Organisations urged to share EASM procurement data to shape UK NCSC guidance
The UK’s cyber watchdog is gathering data on how organisations select and buy EASM solutions to shape future advisory guidance and services.
Key points
- The NCSC is recruiting participants for the next phase of its ACD 2.0 research programme.
- The agency specifically wants to understand the procurement and evaluation stages of EASM adoption.
- Participation involves a voluntary five-minute registration form hosted by Optimal Workshop.
The UK National Cyber Security Centre is actively seeking input from professionals involved in the procurement and evaluation of external attack surface management solutions. According to an official advisory, the agency aims to understand the specific challenges and considerations organisations face when selecting these security tools. This research is part of the broader ACD 2.0 initiative, which seeks to improve how organisations manage exposure to cyber threats.
How it unfolded
- Earlier this year, the NCSC invited organisations with existing EASM experience to participate in initial ACD 2.0 research conversations.
- These early discussions provided insights into how organisations review findings and prioritise risk response activities in practice.
- The agency has now shifted focus to the earlier procurement stage, asking for details on decision-making processes and tool selection.
Who is affected
The call for participation targets individuals who influence cybersecurity investment, manage procurement activities, or provide strategic leadership in risk management. According to the NCSC advisory, the agency is particularly interested in hearing from those who have recently selected, purchased, or implemented EASM solutions. This includes professionals who build business cases, compare different approaches, or shape organisational strategies for managing external attack surface risk. The advisory notes that sharing these experiences helps the NCSC shape better guidance for organisations managing this specific type of cyber risk.
The fix
There is no technical fix or software update associated with this announcement, as it is a research and consultation exercise rather than a security incident. The NCSC states that all information provided by participants will remain confidential and that participation is entirely voluntary. According to the source material, individuals interested in helping should complete a registration form hosted by Optimal Workshop, which takes no longer than five minutes. Once registered, participants are added to a research panel for future activities.
What to do and how to stay safe: NCSC
- Review current external attack surface management procurement processes to identify gaps or inefficiencies in vendor selection.
- Document the specific criteria and challenges your team faces when evaluating security tools for future reference or audits.
- Monitor official NCSC channels for updates on ACD 2.0 guidance that may influence future security investment decisions.
- Ensure that all staff involved in cyber risk management are aware of voluntary research opportunities that can shape industry standards.
Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who should participate in this NCSC research?
Professionals involved in evaluating, selecting, or adopting external attack surface management solutions, including those in procurement and risk management.
Is participation in the NCSC research mandatory?
No, participation is entirely voluntary and all information provided remains confidential according to the official advisory.
How long does the registration process take?
The registration form hosted by Optimal Workshop should take no longer than five minutes to complete.
