Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UK’s National Cyber Security Centre (NCSC) is part of GCHQ and the country’s technical authority for cyber security. It provides guidance and tools, leads the UK’s defence against advanced cyber threats, and coordinates responses to serious incidents. Organisations can report incidents to the NCSC for its information or to seek technical assistance—but that report does not replace any legal or regulatory notification they may need to make.
What does the NCSC do?
The NCSC helps businesses, public-sector organisations and individuals protect the online services and devices they rely on. It publishes cyber-security guidance, tools and frameworks, and leads UK defence against advanced cyber threats. The NCSC’s overview of its work explains its role as part of GCHQ.
When an organisation reports an incident, the NCSC’s Incident Management team assesses the report, coordinates the NCSC and wider government response, and may provide direct support to the affected organisation. That support can be coordinated with the organisation’s own incident-response provider. The team’s role is therefore broader than receiving a form: incident reports help it understand and coordinate responses to threats, while support to an individual victim depends on the nature and significance of the case.
Free tools Windows power users keep installed
One-click scans. No signup required.
The NCSC is not the police, a regulator, a consumer helpline or a guaranteed incident-response contractor. It prioritises its response according to the incident’s severity and potential impact on the UK. The NCSC’s 2025 Annual Review also notes that many businesses are not required to report incidents to it, and that the reports it receives do not represent every cyber incident affecting the UK. In other words, the number of reports received should not be treated as a complete count of cyber incidents.
#1 Best Overall
That distinction matters when deciding what to expect. The NCSC provides national technical leadership and incident coordination; it does not promise that every organisation reporting an incident will receive hands-on response. An organisation may still need its own specialist support, and it must identify any separate legal, regulatory or law-enforcement reporting obligations.
When should an organisation contact the NCSC?
An organisation affected by a cyber incident can report it through the NCSC’s online incident reporting service. The service is intended both for organisations alerting the NCSC to an incident and for those seeking technical assistance. Its stated reasons to report include incidents affecting:
- Data about employees, customers or clients.
- The organisation’s computer firmware, software or hardware.
- Personal data relating to people in the UK, the Channel Islands or the Isle of Man.
These categories help organisations recognise that a report is relevant even if the immediate problem does not look like a large-scale attack. A compromise of organisational systems or data can be relevant to the service, and an organisation can use it to alert the NCSC as well as to seek technical assistance. If you are unsure whether the NCSC is the right destination, use the government’s signposting service rather than assuming that one report covers every need.
Reports are monitored around the clock by a Defence Watch Officer, who will endeavour to reply as soon as possible. This is not a guaranteed response time or promise of direct assistance; the NCSC prioritises cases based on severity and potential UK impact. A highly disruptive incident with wider consequences may be treated differently from an incident with a more limited effect.
If you are not sure which organisation should receive a report, use the government’s Cyber Incident Signposting Service. Different bodies have different remits, and an organisation may need to notify more than one. Think about the purpose of each report: asking for technical assistance, reporting suspected crime, making a regulatory notification and alerting a national cyber-security authority are distinct actions.
If you suspect your network is compromised, do not use it to submit the report. The NCSC advises using a separate system instead. This avoids relying on a network that may be affected when accessing the reporting service.
How to report a cyber incident
- Use a safe device. If the affected network may be compromised, access the reporting service from a separate system. Do not submit the form from the potentially compromised network.
- Open the official NCSC reporting service. Go to report.ncsc.gov.uk and follow the form’s instructions. Use the service to alert the NCSC or request technical assistance. The service is for organisational incident reporting; it is not the general route for an individual who has lost money to a scam.
- Consider who else needs to know. Use the government signposting service if you are uncertain about the appropriate organisations. Different authorities have different responsibilities, so you may need to make more than one report. Check separately for duties to regulators, law enforcement or other bodies.
- Keep recovery moving. For a highly disruptive incident, NCSC guidance groups the response into immediate actions in the first hours, recovery over the following days or weeks, and rebuilding the organisation. Use the current guidance on mitigating the impact of a cyber attack as a framework, not an exhaustive checklist.
The NCSC’s disruptive-attack guidance, published on 28 July 2026, presents those stages as a way to structure the response. It does not replace organisation-specific decisions or set out every action required in every case. The right response depends on what happened, how disruptive it is and which legal or regulatory jurisdictions apply.
Specific obligations and recovery steps depend on the incident and the organisation’s legal and regulatory jurisdiction. Reporting to the NCSC does not itself satisfy those obligations. Keep the distinction clear while managing the incident: use the NCSC route for its intended purpose, and assess separately which other organisations must be told and by when.
Rank #3
Who should you contact in other situations?
The right route depends on who is affected, what happened and what kind of help is needed. These services are not interchangeable. A useful first check is whether the incident concerns an individual or an organisation, whether money was lost or an organisational system was compromised, and whether the immediate need is fraud reporting, technical assistance, regulatory notification or help finding the right authority.
| Situation | Where to go | Purpose |
|---|---|---|
| An organisation has suffered a cyber incident | NCSC incident reporting service | Alert the NCSC or seek technical assistance; consider separate notifications as well. |
| You are unsure which body should receive an organisational incident report | Government Cyber Incident Signposting Service | Find the relevant reporting route or routes. |
| An individual has lost money to a scam | Contact your bank immediately, then report it to Report Fraud. In Scotland, contact Police Scotland. | Address the financial loss and report suspected fraud through the appropriate route. |
| You received a suspicious message or found a scam website | Use the NCSC’s suspicious-message and scam guidance. | Report or handle suspicious messages and websites through the relevant NCSC routes. |
| An organisation needs specialist incident recovery | Review the NCSC’s Cyber Incident Response provider information. | Identify specialist help for assessing the incident, managing immediate impact and improving network security. |
For an individual who has lost money, the immediate route is different from an organisation’s cyber-incident report: contact the bank straight away, then report the suspected fraud to Report Fraud; in Scotland, contact Police Scotland. For a suspicious message or scam website, use the NCSC’s separate routes for suspicious messages and websites. These distinctions help avoid treating every online problem as something the NCSC incident service handles.
An organisation that needs specialist recovery help can consider a provider listed by the NCSC as an assured Cyber Incident Response company. Such companies can assess the extent of an incident, manage its immediate impact and help improve network security. Before engaging one, check its current status in the NCSC assurance scheme and confirm that its services suit the incident. Inclusion in an assured-provider scheme does not mean the NCSC will automatically appoint that provider or manage the recovery.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Does reporting to the NCSC notify the ICO or meet legal duties?
No. The reporting service explicitly says: “Reporting using this service does not fulfil any legal or regulatory reporting requirements that you might be subject to.” An organisation must assess and meet any separate duties that apply to its incident. An NCSC report is not a substitute for a notification to the ICO or another regulator where a separate duty applies.
The NCSC says it will not share incident details with regulators such as the ICO without first seeking consent, although it may share aggregate statistics and anonymised details. Reports from UK government organisations may be shared with the Government Cyber Coordination Centre. The NCSC may also share details with law-enforcement partners to identify opportunities for investigation or mitigation. Check the service’s current reporting information when deciding what to submit and whom else to notify.
It is also worth understanding the limits of the NCSC’s incident information. The NCSC notes that many businesses are not obliged to report incidents to it, and its reports are not a complete picture of all incidents affecting the UK. A report can help the NCSC assess and coordinate a response, but it should not be treated as proof that every affected organisation has reported or that all other obligations have been addressed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to verify an NCSC contact
The NCSC says it will never ask for payment or financial details if it contacts you. Treat anyone claiming to represent the NCSC who asks for either as suspicious. Verify the contact through the NCSC’s official contact and verification information, rather than relying on the caller’s or sender’s claims. This is especially important if a message creates pressure to pay or provide financial details.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Frequently Asked Questions
How do I report a cyber incident in the UK?
An organisation can report an incident using the NCSC’s online service at report.ncsc.gov.uk, either to alert the NCSC or to seek technical assistance. If the network may be compromised, use a separate system to submit the form. If you are unsure which organisation should receive a report, use the government Cyber Incident Signposting Service; you may need to contact more than one body.
Best Value
Does reporting to the NCSC tell the ICO?
No. An NCSC report does not fulfil legal or regulatory reporting requirements. The NCSC says it will not share incident details with regulators such as the ICO without first seeking consent, though aggregate statistics and anonymised details may be shared. Assess and meet any separate notification duties that apply.
Who should I contact after an online scam?
If you lost money, contact your bank straight away and report the suspected fraud to Report Fraud. In Scotland, contact Police Scotland. For a suspicious message or scam website, use the NCSC’s separate suspicious-message or suspicious-website routes.
Will the NCSC respond to every incident report?
Reports are monitored around the clock by a Defence Watch Officer, who will endeavour to reply as soon as possible. That is not a guaranteed response time or promise of direct support. The NCSC prioritises incidents according to severity and potential impact on the UK.
Can the NCSC provide recovery help to my organisation?
The NCSC may provide direct support to an affected organisation and coordinate with its incident-response provider, but it is not a guaranteed incident-response contractor. Organisations needing specialist help can review NCSC-assured Cyber Incident Response companies and should verify current scheme membership and suitability.
The Bottom Line
The NCSC is the UK’s technical cyber-security authority, not a substitute for the police, regulators or an organisation’s own response provider. Organisations can report incidents online, but should use government signposting if unsure where else to report and should meet any separate legal or regulatory duties. Individuals who lose money to a scam should contact their bank promptly and use the appropriate fraud-reporting route.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
