How the NCSC Website Organizes Cyber Security Guidance by Audience

Updated

The NCSC website (ncsc.gov.uk) organizes its guidance around six audience groups: you & your family, small & medium sized organisations, large organisations, public sector, cyber security professionals, and self employed & sole traders. Each group has a dedicated entry point that collects the advice, tools, and recovery resources most relevant to it. The practical rule is simple: start from the audience section that matches who you are, then use the highlighted popular content within that section as your shortlist.

The six audience sections and what each is for

Audience section Who it serves What you'll typically find
You & your family Individuals and households Step-by-step recovery guides (e.g., recovering a hacked account), scam response advice
Small & medium sized organisations SMEs and small businesses Cyber Essentials, practical protection against common threats
Large organisations Larger enterprises Cyber Assessment Framework (CAF), resilience and incident response guidance
Public sector Public bodies Guidance for organisations delivering essential functions
Cyber security professionals Practitioners Technical guidance, including configuration recommendations such as TLS/post-quantum updates
Self employed & sole traders Sole traders and freelancers Advice on responding to online scams and cyber attacks

The site frames all of this under one mission — "Making the UK the safest place to live and work online" — and the audience split is the main navigation device for getting there.

How to choose your starting point

  1. Identify your role first, not your problem. The site assumes the audience determines which version of overlapping advice applies. A sole trader and a large organisation both need incident response help, but the site routes them to different pages.
  2. Open your audience section. From the homepage, the "Find guidance and resources for . . ." area lists all six groups.
  3. Check the popular content block within that section. Each audience page highlights a small set of frequently used items — for organisations this includes the Cyber Assessment Framework, Cyber Essentials, school staff training, and material on frontier AI; for individuals it includes account recovery guides.
  4. Move to the topical sections when you know your task. "Advice & guidance," "Respond to a cyber attack," and "Find a product or service" sit in the main navigation and cut across audiences.

If you have just experienced an attack

The homepage gives this its own prominent route: "Experienced a cyber attack? Find resources to help you or your organisation to recover." From there, the site splits recovery advice three ways — sole traders and small organisations, medium to large organisations, and individuals. Use that split rather than the general audience menu; it is the fastest path to recovery-specific steps.

What the audience structure does and doesn't tell you

The structure tells you where to look, not whether a resource applies to you. Two things are worth knowing before you rely on it:

  • Popular content is a shortcut, not a curriculum. The highlighted items are the most-used entries for that group, so they are a reasonable first read, but they don't cover every obligation or risk your organisation faces.
  • Some guidance is deliberately cross-audience. The Cyber Assessment Framework, for example, is listed under organisations but is aimed at organisations that "play a vital role in the day-to-day life of the UK, with a focus on essential functions" — check the scope statement on the page rather than assuming it fits any large organisation.

A quick way to verify you're in the right place

After opening a page, confirm three things: the page names your audience type or your specific task (recovery, assessment, certification); it states who the guidance is for in its opening lines; and it links onward to the next practical step rather than only describing the topic. If those don't match, return to the audience menu and pick a different entry point.

For most visitors the sequence is: audience section → popular content → topical section for the specific task. That order matches how the site itself is built, and it avoids landing on guidance written for a different type of user.