NCSC (National Cyber Security Centre, United Kingdom)
The British cyber security agency, part of GCHQ, launched in October 2016; its annual reviews and ransom guidance are read closely by the London market.
In May 2023, the NCSC published guidance on ransom payments jointly with the ABI, BIBA and the IUA, the British insurer and broker associations. It reminded victims that paying is not in itself illegal in the UK, sanctions aside, and asked them to document their decision. A state agency and the insurance market signing one text says a lot about the insurer's place in British doctrine. The National Cyber Security Centre is the United Kingdom's national cyber security agency, part of GCHQ, the signals intelligence service, and launched in October 2016. It handles serious incidents, advises operators and publishes an annual review with figures. The 2024 review counted 430 incidents handled, 89 of them nationally significant; the 2025 review counted 204 nationally significant incidents, more than double. For an underwriter these reports offer a severity trend in a market that publishes almost none of its own loss data. Read it with care: a nationally significant incident is defined by its effect on the country, regardless of the cost to the victim. The NCSC also runs the Cyber Essentials scheme, which some British applications ask about. Its French counterpart is ANSSI, which reports to the Prime Minister rather than to an intelligence service; at EU level, ENISA advises without handling incidents itself. Not to be confused with the NCA, the National Crime Agency, which pursues the attackers: the NCSC looks after the victim and the network.
Dated case: in May 2023, a London broker prepares the renewal of a client hit by ransomware the year before, which had paid. The underwriter asks for the payment decision file: who decided, on whose advice, what sanctions check was made. That is the very list the guidance from the NCSC, the ABI, BIBA and the IUA had just set out. The client had kept it, with the negotiator's advice and the screening of the receiving wallets, and the risk renewed with no new exclusion.
NCSC UK, UK NCSC, UK cyber agency, British cyber security agency
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.