Scottish Cyber Coordination Centre (SC3)

Introduction

The Scottish Cyber Coordination Centre (SC3) is the focal point for Scotland’s cyber security and resilience, providing services to help protect against cyber incidents while promoting adherence to appropriate standards and best practices across critical functions and infrastructure. It supports the delivery of The strategic framework for a cyber resilient Scotland. 

SC3 will take cyber incident reports from Scottish public sector organisations as part of the Scottish public sector incident notification procedure. For all other organisations we encourage reporting of a cyber security incident to the National Cyber Security Centre (NCSC) and to Police Scotland.

Strategic plan

We published our strategic plan 2024 to 2027 in September 2024. It provides an overview of SC3’s operating principles, functional structure, and service development plans to support the mission and objectives of the Scottish Cyber Coordination Centre.

Our work is structured into five workstreams:

• incident coordination
• threat intelligence
• cyber exercising
• vulnerability management
• standards and insights

Incident coordination

The ability to co-ordinate multi-agency incident response with speed and consistency is key to the successful handling of serious, national-level and multi-impact cyber incidents. This workstream is about supporting victim organisations to manage and recover from a cyber incident and communicate key information to other stakeholders if required.

SC3 works closely with National Cyber Security Centre ( NCSC) and Police Scotland to support organisations in dealing with significant cyber incidents by bringing external expertise to incident management teams through its multi-agency coordination process. In doing so the SC3 provides a 24/7/365 on call support.

Supporting resources:

• Cyber incident response toolkit
• Scottish Cyber Coordination Centre - vulnerability coordination: policy and procedure
• Public sector cyber incident co-ordination procedure
• Scottish Cyber Coordination Centre - organisational cyber testing and exercising regime: guidance

Threat intelligence

Relevant and actionable information on threats, vulnerabilities and malicious actors, contributes to pragmatic risk assessments for organisations and can support effective response and mitigations to changing environments and circumstances. SC3 supports improving access to and sharing valuable cyber threat intelligence.

Supporting resources:

SC3 threat reports are available to subscribers at Cyberscotland.com.

These include:

• daily threat bulletin
• weekly vulnerability report
• monthly ransomware report

The Scottish public sector is encouraged to improve automated threat intelligence sharing through joining the CyberShield Malware Information Sharing Platform (MISP). To learn more about MISP contact SC3@gov.scot.

Cyber exercising

This workstream focusses on assisting and encouraging organisations’ preparedness through exercising against the most common cyber attack scenarios and testing cyber incident response plans to improve organisational preparedness.

SC3 is developing a cadre of trained staff across the Scottish public sector to enhance cyber exercising resilience and support increased cyber exercising.

 Cyber exercising resources:

• NCSC Exercise in Box resources

• Scottish Cyber Coordination Centre - organisational cyber testing and exercising regime: guidance

Vulnerability management

Recognising that the exploitation of known vulnerabilities is a common attack vector for hostile actors, assisting organisations with their own vulnerability management activities is another core function of SC3. This workstream is about issuing timely and relevant alerts to organisations about the latest vulnerabilities.

The latest SC3 vulnerability coordination procedure is linked below:

• Scottish Cyber Coordination Centre - vulnerability coordination: policy and procedure

Standards and insights

This workstream aims to better understand the public sector’s cyber resilience posture while setting proportionate security expectations. 

Cyber observatory

Our new service is in the discovery phase. In time we will be working with pilot organisations to collect data which will help SC3 tailor and target its support offerings.

Public sector cyber resilience snapshot

In-scope organisations will receive a refreshed survey in 2025, anchored on the Cyber Assessment Framework and building on past years. This point-in-time assessment will complement the insights gained from the Observatory. 

HEFESTIS pathway pilot

We will share learnings from the HEFESTIS public sector later in 2025.

Cyber security guidance documents

Guidance, good practice, and reporting procedures publications

• Cyber resilience: public sector toolkit
• Scottish Cyber Coordination Centre - vulnerability coordination: policy and procedure
• Public sector cyber incident co-ordination procedure
• Scottish Cyber Coordination Centre - organisational cyber testing and exercising regime: guidance