14 Advice and Guidance: Cyber Essentials is a Government-backed, industrysupported scheme to help organisations protect themselves against common online threats. From 1 October 2014, Government required all suppliers bidding for contracts involving the handling of certain sensitive and personal information to be certified against the Cyber Essentials scheme. The UK, primarily through the NCSC, provides advice on supply chain issues. This has included the accreditation of products, services and consultants under schemes run by the NCSC. The NCSC has published guidance to provide organisations with an improved awareness of supply chain security, as well as helping to raise the baseline level of competence in this regard, through the continued adoption of good practise. This guidance proposes a series of 12 principles, designed to help organisations establish effective control and oversight of their supply chain. Proliferation: To prevent the proliferation of malicious ICT tools and techniques, in 2013, the UK supported the inclusion of intrusion software in the control list of the Wassenaar Arrangement14(WA) on Export Controls for Conventional Arms and DualUse Goods and Technologies. Norm 10 (UNGGE 2015 report, paragraph 13j) – States should encourage responsible reporting of ICT vulnerabilities and share associated information on available remedies to such vulnerabilities, in order to limit and possibly eliminate potential threats to ICTs and ICT-dependent infrastructure; Equities Process: In November 2018 the United Kingdom published details of the Equities Process operated on behalf of the Government by GCHQ15. The Equities Process is the means through which decisions are taken on the handling of vulnerabilities found in technology to achieve the best overall outcome in the interests of the United Kingdom Whilst carrying out operational activity, analysts working at GCHQ or elsewhere within Government may identify vulnerabilities in technology. These vulnerabilities may represent a risk to the security of systems in the UK and of our allies. These include Government departments, critical national infrastructure, companies and private citizens. In some cases, the same vulnerabilities might provide a means by which the UK intelligence community could obtain vital intelligence that could be used to protect the UK and its interests. The Equities Process provides a mechanism through which decisions about disclosure are taken. Expert analysis, based on objective criteria, is undertaken to decide whether such vulnerabilities should be released to allow them to be mitigated or retained so that they can be used for intelligence purposes in the interests of the 14 15 https://www.wassenaar.org/ https://www.gchq.gov.uk/information/equities-process