The UK has officially launched its new Cyber Monitoring Centre (CMC) with the goal of measuring cyber incidents with more clarity and precision. The center, which has been in stealth mode for a year, is an independent non-profit organization established by the UK insurance industry. Its public launch took place during an event at the Royal United Services Institute (RUSI) on February 6, 2025.
The main objective of the CMC is to monitor cyber events and categorize their intensity and impact on UK organizations. This includes a range of incidents such as outages caused by faulty updates, data breaches, targeted disruptive cyber-attacks, and supply chain cyber-attacks. The center’s approach is to mirror the methodologies used for physical events, such as the Richter scale for earthquakes and the Saffir-Simpson hurricane wind scale for hurricanes.
One of the key features of the CMC is its commitment to providing the results of its investigations and classifications for free. Will Mayes, CEO of the CMC, emphasized the potential of the center to help businesses and individuals better understand the implications of cyber events, mitigate their impact on people’s lives, and improve cyber resilience and response plans. During the launch event, Ciaran Martin, Chair of the CMC Technical Committee, highlighted the paradox in cybersecurity, stating that while the industry is highly technical, it lacks effective measurement of harm from cyber threats.
The Technical Committee of the CMC, chaired by Martin and consisting of five other members, will be responsible for monitoring, assessing, and classifying cyber incidents. The committee aims to share an initial public statement within 30 days after detecting a cyber incident. This statement will include the incident’s assigned category using the CMC scale and a detailed report on the incident and its financial impact.
The CMC’s categorization will primarily focus on the business and financial impact of cyber incidents. Martin emphasized the importance of considering disruptive attacks alongside data breaches when assessing cyber incidents, as disruptive attacks can have a significant financial impact. The categorization provided by the CMC should be seen as a tool for measuring the impact of a cyber incident, not as the sole measurement.
The CMC has established a specific methodology for assessing and categorizing cyber events. This includes scheduling meetings with the Technical Committee, collecting and analyzing data from various sources, preparing event briefing packs, and conducting workshops to discuss and agree on the event category using the CMC scale. The CMC scale categorizes cyber events into five categories based on criteria such as the affected population and the financial impact on UK organizations.
Overall, the launch of the UK Cyber Monitoring Centre represents a significant step forward in measuring and understanding cyber incidents. The center’s focus on clarity, precision, and free access to information is expected to have a positive impact on cyber security efforts both in the UK and internationally.