Katie Wood, Director of Professional Standards and Accreditation | 01 October 2026

If you’re reading this, there’s a very high likelihood that you work in cyber security. Or, that you want to work in cyber security. Or that you employ people, or work alongside people, who work in cyber security.

Either way, you, like everyone else who uses a computer, drives a car, has ever been to a hospital, or relies on a dependable supply of clean drinking water, have a vested interest in this country’s cyber resilience.

Cyber security protects our data, information systems and national infrastructure from attack. As much as anything else, it keeps the world turning.

But crucially, our cyber resilience doesn’t just consist of ever evolving technical solutions. Central to everything is the knowledge, competence and professional judgement of the people who are responsible for safeguarding the data and systems we rely on.

When we talk about professionalisation in cyber security, that’s what we’re talking about. It’s how we develop a cyber security profession, made up of individuals from a wide range of backgrounds and technical skills, who are on the frontlines of the UK’s cyber defence.

So, let’s get into it.

What does professionalisation mean?

Cyber security is a broad and rapidly developing field.

The threats we face, and the spheres in which we face them, are evolving daily. The growing impact of AI for example, both in terms of the opportunities it offers and the new threats it poses, means that a strong cyber workforce is more important than ever.

Cyber touches all aspects of our society and, as a result, the roles, responsibilities, systems and organisations required to keep us safe are hugely varied.

Unlike more established fields such as law or accountancy, cyber security has historically lacked a single, widely adopted professional framework through which employers, government and the public can understand the professional standing of individual practitioners. Additionally, the sector encompasses a wide variety of roles, qualifications and certifications, reflecting its breadth and the many different routes people take into and through it.

Professionalisation, therefore, means creating a shared understanding of what competent, ethical and accountable practice looks like across cyber security. It means establishing a common framework of technical and professional standards and providing a consistent way for individuals to demonstrate that they meet them at the level, and in the area in which they’re operating.

For individuals, a clear professional framework can provide an understanding of where they are in their careers and the knowledge, skills and experience they need to take their next steps.

For organisations, it provides a more consistent way to understand what good professional practice looks like, helping to inform recruitment, workforce development and decisions about the cyber expertise they require.

For the public, it provides confidence that the people responsible for keeping them safe have received independent assessment and professional recognition of their skills.

It was for that purpose that the UK Cyber Security Council was created. Awarded Royal Charter status in 2022, the Council was set up by a formation project that consisted of government, industry and academia. Our mandate from Government was to set a unified professional standard for cyber security and to hold the UK’s cyber security professional register, providing independent recognition of an individual’s knowledge, competence, experience and integrity.

Setting a Unified Professional Standard

Created in collaboration with organisations and individuals across the industry, the UK Cyber Security Council Standard for Professional Competence and Commitment was created as the benchmark of competence within the sector.

The Standard provides a common framework for understanding and assessing knowledge, competence and experience across cyber security. Importantly, it also considers expectations around wider, but vital professional skills such as approaches to leadership, teamwork, communication, ethical practice and a commitment to continued learning and development.

The Standard is also contextualised across different specialisms and broken down by levels of responsibility. This helps to make it clear what should be expected across different roles and at different stages of a person’s career.

Awarding Professional Titles in Cyber Security

Professional titles in cyber security are the way in which individuals can demonstrate that they meet this Standard. As part of our Royal Charter, the Council is mandated to award professional titles and add any successful applicants to the UK’s Cyber Security Professional Register.

There are four professional titles, starting with Associate Cyber Security Professional (ACSP) and moving through Practitioner (PraCSP), Principal (PriCSP) and finally Chartered Cyber Security Professional (ChCSP). These titles represent progression from starting a career in cyber to achieving the highest levels of professional responsibility and recognition.

Applicants don’t have to apply for each title in turn. Instead, they can apply for the title they believe best reflects where they are in their career. Our entry-level Associate title, for example, recognises those who are ready to begin a career in cyber security or who are developing their competence in an early role. Practitioner recognises established professionals who apply their knowledge and skills effectively in their work, while Principal reflects greater experience, responsibility and influence within an organisation. At Chartered level, applicants are expected to demonstrate the highest levels of professional competence, leadership and impact, influencing not only their own organisation but potentially the wider cyber security sector.

Importantly, professional registration doesn’t replace qualifications, certifications or training.

Instead, it complements existing learning, bringing together evidence from across a professional’s career. It assesses their accumulated knowledge, competence, experience, professionalism and integrity and, crucially, how they put them into practice across their work. It is a comprehensive and holistic assessment of an individual’s standing as a cyber security professional.

The Role of the UK Cyber Security Council

It’s important to note that, whilst the Council was awarded this mandate by Royal Charter, we don’t do this alone. Professionalising a sector as broad and varied as cyber security requires collaboration between practitioners, employers, government, academia, training and certification providers, professional bodies and many other organisations across the cyber security community.

The Council has a distinct role within that ecosystem. At the heart of our mandate is setting and maintaining a unified professional standard, awarding professional titles and holding the UK’s Cyber Security Professional Register.

To help deliver professional registration across the sector, we also license suitable organisations to assess professional title applications. These organisations are known as Licensed Bodies, and they bring their own expertise, experience and relationships with different parts of the cyber security community.

Every successful applicant is assessed against the same professional standard and are added to the same national register, regardless of the Licensed Body through which they apply. Our Licensed Bodies are currently The Cyber Scheme, the Chartered Institute for Information Security, CREST and IASME, which was announced as a new Licensed Body earlier this year. By expanding this community, we’re opening more routes for those working in cyber to join their sector’s professional register.

Building a Profession Fit for the Future

Ultimately, professionalisation is about strengthening the UK’s cyber resilience by strengthening the UK’s cyber workforce. The people who work in cyber, in every specialism and at every level, are central to our collective cyber security.

A unified professional standard and clear professional titles mean that every cyber professional has the ability to follow their own path, at their own pace, in their own way.

They provide a shared framework that defines the competence, ethics and commitment that we should expect across the sector, whilst giving professionals the opportunity to bring together their knowledge, experience, values and achievements in a way that is recognised by government, employers and peers.

As a profession that holds such significant national importance, we shouldn’t settle for anything less than is already expected in so many other industries.

It’s undeniable that the professionalisation of the sector is gathering pace. At the end of 2025, the UK’s Cyber Security Professional Register reached 1,000 registrants. In less than a year, that number has close to doubled.

The UK Government and the National Cyber Security Centre have consistently expressed their support for a unified professional standard, and the Council’s role in developing it.

The framework for the new Government Cyber Profession has been aligned with our Standard, and the Government has indicated that standards and professionalisation will form a key part of the secondary legislation that follows the passage of the Cyber Security and Resilience Bill.

As an organisation, we’re committed to working with individuals and parters across the sector to increase the adoption and recognition of these professional standards and to give practitioners and employers the tools they need to help the sector thrive.

That means continuing to champion the importance of professionalisation, whilst also ensuring that both the Standard, and the way we deliver on our mandate, reflects the evolving needs of the UK’s cyber security profession.

The technologies we rely on will continue to change, as will the threats against them. But our national resilience will always depend on the people responsible for protecting it.

Whether you’re already working in cyber, looking to enter the sector, employing cyber professionals or seeking their expertise, we all have a role to play in building a thriving cyber security profession, fit for the future.