NCSC resilience guidance: start with your critical services

01The 1 October guidance

The NCSC’s guidance on reducing the risk of highly disruptive cyber attacks, dated 1 October 2026, organises resilience around five capabilities: identify critical systems, services and data; reduce exposure; limit the impact of compromise; build system resilience; and detect and respond quickly.

For a small business, this is a useful way to connect a website finding with an operational decision. An external check can help identify part of your exposure. It cannot tell you whether your team can take bookings, access customer records or restore an essential service after an incident.

02Try a 30-minute service review

1. Choose three services whose loss would interrupt trading: for example email, online bookings and accounts.
2. For each service, name the business owner, technical provider and accounts needed to recover access. Include the registrar and DNS provider where relevant.
3. Write down how long you could operate without it and which manual workaround is realistic.
4. Check that the recovery plan, supplier contact details and essential records remain accessible when the usual account or laptop is unavailable.
5. Schedule a restore or recovery exercise with the provider. Record the outcome and the improvements needed.

03Turn the scan into a work queue

Give a finding a service owner and a practical consequence. A missing control on the customer portal may deserve different attention from the same observation on an unused marketing subdomain. Keep the technical severity visible, but add business context, a target date and evidence of completion. This briefing applies the October guidance; it does not report a new incident on 1 November.