United Kingdom
External attack surface management for UK organisations
UK certification schemes and regulator guidance start with the same step: define the boundary. You cannot scope what you have not found. With the NCSC’s free Web Check and Mail Check services retired in March 2026, organisations now need their own outside-in view of websites and email domains.
Serving organisations in London, Manchester, Birmingham, Edinburgh.
What the rules in United Kingdom expect
Cyber Essentials and Cyber Essentials Plus
Certification requires you to define the scope of your internet-facing infrastructure and then show the technical controls across it. Scoping is where most assessments run into trouble, because the boundary drawn on paper rarely matches what is actually exposed. The current requirements are version 3.3.
The Cyber Assessment Framework
The NCSC’s Cyber Assessment Framework, now version 4.0, is used across the public sector and critical national infrastructure. Its asset management outcomes expect organisations to understand the systems that support essential functions. The Cyber Security and Resilience Bill would extend regulation to more digital service providers, but it is still a Bill.
UK GDPR and the ICO
Article 32 requires security appropriate to the risk, and notifiable breaches must be reported to the ICO within 72 hours. Forgotten and unpatched internet-facing systems feature repeatedly in breach cases. An unknown asset cannot be patched.
After Web Check and Mail Check
The NCSC retired its Web Check and Mail Check services on 31 March 2026. Many organisations relied on them for a basic outside-in view of website and email security. EASMLens covers the same ground and more: TLS, certificates, SPF, DKIM, DMARC, MTA-STS and DNSSEC across every domain and subdomain attributed to you.
What each rule asks for, and what EASMLens shows you
| Rule | What it asks for | What EASMLens shows you |
|---|---|---|
| Cyber Essentials | Define the internet-facing scope before certification | The internet-facing boundary as it actually exists |
| CAF asset management | Understand the systems that support essential functions | A continuous inventory of internet-facing systems |
| UK GDPR Art 32 | Security appropriate to the risk | Unpatched and end-of-life internet-facing services |
| Former NCSC Mail Check | Good email security practice | SPF, DKIM, DMARC, MTA-STS and TLS-RPT graded per domain |
Reporting clocks
UK GDPR controllers
72 hours to the ICO for a notifiable breach
Questions for the board
- 1Does our Cyber Essentials scope match what the internet can actually see of us?
- 2What replaced Web Check and Mail Check for us after March 2026?
- 3How many of our internet-facing services run unsupported software today?
How EASMLens supports these obligations
- Boundary definition for Cyber Essentials scoping, before the assessor arrives
- Continuous inventory supporting CAF asset management outcomes
- Detection of unpatched and end-of-life internet-facing services
- Website and email security checks that replace the retired NCSC services
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Will EASMLens help us pass Cyber Essentials?
- It addresses the part most organisations get wrong, which is knowing the full scope of internet-facing infrastructure. The technical controls still need implementing, and the certification body makes the decision.
- How is this different from an annual penetration test?
- A penetration test examines an agreed scope at one point in time. EASMLens discovers what is in scope all year, and checks it continuously, including assets that appear between tests.
- How should we compare EASM providers in the UK?
- Ask four questions. How does the provider find assets you have not told it about: passive sources such as DNS and certificate transparency, or only the domains you list? Does it check what it finds, with non-destructive service and web checks, or only list it? Does it cover email domains, the job the retired NCSC Mail Check used to do? And is pricing per asset, per domain or per organisation, so a growing estate does not surprise you at renewal.
Primary sources
Regulatory content reviewed on . General information only, not legal advice.