The NCSC 10 Steps to Cyber Security, Mapped to Cyber Essentials and ISO 27001

The NCSC 10 Steps to Cyber Security are the National Cyber Security Centre’s summary of how an organisation should protect itself, split into ten areas: risk management, engagement and training, asset management, architecture and configuration, vulnerability management, identity and access management, data security, logging and monitoring, incident management and supply chain security. The current version was published in May 2021 for medium to large organisations with someone dedicated to managing cyber security.

The 10 Steps are guidance, not a standard you can be certified against. To prove progress to customers you need an assessed scheme such as Cyber Essentials, ISO 27001 or PCI DSS. This page explains each step briefly, maps all ten to those three schemes in one table and lists the questions a board should ask.

What are the NCSC 10 steps to cyber security?

They are ten areas of security management, with risk management setting the direction for the other nine. Each step is summarised below in our words; the full guidance is in the NCSC’s 10 Steps to Cyber Security collection.

1. Risk management. Decide how you will identify, assess and manage cyber risk, and make senior leadership accountable for it. Know which systems and information matter most to the business and how much risk you are willing to accept, so the other nine steps follow from those decisions.
2. Engagement and training. Build security around how people actually work. Involve staff in shaping policies, make it safe to report mistakes, and run short, regular and relevant training, with senior leaders visibly following the same rules.
3. Asset management. Asset security starts with knowing what you have. Keep an inventory of systems, devices, data, accounts and suppliers, with an owner for each, and decommission anything you no longer use. You cannot protect or patch an asset you do not know about.
4. Architecture and configuration. Design, build and maintain systems securely from the start. Use secure configurations, separate networks, protect administration and treat security as part of design rather than an afterthought.
5. Vulnerability management. Keep software and devices updated, prioritise fixes by risk and replace systems that no longer get security updates. Find weaknesses before attackers do, through scanning and testing, and track each one to a fix.
6. Identity and access management. Give people and services the access they need and no more. Use strong authentication such as MFA, keep privileged accounts separate and tightly controlled, and remove access promptly when people leave or change role.
7. Data security. Protect data wherever it is stored, processed or sent, including in cloud services and with suppliers. Use encryption where appropriate, and keep backups that the same attack cannot reach.
8. Logging and monitoring. Collect and review logs from the systems that matter so you can spot attacks and investigate incidents. Decide what you most need to detect, then protect your logs and keep them long enough to be useful.
9. Incident management. Plan your response and recovery before you need them. Assign roles, know who to contact, rehearse the plan with exercises and learn from every incident.
10. Supply chain security. Know which suppliers you depend on and what access they have. Set proportionate security requirements in contracts, require incident reporting and data return or deletion at contract end, and help suppliers improve over time.

How do the 10 steps map to Cyber Essentials, ISO 27001 and PCI DSS?

Cyber Essentials covers the technical core of steps 3 to 6, ISO 27001 can cover all ten, and PCI DSS has requirements in all ten areas but applies them only to the cardholder data environment and the systems connected to it. This is our mapping, not an official NCSC one. ISO 27001 references are clauses or ISO 27001 Annex A controls (marked “A.”) from the 2022 edition. PCI DSS references are v4.0.1 requirements.

For PCI DSS detail, our PCI DSS compliance checklist covers all 12 requirements, including those that became mandatory on 31 March 2025.

How do the 10 steps relate to Cyber Essentials?

Cyber Essentials is the certified baseline for the technical heart of the 10 Steps. Its five Cyber Essentials controls (firewalls, secure configuration, security update management, user access control and malware protection) sit inside steps 4 to 6, the scoping exercise covers part of step 3, and an assessor checks the controls across every in-scope device, account and cloud service. Cyber Essentials Plus adds hands-on testing of a sample of those devices and accounts.

What Cyber Essentials does not give you is the governance around those controls. Steps 1, 2, 7, 8 and 9 are outside its scope, and step 10 is only touched. That is why many organisations certify to Cyber Essentials first, then use the 10 Steps, or ISO 27001, to build the rest.

Who are the 10 Steps for?

The NCSC says the collection is for medium to large organisations that have someone dedicated to managing cyber security, and is written for security professionals and technical staff. For smaller organisations it suggests the NCSC’s Cyber Action Toolkit as a better place to start, although the principles apply to everyone. If you run a small firm without a security team, our cyber security plan for small businesses turns the same ideas into practical first steps.

Boards are not the primary audience. The NCSC’s Cyber Security Toolkit for Boards and the government’s Cyber Governance Code of Practice set out what directors should own, and the questions below connect the two.

What should the board ask about the 10 steps?

One question per step is enough to start an honest conversation:

How do you use the 10 steps in practice?

1. Score each step as not started, partly in place or in place, and note the evidence for each score.
2. Fix the baseline first. Certifying to Cyber Essentials locks in the technical controls behind steps 3 to 6.
3. Close the governance gaps in steps 1, 2 and 9 with a risk register, a training plan and a rehearsed incident plan.
4. Get an independent view. Our guide to how a cyber security audit works explains how to test your scores, and regulated organisations may be assessed against the NCSC’s Cyber Assessment Framework instead.
5. Review every year, and after any significant change or incident.

Why Sovereign Secure?

• We are an IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates for the technical core of steps 3 to 6.
• We are ISO 27001 certified, and provide ISO 27001 consultancy with certification audits by our partner certification body, MQA International.
• We are a PCI SSC Qualified Security Assessor (QSA) company, Qualified PIN Assessor and Card Production Security Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
• We provide penetration testing and vulnerability scanning for step 5, with external ASV scans delivered through a PCI SSC Approved Scanning Vendor.

What is the next step?

Start with the baseline behind steps 3 to 6. Check where you stand with our free Cyber Essentials readiness check, then certify with Cyber Essentials from £320 + VAT. For the governance steps, our ISO 27001 consultancy builds the risk, incident and supplier management that steps 1, 2, 9 and 10 describe. Use the form below or contact us for a quote.