Monitoring
What monitoring you have, who watches it and how coverage is arranged, compared with the measure on 24-hour monitoring.
NCTL Medium Readiness Review
The NCTL Medium readiness review is a two-day gap check of how ready an organisation is against the nine cybersecurity preparedness measures NACSA set for National Critical Information Infrastructure (NCII) entities when it raised the national threat level to Medium.
NCTL Medium Readiness Review
What it is
A short, structured review of your evidence and arrangements against each preparedness measure, ending with a gap register, an action list and a one-page summary for management.
Why organisations need it
On 4 November 2026 NACSA raised the National Cyber Security Threat Level from Low to Medium. NCII entities were told to implement nine preparedness measures, including 24-hour monitoring, system patching, multi-factor authentication and updated Service Continuity Plans, and NCII sector heads report threat status to NACSA weekly. Only some of the measures have been described publicly, so the review works from the full set as NACSA communicated it to your organisation or sector head. Entities need to know quickly where they stand, and suppliers to those entities are being asked the same questions.
What the engagement covers
Patching
How systems are patched, how fast critical fixes are applied and how exceptions are tracked.
Multi-factor authentication
Where MFA is in place, where it is missing, and which accounts matter most.
Service continuity plans
Whether your Service Continuity Plans exist, are current and cover a cyber attack.
The remaining measures
Each other measure NACSA issued to you, checked against your evidence.
Reporting
Whether you can produce the status information your sector head asks for, on time.
What the business gets out of it
A clear position in two days
Know where you meet each measure and where you do not.
Evidence ready
A checklist of what to show if asked.
Actions in order
Fix the highest-risk gaps first.
Simple reporting
A summary your management and sector head can read in minutes.
Supplier-ready
A response for customers that are NCII entities.
How it works
How the engagement runs
01
Day 1 morning
Confirm scope, the measures that apply and the contacts.
02
Day 1 afternoon
Review evidence: monitoring, patching and access controls.
03
Day 2 morning
Review continuity plans, reporting and remaining measures.
04
Day 2 afternoon
Agree findings and priorities with management.
05
After the review
Written gap register and action list.
Deliverables
What you receive
Gap register
Each measure rated, with the evidence seen.
Action list
Prioritised, with suggested owners.
Evidence checklist
What to keep ready for your sector head or NACSA.
Management summary
One page for directors.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
Organisations designated as NCII entities, and organisations that supply or support them. If you are unsure whether you are covered, we can help you check with your sector lead.
NACSA has described some publicly: 24-hour monitoring, system patching, multi-factor authentication and updating Service Continuity Plans. The full set is communicated to NCII entities through their sector heads, so we review against the list you hold. We do not guess at the rest.
No. This is a review of your evidence and arrangements. We do not provide monitoring or penetration testing.
No. Only NACSA and your sector head decide whether you comply. The review tells you where you stand and what to fix before they ask.
The measures may be updated. We note the date of the instruction we reviewed against, and can repeat the review if it changes.