Secure Innovation

Who are NPSA?

National Protective Security Authority (NPSA) are part of MI5. They are the UK’s national technical authority for personnel and physical security.  Their mission is to reduce the vulnerability of UK government, businesses, and academia to a range of threats, including terrorism, espionage, and sabotage. NPSA provides expert guidance to help organisations strengthen their protective security posture.

Who are the NCSC?

The National Cyber Security Centre (NCSC) are part of GCHQ. They are the UK’s national technical authority for cyber security. Their role is to make the UK the safest place to live and work online. They support the most critical organisations in the UK, the wider public sector, industry, SMEs as well as the general public.

What are state threats?

State threats are overt or covert actions by foreign governments which fall short of direct armed conflict with the UK but go beyond peaceful diplomacy and expected statecraft to harm or threaten the safety or interests of the UK or our allies.

State threats present a real and evolving risk to the UK. They can manifest in a range of forms. These include attempts to:

• steal sensitive information through espionage or cyber attacks
• threaten the public’s safety, including through physical violence.
• harm our prosperity
• undermine our values and freedoms

State threats do not only materialise against government and intelligence agencies. Some states are particularly interested in industrial or commercial information which could be used to support their own economy or military. This information may not be “classified” or an obvious target for espionage.

States may seek to exploit foreign direct investment, academic partnerships and supply chains to gain access to sensitive information.

This includes information on companies’ products and plans or commercial/academic research. State actors could seek to fast track their own technological capabilities or increase their military advantage. Examples of industries in which states show particular interest include advanced materials, biotech, and artificial intelligence. It also includes research and mainly academic research, particularly in STEM (science, technology, engineering and mathematics), dual-use technologies, emerging technology and other commercially sensitive areas. As with business information, state actors could seek to exploit research to improve their own technological or military capabilities.

Are state threats relevant to the private sector and small businesses?

Yes. State actors do not only target large corporations or government entities. In fact, companies of all sizes —especially those with lower levels of security—can be attractive targets. No business is too small or too early-stage to be of interest, particularly if it holds valuable intellectual property, innovative technologies, or sensitive data.

Can a small company really do anything to protect themselves from state threats?

Yes. There are steps businesses of any size can take to reduce their vulnerabilities to state threats. The aim of the protective security measures outlined in Secure Innovation is to reduce the risk to the business and increase the risk to the state actor trying to get hold of their assets. The better an organisation’s protective security measures are, the harder a state actor will have to try to get access to their technologies, and the greater the chance that they will be detected doing so. State actors will make a risk-benefit decision on who to target, so the higher the risk to them, the less likely they are to try.

How do you apply for a Security Review?

A company can apply for a Secure Innovation Security Review at the link below.

Applications are assessed by Innovate UK Business Growth against the criteria set out in the application form.

Is funding guaranteed?

Secure Innovation Security Reviews is a subsidy scheme. Until all slots are filled, organisations that meet the eligibility criteria and successfully pass the application process will be offered access to a partially funded Secure Innovation Security Review. Participating companies will contribute £500; while the government will fund the remaining £2,500.

Funding for the scheme is limited and will be awarded on a first-come, first-served basis. Once the available funding has been allocated, no further awards can be made—meaning only a limited number of companies will be able to benefit from the scheme this financial year.

It should be noted that the government will fund £2,500 (including VAT) of the total cost of the review which is £3,000 (including VAT); by making an application for a Security Review an organisation is confirming their agreement to fund the remaining £500 (including VAT) of the overall cost. This will be invoiced and paid directly to the Security Reviewer.

Where do you find information on appointing an appropriate Security Reviewer who can complete the review?

Following approval of your application, your organisation will be required to appoint a Security Reviewer to carry out the review. A list of approved Security Reviewers will have been shared in the grant acceptance email. It is the organisation’s responsibility to choose an appropriate professional from this list.

All approved Security Reviewers are either Chartered Security Professionals (CSyP), appear on the Register of Security Engineers and Specialists (RSES) or are NCSC assured Cyber Advisors. They have applied to be part of this scheme, have completed training on the Secure Innovation Security Review framework with NPSA and NCSC and passed a knowledge check to demonstrate an understanding of the scheme and framework, and have signed up to complete reviews anywhere in the UK.

While we provide basic information about each professional’s experience and location preferences to assist organisations in making a selection, the framework and scope of the scheme remain consistent across all reviewers. Therefore, it is not advisable for organisations to request multiple reviewers to ‘bid’ or ‘pitch’ for the review.

We recommend that organisations appoint their chosen Security Reviewer within one week of receiving the grant acceptance email to ensure timely scheduling of the review.

What do you need to do before meeting the Security Reviewer you appoint?

Firstly, you should share the content of your confirmation email along with a copy of your application form with the appointed security reviewer.

Secondly, you should undertake the Secure Innovation Action plan preparatory work.

What do you need to do before the due date?

The deadline detailed in the confirmation email is the deadline for your Security Reviewer to have submitted a final report. Prior to this deadline a company must:

1. 1. Appoint a Security Reviewer from the list provided.
   2. Share the content of the confirmation email along with a copy of their application form to the security reviewer.
   3. Complete the preparatory work.
   4. Arrange an in-person site visit with the Security Reviewer.
   5. Review and sign-off the report.
   6. Confirm that your Security Reviewer has submitted the final report and their invoice for £2,500 via email to secureinnovation@iukbg.ukri.org
   7. The business receiving the security review will be responsible for paying the outstanding £500 to the appointed Security Reviewer.

What if you can’t complete the above by the due date?

Innovate UK Business Growth should be contacted by email secureinnovation@iukbg.ukri.org as early as possible by the party requiring an extension (either the organisation or security reviewer) to request an extension to the deadline.

If the report is not submitted within the time allowed and an extension has not been agreed; or if an extension has been agreed, but the report is not submitted before the expiry of the extension period, we will assume the review report is not going to be submitted and withdraw the funding offer. Innovate UK Business Growth will not be responsible for any costs incurred by the business or Security Reviewer if funding is withdrawn.

It is the organisation’s responsibility to ensure that the Security Reviewer is aware of the deadline detailed in the confirmation email.

Is the Security Review report confidential?

Yes. It will only be shared with selected individuals within BIST, Innovate UK, NPSA and the NCSC.

Does the £3000 cover the cost of implementing protective security measures?

No, the £3000 is for the purposes of the security review only.

How long will the Security Review scheme run for?

Applications for the current scheme will be open until January 31st 2027, with over 300 grants available. These will be allocated on a first-come-first-serve basis to organisations who pass the eligibility criteria and assessment. The scheme is planned to extend through to 2029, enabling support for up to 1,000 organisations in total, with applications opening again in the next FY.

Does the review include penetration (PEN) testing?

The reviews do not include PEN testing. NCSC have the CHECK scheme which is a list of NCSC approved companies who can do cyber PEN testing. NPSA do not recommend PEN testing for physical and personnel security.

Do we get an official certification or is there a logo we can display to show we have gone through this process?

This is not a certification scheme, as there is no requirement and/or test or audit to ensure organisations have implemented the security measures recommended by the review. We do not offer a logo which companies can display to show they have gone through the process. This is to avoid the risk of the scheme being misinterpreted as a certification or accreditation scheme. However, you can mention having had a security review completed as a way of demonstrating your commitment to security.

What data will be collected as part of the Secure Innovation Security Review Scheme?

Data will be collected through various stages of the scheme, including the application process, site visit, written report, Health Check Questionnaires, and feedback surveys. This may include business contact details, security-related information, and feedback on the scheme.

Who will my data be shared with?

Your data will be shared with the following organisations involved in the funding, delivery and oversight of the scheme:

• • Department for Business, Innovation, Science and Trade (BIST)
  • Innovate UK
  • National Protective Security Authority (NPSA)
  • National Cyber Security Centre (NCSC)
  • Innovate UK Business Growth service consortium delivery partner

Why is my data being shared with these organisations?

These organisations are responsible for funding, managing, delivering, and evaluating the scheme. Data sharing enables them to monitor the scheme’s effectiveness, assess behavioural change, and inform future improvements or expansion.

Will my data be used for marketing purposes?

No. Your data will not be used for marketing purposes unless you have explicitly consented to this.

Is this data sharing compliant with UK GDPR?

In accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (as applicable), by participating in the Secure Innovation Security Review Scheme, you acknowledge and agree that any data you provide or that is collected throughout the scheme via the site visit, written report, Health Check Questionnaires, and feedback surveys—may be shared with Innovate UK Business Growth service consortium delivery partner, the Department for Business, Innovation, Science and Trade (BIST), the National Protective Security Authority (NPSA), and the National Cyber Security Centre (NCSC). This data will be used solely for the purposes of administering, evaluating, and improving the scheme, and for monitoring its impact. All data will be handled in accordance with applicable data protection laws and will not be used for marketing purposes without your explicit consent.

By providing your contact details, you agree to any partner mentioned above storing your information and they may contact you at a future date to learn about your experiences and to share opportunities related to other Secure Innovation products. Your data will be handled in accordance with the relevant privacy notices of each organisation as available on their websites.

Who can I contact with questions about data protection?

If you have any questions or concerns about how your data is being used, you should contact the delivery partner or the data protection officer for the scheme at secureinnovation@iukbg.ukri.org

Where can I find additional resources?

The Economic Security Advisory Service (ESAS) provides a consolidated source of advice, guidance, and resources on economic security. ESAS is a new Government service being led by the Department for Business, Innovation, Science and Trade, which is designed to support UK businesses of any size, sector, or location in navigating economic security challenges. ESAS brings together expert guidance from bodies such as NPSA, NCSC, and IPO to provide businesses with clear, consolidated advice, guidance, and information on issues such as supply chain resilience, cyber security, and intellectual property. In addition to offering central online resources and guidance, ESAS facilitates business roundtables and two-way engagement, creating direct channels for dialogue between businesses and the Government on a full range of economic security matters.