and communicate risk tolerance levels across organization
Review risk appetite annually with board involvement
InfiniTech Approach
We conduct free risk assessments for Cornwall businesses, identifying your highest-priority vulnerabilities and creating a roadmap aligned with your budget. No jargon, just practical recommendations.
2
Engagement and Training Critical
Build security that works for people in your organization. Most breaches involve human error - your team is either your strongest defense or your weakest link.
Implementations
Run practical staff security awareness training with role-specific modules
Launch interactive workshops on phishing recognition and safe data handling
Implement simulated phishing campaigns to test awareness
Upgrades
Shift to online platforms with gamified elements and mobile apps
Integrate training metrics into performance reviews
Deploy automated training assignment based on role changes
Use AI-driven personalized learning paths
Protocols
Foster positive security culture emphasizing benefits over punishments
Mandate training for new hires and contractors
Conduct annual refresher courses adapting to emerging threats
Maintain feedback loops for employees to suggest improvements
Training That Actually Works
Avoid boring PowerPoint lectures. Effective training is short (15-20 minutes), relevant to daily work, and repeated quarterly. Focus on practical scenarios: "This is what a phishing email looks like. This is what to do when you receive one."
3
Asset Management Foundation
Know what data and systems you have and what business need they support. You can't protect what you don't know exists.
Implementations
Build centralized asset register cataloging hardware, software, data
Classify assets by sensitivity and business criticality
Map data flows showing where information moves
Document asset ownership and lifecycle stages
Upgrades
Deploy automated asset discovery tools and network scanners
Implement IT asset management software with auto-updating
Use agent-based monitoring to detect shadow IT
Integrate with procurement systems for automatic registration
Protocols
Perform bi-annual audits to verify asset accuracy
Remove obsolete items and decommission properly
Integrate asset management with change control processes
Ensure GDPR compliance through data inventory
InfiniTech Endpoint Management
Our platform automatically discovers and catalogs every device on your network. You get real-time asset inventory showing hardware specs, installed software, last update, and security status - all in one dashboard.
4
Architecture and Configuration Important
Design, build, maintain, and manage systems securely. Security should be built in, not bolted on afterward.
Implementations
Incorporate security-by-design principles in system development
Segment networks to isolate critical areas
Apply default secure configurations on all devices
Disable unnecessary services and remove default accounts
Conduct regular vulnerability scans on infrastructure
Review architecture before deploying new systems
Document all architectural decisions and rationale
5
Vulnerability Management Critical
Keep your systems protected throughout their lifecycle. Vulnerabilities are discovered constantly - your patching process determines your risk exposure.
Implementations
Set up vulnerability scanning with regular schedule
Conduct annual penetration testing
Subscribe to threat intelligence feeds for early warnings
Prioritize patches based on CVSS severity scores
Upgrades
Implement automated patching via endpoint management
Integrate vulnerability data with SIEM for alerts
Deploy virtual patching for legacy systems
Use predictive analytics to identify likely targets
Protocols
Define remediation timelines (critical within 48 hours)
Maintain vulnerability database with tracking
Conduct post-patch testing for system stability
Include third-party software in patch process
Why Patch Management Matters
The WannaCry ransomware attack exploited a vulnerability Microsoft had patched two months earlier. Organizations that delayed patching were compromised. The ransomware caused £6 billion in damages globally, including significant impact on the NHS.
6
Identity and Access Management Critical
Control who and what can access your systems and data. Stolen or weak credentials are the #1 attack vector.
Implementations
Enforce multi-factor authentication for all accounts
Implement privileged access management for admin accounts
Deploy password manager for strong unique passwords
Upgrades
Upgrade to single sign-on with biometric options
Implement adaptive authentication based on risk factors
Deploy identity governance for automated access reviews
Use passwordless authentication where possible
Protocols
Review access permissions every 6 months
Revoke unnecessary privileges immediately
Log and audit all access attempts with alerts
Balance security with usability to prevent workarounds
MFA Implementation
Microsoft reports MFA blocks 99.9% of automated attacks. Yet only 22% of Microsoft 365 users have it enabled. InfiniTech enables and enforces MFA across all your systems as part of standard setup.
7
Data Security Critical
Protect data where it is vulnerable: in storage, in transmission, and during processing. GDPR makes this a legal requirement as well as security necessity.
Implement automated data discovery and classification
Use data masking for development environments
Protocols
Conduct annual data inventories mapping locations
Establish handling procedures aligned with CIA triad
Test recovery processes quarterly
Document data retention and disposal policies
The 3-2-1 Backup Rule
Keep 3 copies of data, on 2 different media types, with 1 copy offsite. This protects against hardware failure, ransomware, and physical disasters. Modern interpretation adds: 1 copy should be immutable (cannot be deleted or encrypted).
8
Logging and Monitoring Important
Design systems to detect and investigate incidents. You need visibility to spot attacks in progress and investigate breaches afterward.
Implementations
Configure centralized logging for systems and networks
Set up monitoring dashboards establishing baselines
Enable security logging on all critical systems
Capture authentication events and access attempts
Upgrades
Adopt SIEM platform for real-time correlation
Implement UEBA for anomaly detection
Deploy automated threat hunting tools
Use AI/ML for pattern recognition
Protocols
Define log retention policies (12 months minimum)
Review logs routinely for suspicious activity
Integrate monitoring with incident response
Customize alerts to reduce false positives
InfiniTech Monitoring
Our endpoint management platform monitors 200+ security indicators across your devices, applications, and network. We alert on suspicious behavior before it becomes a breach - and provide forensics if something does go wrong.
9
Incident Management Critical
Plan your response to cyber incidents in advance. When attack happens, having a documented plan reduces damage and recovery time by 50-70%.
Implementations
Create incident response plan outlining roles and procedures
Form cross-functional team (IT, legal, HR, leadership)
Document communication channels and escalation paths
Establish relationships with external forensics providers
Upgrades
Incorporate tabletop exercises testing the plan
Integrate with external crisis communication services
Deploy automated playbooks for common scenarios
Use simulation tools for realistic training
Protocols
Conduct quarterly drills to refine procedures
Document lessons learned from incidents and tests
Coordinate with logging systems for evidence collection
Define recovery objectives and escalation triggers
Incident Response Timeline
Average time to detect a breach in UK SMEs: 206 days. Average time to contain once detected: 73 days. Organizations with tested incident response plans detect breaches 50% faster and contain them 70% faster. The plan makes the difference.
10
Supply Chain Security Important
Collaborate with your suppliers and partners. 60% of breaches originate through third-party access. Your security is only as strong as your weakest vendor.
Implementations
Assess third-party vendors for cyber risks during onboarding
Require security questionnaires from all suppliers
Include security clauses in contracts mandating standards
Conduct vendor security audits for critical suppliers
Upgrades
Use supply chain risk management tools
Monitor vendor security postures continuously
Require certifications like SOC 2 or ISO 27001
Implement vendor security scoring systems
Protocols
Establish ongoing collaboration protocols
Conduct joint incident response planning
Review supply chain risks annually
Provide security assistance to smaller suppliers
Cornwall Supply Chain Advantage
As a local IT provider, InfiniTech understands Cornwall's business ecosystem. We work with local suppliers implementing security standards, creating a more secure regional supply chain that benefits everyone.
Your 90-Day NCSC Implementation Roadmap
Don't try implementing all 10 steps simultaneously. Follow this prioritized roadmap focusing on highest-impact controls first:
Month 1: Foundation (Steps 1, 2, 3)
Week 1-2: Conduct initial risk assessment and create asset inventory
Week 3: Launch security awareness training program
Week 4: Document risk register and establish governance framework
Month 2: Protection (Steps 5, 6, 7)
Week 5-6: Implement patch management process and enable MFA
Week 7: Deploy proper backup solution with offline storage
Week 8: Configure access controls and review permissions
Month 3: Detection & Response (Steps 4, 8, 9, 10)
Week 9: Review architecture and apply secure configurations
Week 10: Set up centralized logging and monitoring
Week 11: Create incident response plan and conduct first drill
Week 12: Assess vendor risks and update contracts
Ongoing Maintenance
After initial implementation, allocate 4-8 hours monthly for maintenance: reviewing logs, testing backups, conducting training, updating risk assessments, and refining procedures. Security is continuous, not a project with an end date.
The Reality of Implementation
The NCSC 10 Steps framework is comprehensive but not complicated. For a 10-20 person Cornwall business, implementing all 10 steps properly requires approximately:
Initial effort: 60-80 hours of focused work over 90 days
Initial cost: £3,000-6,000 for tools and services
Ongoing cost: £200-400/month for maintenance and monitoring
Ongoing effort: 4-8 hours/month for reviews and updates
Compare this to the average cost of a cyber breach for UK SMEs: £4,200/minute of downtime, plus ransom demands averaging £180,000-250,000, plus regulatory fines, plus reputational damage.
The NCSC 10 Steps isn't a luxury for enterprises. It's practical protection that pays for itself the first time it prevents an attack.
Implement NCSC 10 Steps Properly
InfiniTech's endpoint management platform automates steps 3, 5, 6, 7, and 8 for £10/device/month. We'll assess your current state against all 10 steps, create your implementation roadmap, and provide ongoing support.