20. Our most innovative and groundbreaking efforts have been to take action at scale, including through the development and increasing rollout of the Active Cyber Defence (ACD) programme. Last year it took down 2.3 million malicious campaigns – including 442 phishing campaigns using NHS branding and 80 illegitimate NHS apps hosted and available to download outside of official app stores.3 We also took the lead globally in pushing for connectable consumer products to be ‘secure by design’, developing a UK code of practice in 2018 that inspired others to follow and informed the first globally-applicable industry standard on internet-connected consumer devices.4 5 21. New regulation has had a positive impact on cyber security, with 82% of organisations saying the improvements they had made were influenced by the introduction of the UK General Data Protection Regulation in 2018.6 And 77% of businesses now see cyber security as a high priority, an increase of 12% since 2016.7 The introduction of the Network & Information Systems Regulations (‘NIS regulations’) in 2018 also led to designated organisations taking measures to better ensure the security of their networks and information systems, leading to a reduction in the cyber risks posed to essential services and important digital services.8 A good example of collaboration across the four nations of the UK has been the improvements made across the health sector, including the implementation of the NIS regulations. 22. We have provided comprehensive cyber security advice and guidance to organisations in the wider economy, and tailored support to critical sectors during the coronavirus (COVID-19) pandemic. For the public, our Cyber Aware campaign has provided advice on the steps they can take to protect themselves online. When cyber attacks have got through we have used our world-leading incident response capabilities to provide direct support in the most serious cases and our investment in local law enforcement specialists means that every reported incident now receives a response. 23. We have established specialist law enforcement cyber units across the UK, and alongside this the cyber PROTECT network, Economic Crime Victims Care Unit and regional Cyber Resilience Centres. These initiatives mean that for citizens and small-to-medium-sized organisations there is someone nearby or easily contactable who has the right skills and local knowledge to provide support and guidance to improve your cyber resilience. 24. However, we have growing evidence of gaps in our national resilience, with levels of cyber crime and breaches affecting government, businesses and individuals continuing to rise as well as cyber-enabled crime, NCSC, NCSC Annual Review 2021 (2021) DCMS, Code of Practice for Consumer IoT Security (2018) 5 DCMS, ETSI industry standard based on the Code of Practice (2019) 6 DCMS/RSM, The impact of GDPR on cyber security outcomes (2020); The General Data Protection Regulation (GDPR) that was introduced into UK law in 2018 has now been replaced by the UK GDPR) 7 DCMS, Cyber Security Breaches Survey 2021 (2021) 8 DCMS, Post-Implementation Review of the Network and Information Systems Regulations 2018 (2020) 3 4 22 National Cyber Strategy