The NCSC 10 Steps to Cyber Security gives you a structured way to cover every major risk area in your business, from board-level risk management down to supply chain checks. This guide breaks the framework into steps you can actually action in 2026, with the tools and evidence trail each one needs.
Why this matters
The National Cyber Security Centre built the 10 Steps framework for UK organisations of every size, and it underpins guidance referenced in government procurement, cyber insurance applications, and board reporting. It's not a certification you sit an exam for — it's a self-assessed control set, which means the evidence you hold matters more than the policy you wrote.
Most businesses already do pieces of this without naming it: patching, access reviews, staff training. The gap is usually structure — nobody owns all 10 steps, so gaps go unnoticed until a customer security questionnaire or a Cyber Essentials Plus audit asks for evidence you don't have. If you're choosing between frameworks first, read how to choose the right compliance framework for your business before you commit resource to this one.
What you'll need
- An up-to-date asset register: devices, cloud services, and who owns each one
- A named risk owner — someone with authority to sign off risk decisions, not just log them
- 6-8 weeks of dedicated time from whoever runs IT or security, even part-time
- Existing policies (acceptable use, access control) if you have them — you'll refine rather than start from zero
- A way to store evidence centrally; spreadsheets work for month one, they don't scale past month three
- Buy-in from leadership to enforce access changes and patching windows, since several steps require decisions that affect daily operations
The 10 steps, in order
1. Set up risk management
This step accomplishes the thing every other step depends on: a documented, owned view of what could go wrong and how much it would cost you. Without it, you're patching symptoms.
Assign a named risk owner, build a risk register with at least 10-15 entries covering data loss, ransomware, and third-party failure, and set a review cadence — quarterly is standard for a business under 250 staff in 2026. Common mistake: treating the risk register as a one-time document instead of a living one reviewed every quarter.
2. Run engagement and training
This step gets your staff acting as a control rather than a vulnerability. Phishing accounts for a large share of UK breach starting points year after year, and untrained staff are the fastest way in.
Roll out onboarding security training within the first week of employment and refresher sessions at least twice a year. If your team is distributed, security awareness training for remote teams covers the delivery mechanics that in-office training misses. Expected outcome: a measurable drop in phishing simulation click-through rate over two to three quarters. Common mistake: running training once at onboarding and never again.
3. Build asset management
This step gives you the inventory every later step references — you can't patch, monitor, or restrict access to something you don't know you have.
List every device, application, and cloud service in use, tag each with an owner and a criticality rating, and refresh the list monthly, not annually. Common mistake: excluding personal devices used for work email — shadow IT is still your attack surface.
4. Fix architecture and configuration
This step closes off the default-settings weaknesses attackers scan for automatically. Misconfigured cloud storage and default admin credentials remain two of the most common findings in penetration tests.
Harden default configurations on every new device and service before deployment, disable unused ports and services, and document your secure baseline so new hires apply it consistently. Common mistake: hardening production but leaving staging and dev environments on default settings.
5. Run vulnerability management
This step catches the flaws attackers exploit before you patch them — timing is the entire game here. NCSC guidance points to critical patches applying within days, not the next scheduled maintenance window.
Set a patching SLA (14 days for high-severity, 30 for medium is a reasonable 2026 baseline), run vulnerability scans monthly, and track remediation to close. A documented workflow makes this repeatable — see how to build a vulnerability remediation workflow for the step-by-step. Common mistake: scanning for vulnerabilities but having no formal SLA for closing them.
6. Tighten identity and access management
This step limits what a compromised account can actually do, which matters more than preventing the compromise itself — credentials get phished regardless.
Enforce multi-factor authentication on every account with access to sensitive data, apply least-privilege access by default, and run access reviews quarterly to catch permission creep. Common mistake: granting admin rights during onboarding to save time and never revoking them.
7. Secure your data
This step protects the thing attackers are actually after — the data, not the network. Encryption at rest and in transit is table stakes by 2026, not a differentiator.
Classify data by sensitivity, encrypt anything classified as confidential or above, and set retention limits so you're not storing data you no longer need. Common mistake: encrypting production databases but leaving backups unencrypted.
8. Set up logging and monitoring
This step gives you the evidence trail auditors and incident responders both need — you can't investigate what you didn't log.
Centralise logs from your critical systems, retain them for at least 12 months, and set alerts for anomalous access patterns rather than relying on manual review. Common mistake: collecting logs nobody ever reviews until after an incident.
9. Prepare incident management
This step determines how fast you recover, not whether you get hit — every organisation eventually faces an incident. NCSC data consistently shows response time is the biggest driver of breach cost.
Write an incident response plan naming roles and escalation paths, and rehearse it at least once a year. A tabletop exercise for incident response is the fastest way to find the gaps in a plan before a real incident does. Common mistake: a plan that exists on paper but has never been tested against a realistic scenario.
10. Manage supply chain security
This step closes the door attackers increasingly prefer — your suppliers, not you. Third-party compromise is now a leading cause of major UK breaches.
Map which suppliers touch your data or systems, require evidence of their own security controls (Cyber Essentials or equivalent is a reasonable minimum ask), and reassess annually. Common mistake: onboarding a new supplier with system access and never asking for security evidence at all.
Automate all 10 steps of evidence
OneClickComply tracks controls, evidence, and renewal dates in one place.
Troubleshooting
- Risk register is out of date within a month — assign the review to a calendar reminder, not a person's memory. Quarterly reviews slip without a forced trigger.
- Staff skip training modules — tie completion to a system access gate; if training isn't done, access doesn't activate.
- Patching SLA gets missed on legacy systems — flag legacy assets separately in your asset register with a compensating control noted, rather than pretending the SLA applies equally everywhere.
- Logs exist but nobody reviews them — set at least one weekly automated alert rule before you add more log sources; volume without alerting is dead weight.
- Suppliers refuse to share security evidence — make evidence a contract clause at renewal, not an optional ask after the fact.
- Evidence is scattered across email, spreadsheets, and screenshots — centralise it before your next audit cycle, not during it.
Tools and resources
- A risk register template (spreadsheet works to start)
- MFA enforcement on your identity provider
- A vulnerability scanner with scheduled monthly runs
- Centralised logging with retention set to at least 12 months
- A documented incident response plan, tested annually
- Compliance automation software to track evidence and renewal dates across all 10 steps without manual chasing
What to do next
Once the 10 steps are documented, the next bottleneck is proving them during an audit or a customer's security questionnaire. How to automate evidence collection for audits covers how to stop rebuilding the same evidence pack every time someone asks for it.
Frequently asked questions
One last thing
The step teams skip most often isn't the technical one — it's supply chain security, step 10. Third-party access keeps showing up as a leading cause of major UK breaches, yet it's the step with the least documentation in most self-assessments reviewed in 2026. Start your supplier evidence requests this quarter, not after the next incident makes it urgent.