NCSC Defines Two-Tier Criteria for CIR Providers and How to Choose

The United Kingdom's National Cyber Security Centre (NCSC) has outlined two certification levels for "Assured Cyber Incident Response (CIR)" providers that organisations can use when recovering from cyber incidents. This framework is intended to provide quality assurance when using external incident response services.

Specifically, CIR has two levels—Standard and Enhanced—and providers that meet the technical criteria for the Enhanced level are considered to also have the technical capability to deliver the incident response services required at the Standard level. In other words, operators certified at the Enhanced level are guaranteed to meet higher standards of capability and, by extension, satisfy the Standard requirements as well.

For organisations that are unsure which level to choose, the NCSC directs them to consult the "Information for buyers" section on the same webpage. This guidance helps organisations select the appropriate service level based on their size, expected impact scenarios, and the scope of response required.

This article provides decision-making information for organisations selecting external incident response support by clarifying the selection criteria and tiered structure for CIR providers. The content is based on NCSC's official guidance and does not include evaluations or endorsements of specific providers.