UK NCSC seeks EASM procurement data to refine future cyber guidance

The UK National Cyber Security Centre is actively seeking input from organisations regarding their procurement processes for external attack surface management solutions. This call for participation forms part of the ongoing development of the ACD 2.0 service, which aims to responsibly report vulnerabilities to system owners. The agency stated that it wants to understand how organisations approach external attack surface risk during the initial evaluation and selection phases.

Root cause

Earlier this year, the NCSC invited organisations with experience in external attack surface management and exposure management solutions to participate in its ACD 2.0 research. According to the official advisory, these conversations provided valuable insights into how organisations use such solutions in practice. The agency noted that it learned how teams review findings, prioritise activity, and respond to potential risks. However, the NCSC identified a gap in understanding the earlier stages of that process, specifically the considerations and challenges faced when determining which support, tools, or services best meet organisational needs.

Attack path

The NCSC is particularly keen to hear from individuals involved in identifying organisational needs, evaluating options, and building business cases. The agency is interested in learning from those who influence investment or procurement decisions, select suppliers, or shape their organisation's approach to external attack surface risk. Participants may be considering EASM for the first time, comparing different approaches, or having recently selected, purchased, or implemented a solution. The NCSC emphasised that sharing these experiences will help shape better guidance and services for organisations managing external attack surface risk.

Affected versions

The NCSC specified several roles that are relevant for this research phase. These include individuals who evaluate cyber security tools, services, or technologies, and those who contribute to cyber risk management activities. The agency also seeks input from people who influence or make cyber security investment decisions, manage procurement or supplier selection activities, and provide cyber security governance, assurance, or strategic leadership. Additionally, the NCSC is interested in those who have recently been involved in decisions relating to external attack surface management, exposure management, or related security capabilities.

Mitigation

Participation in the research may involve a range of activities, though specific tasks were not detailed in the initial announcement. The NCSC assured that all information provided will remain confidential and that participation is entirely voluntary. Individuals interested in helping the NCSC are asked to complete a registration form hosted by Optimal Workshop. The agency stated that the form should take no longer than five minutes to complete. Once registered, participants will be added to the research panel for future activities, and the NCSC will contact them via email if an opportunity fits their experience and current areas of focus.

What to do and how to stay safe: NCSC

• Review your organisation's current external attack surface management strategy to identify gaps in procurement documentation.
• Gather records of past evaluations, business cases, and supplier selection criteria for EASM tools.
• Identify key stakeholders involved in cyber security investment decisions who can provide insights on risk management.
• Monitor communications from the NCSC for updates on the ACD 2.0 research and future guidance releases.

Step-by-step guide: DDoS Protection for Dedicated Server: Architecture and Mitigation

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is eligible to participate in the NCSC's ACD 2.0 research?

Individuals involved in evaluating, selecting, or adopting external attack surface management solutions, including those in procurement, governance, and risk management roles.

Is participation in the NCSC research mandatory?

No, the NCSC stated that participation is entirely voluntary and all information provided will remain confidential.

What is the deadline for organisations to have alternatives to Mail Check and Web Check?

Organisations should have alternatives in place by 31 March 2026, according to the NCSC advisory.