Actions to take when the cyber threat is heightened

Summary

The National Cyber Security Centre explains how organisations should respond when the cyber threat increases. The guidance urges establishing a balance between acceptable risk and defensive measures, and focuses on practical, high-priority actions that can be completed quickly to reduce vulnerability and limit impact.

Key areas covered include patching systems and firmware, verifying access controls and multi-factor authentication, ensuring antivirus and firewall defences are functioning, reviewing logging and monitoring, testing backups (including offline copies), and validating incident response plans and escalation routes. It also covers checking internet-facing assets, handling phishing reports, managing third-party access, registering for NCSC alerts, and briefing the wider organisation.

Key Points

Heightened threat periods require prioritising basic cyber hygiene rather than widespread system changes.
Ensure all devices and internet-facing services are patched promptly, including firmware and third-party software.
Verify strong, unique passwords and that multi-factor authentication (MFA) is properly configured for critical and privileged accounts.
Confirm antivirus is active and updating, and review firewall rules for unexpected temporary exceptions.
Ensure logging is in place, retained (aim for at least one month where possible) and monitored, especially antivirus logs.
Test backups regularly, keep an offline copy, and back up critical machine state and credentials as well as data.
Review and update incident response plans, contact lists and decision authorities, and ensure communication methods work if systems are down.
Catalogue and scan your internet footprint; unpatched internet-facing services represent an unmanageable risk.
Make phishing reporting simple for staff and have a process to handle reported suspicious emails.
Understand and limit third-party access privileges; verify third-party security practices.
Large organisations should consider accelerating key mitigations, revisiting risk tolerances, scaling SOC hours and acquiring threat feeds where appropriate.

Why should I read this?

Look — this is the checklist you want when things feel a bit hairier than usual. It’s short, practical and focused on actions you can actually do fast: patch, lock down accounts, check backups, tell the business what’s up. If you’re responsible for systems, it saves you trawling through long reports; follow these steps first and you’ll stop the easy hits.

Author style

Punchy: this is practical government-backed guidance for IT, risk and security teams. Because the advice is immediately actionable and covers fundamentals that stop most attacks, treat it as high priority — revisit and accelerate planned fixes while the threat is elevated.

Source

Source: https://www.ncsc.gov.uk/guidance/actions-to-take-when-the-cyber-threat-is-heightened