UK Launches New Cyber Attack Severity Rating System

The Cyber Monitoring Centre will categorize cyber incidents to enhance business responses and recovery strategies.

On February 6, 2025, the UK formally introduced a new cyber incident rating system through the establishment of the Cyber Monitoring Centre (CMC).

This initiative is designed to bolster understanding of cyber events and improve the response of organizations affected by such incidents.

The CMC will begin rating cyber incidents that have potential financial implications exceeding £100 million and that impact multiple organizations.

The severity of these incidents will be assessed and categorized on a scale from one, denoting the least severe incidents, to five, indicating the most severe.

Ciaran Martin, the former chief executive of the National Cyber Security Centre (NCSC), will lead the technical committee responsible for the monitoring efforts.

The CMC stated that it intends to publish the ratings of categorized events alongside comprehensive reports, aimed at informing organizations about protective measures and recovery protocols.

The UK has experienced significant cyber incidents in recent years, including disruptions to online banking services, cyber attacks targeting the National Health Service (NHS), and the CrowdStrike IT outage last summer, which significantly affected infrastructure, transport, and healthcare systems across the country.

Martin noted the challenges associated with measuring the severity of these incidents, expressing optimism that the new system could represent a significant advancement in the management and recovery from cyber incidents.

The CMC aims to contribute expertise from its technical committee, which also includes a professor of cyber security from the University of Oxford and the former director general for technology at GCHQ, at no cost to affected organizations.

Will Mayes, chief executive of the CMC, emphasized the increasing risks associated with major cyber events, asserting that as dependence on technology heightens among UK organizations, the CMC could play a crucial role in enhancing cyber resilience and refining response strategies.

Mayes also recognized the collaborative efforts of global experts who assisted in launching the CMC, suggesting that their ongoing contributions would be pivotal for the organization's effectiveness in future cyber events.