The UK’s National Cyber Security Centre (NCSC) is part of GCHQ and the government’s technical authority for cyber security. It provides advice and tools, leads national defence against advanced cyber threats, and coordinates responses to serious incidents. Organisations can report a cyber incident to the NCSC for information or technical assistance, but that report does not replace any legal or regulatory notifications they must make.
What does the NCSC do?
The NCSC helps businesses, public-sector organisations and individuals protect the online services and devices they rely on. Its work includes cyber-security guidance, tools and frameworks, as well as national leadership against advanced cyber threats. The NCSC describes itself as part of GCHQ. NCSC: What we do
As an Amazon Associate I earn from qualifying purchases.
That national role is different from providing a general service to investigate every individual scam or resolve every computer problem. The NCSC is a technical authority: its work includes helping the UK defend against advanced threats and reducing harm from serious cyber incidents. Its incident response is prioritised according to severity and potential impact on the UK, so making a report does not guarantee that the NCSC will take over an organisation’s response or provide a particular level of hands-on support.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhen an organisation reports a cyber incident, the NCSC’s Incident Management team assesses the report, helps shape the NCSC and cross-government response, and may provide direct support to the affected organisation. That support can be coordinated with the organisation’s own incident-response provider. The NCSC is not a police force, a regulator, a consumer helpline or a guaranteed incident-response contractor. NCSC: Incident management
#1 Best Overall
When should an organisation contact the NCSC?
An organisation affected by a cyber incident can use the NCSC’s online reporting service. The service welcomes reports made to alert the NCSC or to seek technical assistance. It identifies incidents involving data about employees, customers or clients; organisational computer firmware, software or hardware; or personal data relating to people in the UK, Channel Islands or Isle of Man as reasons to report. These categories cover incidents affecting an organisation’s information and technology, not only cases where the organisation has confirmed that personal data was taken. Report a cyber incident
Reports are monitored around the clock by a Defence Watch Officer, who will endeavour to reply as soon as possible. That wording is not a guaranteed response time. An organisation should therefore distinguish between reporting an incident and managing the incident: a submission can alert the NCSC or seek assistance, but it should not be treated as an assurance that a response team will arrive or that the NCSC will lead containment and recovery. Organisations facing an active or highly disruptive attack should not wait for a reply before taking necessary containment and recovery steps.
Contacting the NCSC is particularly relevant when the affected party is an organisation and the incident concerns its data, devices, systems or services. The NCSC’s role is not interchangeable with a crime or fraud report, a regulator notification, or a route for reporting a suspicious message. The right route depends on who is affected, what has happened, whether there is operational disruption, what kind of help is needed, and the applicable jurisdiction.
If the affected network might be compromised, do not submit the reporting form from a device or connection on that network. Use a separate system instead. This is a practical safety measure: a possibly compromised network may not be a suitable channel for making a sensitive report. If it is unclear which organisation should receive a report, use the government’s Cyber Incident Signposting Service. Different bodies have different remits, and more than one notification may be necessary. NCSC incident reporting and signposting
How to report an organisational cyber incident
- Protect the reporting channel. If you suspect the organisation’s network is compromised, access the reporting service from a separate, trusted system rather than using the affected network.
- Decide whether the NCSC route fits. The online service is for an organisation that has experienced a cyber incident and wants to alert the NCSC or seek technical assistance. The service describes relevant incidents as including effects on employee, customer or client data, organisational firmware, software or hardware, and personal data relating to people in the UK, Channel Islands or Isle of Man.
- Submit through the online service. Use report.ncsc.gov.uk. Reports are monitored around the clock, but the service says an officer will endeavour to reply as soon as possible; it does not promise a specific response time or a particular kind of support.
- Check for other reporting routes. Use the government Cyber Incident Signposting Service if you are unsure which bodies to notify. A single incident can involve separate responsibilities, so assess legal, regulatory, contractual and other relevant obligations independently rather than assuming the NCSC submission covers them.
- For a highly disruptive incident, work through response stages. NCSC guidance frames response as immediate actions in the first hours, recovery over the following days or weeks, and organisational rebuild. This gives organisations a broad way to think about the work: urgent response is distinct from restoring operations, and recovery is distinct from longer-term rebuilding. The July 2026 guidance is a framework, not an exhaustive checklist; what is required depends on the incident and applicable legal and regulatory jurisdictions. NCSC guidance on mitigating the impact of cyber attacks
The guidance’s stages are not a substitute for an incident-specific plan or specialist advice. A disruptive attack can create immediate operational needs as well as later recovery work, and the details will vary by organisation and incident. The key distinction is that reporting to the NCSC is one part of the response, not the response plan itself.
What the NCSC report does—and does not—do
Submitting a report to the NCSC does not fulfil legal or regulatory reporting requirements. An organisation must assess and meet any separate duties that apply to its circumstances. The reporting service explicitly warns: “Reporting using this service does not fulfil any legal or regulatory reporting requirements that you might be subject to.” NCSC incident reporting service
That means organisations should not assume that reporting an incident to the NCSC automatically notifies a regulator, satisfies a legal deadline, or fulfils another body’s reporting process. The relevant obligations depend on the organisation, incident and jurisdiction. If an organisation is unsure what applies, it should use the appropriate signposting and seek advice relevant to its duties.
The NCSC says it will not share incident details with regulators such as the Information Commissioner’s Office (ICO) without first seeking consent, although it may share aggregate statistics and anonymised details. Reports from UK government organisations may be shared with the Government Cyber Coordination Centre; details may also be shared with law-enforcement partners to identify opportunities for investigation or mitigation. These arrangements are another reason to understand what the reporting service does, rather than treating it as a general-purpose notification to every authority.
Rank #3
Nor should the NCSC’s incident reporting data be treated as a count of every cyber incident in the UK. Its 2025 Annual Review explains that many businesses are not required to report breaches to the NCSC and that reported incidents do not represent all incidents affecting the country. A report total therefore reflects reports received, not a complete census of all incidents. NCSC Annual Review 2025
Which UK route should you use?
Choose the route by looking first at who is affected and what happened, then at the purpose of the contact. An organisation seeking technical assistance after a system incident has a different need from an individual who has lost money, or someone who has received a suspicious message. The route can also depend on urgency and jurisdiction: individual fraud reporting in Scotland, for example, differs from the route elsewhere in the UK.
| Situation | First route to consider | Purpose |
|---|---|---|
| An organisation has suffered a cyber incident | NCSC incident reporting service | Alert the NCSC or seek technical assistance; check separately for other notifications. |
| You are unsure which organisation should receive an incident report | Government Cyber Incident Signposting Service | Identify appropriate reporting bodies; more than one may be relevant. |
| An individual has lost money to a scam | Contact your bank straight away and report to Report Fraud. In Scotland, contact Police Scotland. | Address the financial loss and report the suspected fraud through the applicable route. This is distinct from making an organisational cyber incident report. NCSC guidance on online scams |
| You received a suspicious message or found a scam website | Use the NCSC’s separate suspicious-message or suspicious-website reporting routes. | Report suspected phishing messages or malicious websites, rather than treating them as a report of an organisational incident. Report a suspicious website |
| An organisation needs specialist recovery support | Consider an NCSC-assured Cyber Incident Response company. | These companies can assess an incident’s extent, manage immediate impact and help improve network security. Check current scheme membership and suitability before choosing a provider. NCSC Cyber Incident Response companies |
These options are not necessarily alternatives to one another. For example, an organisation may report an incident to the NCSC, have separate legal or regulatory duties, and need specialist help with recovery. Likewise, an individual who has lost money should contact their bank promptly and use the relevant fraud-reporting route; that does not turn the matter into an organisational report to the NCSC. When the correct combination is uncertain, use the government signposting service.
Recommended Free Tools
Specialist support for organisational recovery
For an organisation dealing with a significant incident, an NCSC-assured Cyber Incident Response company may be a useful source of specialist help. The NCSC says these companies can assess the extent of an incident, manage its immediate impact and help improve network security. This is a different kind of support from reporting an incident to the NCSC: the NCSC receives and triages reports as part of its national role, while an incident-response provider may be engaged to help the organisation work through its own response and recovery.
Assured status is not a reason to skip due diligence. Check the current scheme membership and whether a provider’s services suit the incident and organisation before engaging it. The available provider list and scheme details can change, so verify current information directly through the NCSC resource. NCSC Cyber Incident Response companies
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to spot a fake NCSC contact
The NCSC says it will never ask someone for payment or financial details. Treat a message or call claiming to be from the NCSC as suspicious if it asks for either, and verify the contact through the official service before responding. Do not rely on a caller’s claim of identity alone. How to contact the NCSC
What to keep in mind about NCSC support
- The NCSC is the UK’s national technical cyber-security authority, part of GCHQ, not the universal destination for every scam, fraud or complaint.
- Organisations can report incidents to alert the NCSC or seek technical assistance; the incident-management response is prioritised according to severity and potential UK impact.
- A report is not a guarantee of direct support, a promised response time, or a substitute for managing the incident and recovery.
- Use the signposting service when the right reporting body is uncertain, and check separately for legal or regulatory duties. Multiple notifications may be relevant.
- For individuals who have lost money, contacting the bank promptly and using the appropriate fraud-reporting route are distinct from organisational incident reporting.
- If you suspect the organisation’s network is compromised, use a separate system to access the reporting service.
- For specialist organisational recovery, consider an NCSC-assured response provider and verify its current status and suitability.
Frequently Asked Questions
What does the NCSC do?
The NCSC is part of GCHQ and the UK’s technical authority for cyber security. It provides guidance, tools and frameworks, leads national defence against advanced cyber threats, and triages organisational incident reports. It may provide direct support in serious cases, but support is prioritised by severity and potential UK impact.
How do I report a cyber incident in the UK?
If an organisation has experienced a cyber incident and wants to alert the NCSC or seek technical assistance, use the online service at report.ncsc.gov.uk. If the affected network may be compromised, submit the form from a separate system. Use the government Cyber Incident Signposting Service if you are unsure which bodies should also receive a report.
Best Value
Does reporting to the NCSC tell the ICO?
No. An NCSC report does not fulfil legal or regulatory reporting requirements. The NCSC says it will not share incident details with regulators such as the ICO without first seeking consent, so an organisation must assess and meet any separate duties that apply.
Who should I contact after an online scam?
If you have lost money, contact your bank straight away and report to Report Fraud; in Scotland, contact Police Scotland. For a suspicious message or scam website, use the NCSC’s separate suspicious-message or suspicious-website reporting routes. These are different from reporting an organisational cyber incident.
Will the NCSC respond to every incident report?
Reports are monitored around the clock by a Defence Watch Officer, who will endeavour to reply as soon as possible. The service does not promise a particular response time, and the NCSC prioritises incidents according to severity and potential impact on the UK.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Can the NCSC recover my organisation’s systems?
The NCSC may provide direct support to an affected organisation, working with its incident-response provider, but it is not a guaranteed incident-response contractor. Organisations needing specialist help can consider an NCSC-assured Cyber Incident Response company and should verify current membership and suitability.
The Bottom Line
Contact the NCSC when an organisation has experienced a cyber incident and needs to alert the UK’s technical authority or seek assistance. Use the signposting service when you are unsure which bodies are relevant, and treat fraud reports, suspicious-message reports and regulatory notifications as separate routes. An NCSC report can help inform the national response, but it is neither a guarantee of hands-on recovery nor a replacement for an organisation’s other duties.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
