Curated Cybersecurity Reference Library
Verification and maintenance: last reviewed 24 October 2026. Links will be reviewed at least quarterly and after major regulatory, standards or organisational changes. Official legislation, regulator, standards-body and publisher pages are preferred over third-party summaries. Date-specific reports will be replaced or archived when a newer edition becomes available. Resources requiring payment, registration or a subscription are identified explicitly.
Contents
hide
🇬🇧 UK public bodies, regulators and standards organisations
- British Standards Institution (BSI)
- Department for Business, Innovation, Science and Trade
- Financial Conduct Authority (FCA)
- Information Commission
- National Cyber Security Centre (NCSC)
- National Crime Agency (NCA)
- National Protective Security Authority (NPSA)
- Ofcom
- Prudential Regulation Authority (PRA)
Guidance, legislation and publications
- Bank of England Financial Stability Report, July 2026
- Cyber Security Breaches Survey 2025/2026
- Data Protection Act 2018
- GovAssure
- ICO AI and Biometrics Strategy
- ICO Data Breach Guidance
- ICO Data Breach Reporting
- ICO Data Protection Impact Assessment (DPIA) Guidance
- ICO GDPR Guidance
- Information Commissioner’s Annual Report 2025/26
- Law Commission review of the Computer Misuse Act — archived project page
- National Cyber Strategy 2022–2030
- NCSC 10 Steps to Cyber Security
- NCSC Annual Review 2025
- NCSC’s Cyber Assessment Framework
- NCSC Cyber Essentials
- NCSC Cyber Governance Code of Practice
- NCSC’s Cyber Governance for Boards
- NCSC Device Security Guidance
- NCSC for Startups — archived programme overview
- NCSC Guidance on migrating to post-quantum cryptography
- NCSC guidance on securing important online accounts
- NCSC Guidance on Zero Trust
- NCSC incident management guidance
- NCSC’s Secure by Design Principles
- Network and Information Systems Regulations 2018
- NHS Data Security and Protection Toolkit
- Payment Card Industry Data Security Standard (PCI DSS)
- Product Security and Telecommunications Infrastructure Act 2022
- Public Interest Disclosure Act (PIDA) 1998
- Report Fraud — national service for reporting fraud and cybercrime
- UK Government Cyber Security and Resilience Bill
- UK Green Finance Strategy
- Online Safety Act 2023
🇪🇺 EU institutions, regulation and guidance
- CERT-EU
- European Banking Authority (EBA)
- European Cyber Crisis Liaison Organisation Network (EU-CyCLONe)
- European Cybersecurity Competence Centre (ECCC)
- European Data Protection Board (EDPB)
- European Data Protection Supervisor (EDPS)
- European Union Agency for Cybersecurity (ENISA)
- European Union Agency for Law Enforcement Cooperation (Europol)
Legislation, guidance and publications
- ENISA Threat Landscape 2026
- ENISA 2024 Report on the State of Cybersecurity in the Union
- EU Artificial Intelligence Act — official text and implementation resources
- EU Corporate Sustainability Reporting Directive
- EU Cyber Resilience Act — Regulation (EU) 2024/2847
- EU Cybersecurity Act
- EU Cybersecurity Certification Framework
- EU Cyber Solidarity Act
- EU Digital Operational Resilience Act (DORA)
- EU Whistleblower Directive
- European Health Data Space Regulation
- Europol Internet Organised Crime Threat Assessment (IOCTA)
- General Data Protection Regulation — official EUR-Lex text
- NIS2 Directive
🌍 International organisations and resources
Institutions and organisations
- Center for Internet Security (CIS)
- Cloud Security Alliance (CSA)
- Cybersecurity and Infrastructure Security Agency (CISA)
- Forum of Incident Response and Security Teams (FIRST)
- Global Forum on Cyber Expertise (GFCE)
- INTERPOL
- Internet Engineering Task Force (IETF)
- International Telecommunication Union (ITU)
- National Institute of Standards and Technology (NIST)
- Organisation for Economic Co-operation and Development (OECD)
Guidance, legislation and publications
- CISA Ransomware Guidance (USA)
- Cyber Threat Alliance resources and intelligence-sharing initiatives
- FBI cybercrime guidance and reporting resources
- FTC cybersecurity and consumer-protection guidance
- Health Insurance Portability and Accountability Act (USA)
- ISSA professional resources
- National Vulnerability Database (USA)
- NATO Cyber Defence policy and activities
- NATO CCDCOE research and publications
- Sarbanes–Oxley Act of 2002 (USA)
- SEC Rules on Cybersecurity Disclosure (USA)
- World Economic Forum Global Cybersecurity Outlook 2026
- World Economic Forum Global Risks Report 2026
📚 Professional and research bodies
Institutions and research bodies
- Access Now: Digital Rights and Hacktivism
- Chatham House
- Chartered Institute of Information Security (CIISec)
- Electronic Frontier Foundation (EFF)
- FIDO Alliance
- Financial Services Information Sharing and Analysis Center (FS-ISAC)
- Information Systems Audit and Control Association (ISACA)
- Open Worldwide Application Security Project (OWASP)
- Oxford Martin School Global Cyber Security Capacity Centre
Guidance, frameworks and publications
- (ISC)² Advancing the Cyber Workforce
- CIISec Insider Threat Guidance
- CIISec Security Culture
- CIISec Skills Framework
- European Cybersecurity Skills Framework (ECSF)
- Gartner Guide to Cloud Security Concepts (subscription required)
- ISACA State of Cybersecurity 2026
- Journal of Cybersecurity
- Oxford Internet Institute research
- Pew Research: Internet & Technology
- Ponemon Institute
- Reporters Without Borders (RSF)
- Royal United Services Institute
- The Security Awareness Special Interest Group (SASIG)
🛠️ Frameworks and standards
Standards access: ISO, ISO/IEC and ISA/IEC catalogue pages are freely accessible, but full standards normally require purchase or licensed institutional access.
- (ISC)². (2024). Code of Ethics
- AWS Shared Responsibility Model
- CIS Controls v8
- CISA Known Exploited Vulnerabilities (KEV) Catalogue
- (2024). COBIT Framework
- CSA Cloud Controls Matrix
- Cybersecurity Capability Maturity Model (C2M2) 2.1
- ISA/IEC 62443 series — Industrial automation and control-system security
- ISO 22336:2024 — Security and resilience — Organisational resilience — Guidelines for resilience policy and strategy
- ISO 31000:2018 — Risk management — Guidelines
- ISO 45001:2018 — Occupational health and safety management systems — Requirements with guidance for use
- ISO/IEC 27001:2022/Amd 1:2024 — Information security management systems — Requirements — Amendment 1: Climate action changes
- ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls
- ISO/IEC 27017:2026 — Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services
- ISO/IEC 27018:2025 — Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information in public clouds acting as PII processors
- ISO/IEC 27035-1:2023 — Information technology — Information security incident management — Part 1: Principles and process
- ISO/IEC 27701:2025 — Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance
- ISO/IEC 42001:2023 — Artificial Intelligence Management System
- ITIL Version 5 — digital product and service management framework
- MITRE ATT&CK Framework
- MITRE CWE Top 25
- MITRE D3FEND
- NIST AI Risk Management Framework (AI RMF)
- NIST Cybersecurity Framework (CSF) 2.0
- NIST Incident Response Project
- NIST Post-Quantum Cryptography Project
- NIST Privacy Framework
- NIST Secure Software Development Framework Project
- NIST SP 800-37 Rev. 2 — Risk Management Framework for Information Systems and Organizations
- NIST SP 800-53 Rev. 5 — Security and Privacy Controls for Information Systems and Organizations
- NIST SP 800-61 Rev. 3 — Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST SP 800-63-4 — Digital Identity Guidelines
- NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
- NIST SP 800-207 — Zero Trust Architecture
- NIST SP 800-218 — Secure Software Development Framework Version 1.1
- NTIA SBOM Minimum Elements
- Open FAIR — quantitative information-risk analysis
- OpenSSF SLSA — Supply-chain Levels for Software Artifacts
- OWASP API Security Top 10 2023
- OWASP Application Security Verification Standard (ASVS) 5.0
- OWASP Software Assurance Maturity Model (SAMM) 2.2
- OWASP Top 10 2025
- UK Government Secure by Design Framework
📌 Threat intelligence
- Accenture Ninth Annual Cost of Cybercrime Study 2019
- CrowdStrike Global Threat Report (summary open; free registration required for the full report)
- Forrester’s Cybersecurity Trends
- Gartner cybersecurity research and guidance (subscription may be required)
- Gartner Top Trends in Cybersecurity for 2026 (subscription may be required)
- Google Cloud Mandiant M-Trends
- IBM Cost of a Data Breach Report 2026
- IBM X-Force Threat Intelligence Index
- Microsoft Digital Defence Report
- MITRE ATLAS — adversary tactics and techniques for AI-enabled systems
- OpenSSF Annual Report 2025
- Proofpoint Human Factor Report (free registration required)
- PwC Global Digital Trust Insights 2026
- SonicWall Cyber Threat Report 2026
- Sophos State of Ransomware 2025
- UK Finance Fraud Report 2025
- US DNI Annual Threat Assessment 2026
- Veeam Ransomware Trends
- Verizon Data Breach Investigations Report (DBIR) 2026
🛡️ Tools and resources
- Age-Appropriate Design Code (Children’s Code)
- Bellingcat Online Investigations Toolkit
- CISA Cybersecurity Tools and Resources
- CISA Zero Trust Maturity Model
- EFF’s Surveillance Self-Defense Guide
- ENISA cybersecurity-awareness conference and C-level guidance
- ENISA announcement introducing the European Cybersecurity Skills Framework
- Get Safe Online — online-safety advice and self-help tools
- Google’s Phishing Quiz
- Have I Been Pwned
- Maltego: OSINT tools for threat intelligence (free basic tier; paid plans available; registration required)
- Microsoft Cybersecurity Training
- NCSC Cyber Aware Campaign
- NCSC Early Warning Service
- NCSC Exercise in a Box
- NCSC Vulnerability Scanning Service
- Protect – Whistleblowing Charity
- Report Fraud — payment diversion and business email compromise guidance
Expert commentators
Selected commentators provide authoritative analysis across security engineering, cyber policy, threat intelligence, digital rights, surveillance, governance and technology leadership. The section includes both active commentators and archival authorities whose work remains influential. Links lead to personal sites, institutional profiles or established publication channels.
- Alex Stamos, cybersecurity policy specialist and lecturer at Stanford University
- Brian Krebs, investigative journalist
- Bruce Schneier, security technologist, author and Fellow at Harvard Kennedy School’s Belfer Centre
- Ciaran Martin, Professor of Practice at the Blavatnik School of Government and founding Chief Executive of the UK National Cyber Security Centre
- Claudio Guarnieri, security researcher specialising in spyware, targeted surveillance and digital threats to civil society
- Dave Lewis, Advisory CISO at Cisco
- Dmitri Alperovitch, co-founder and former Chief Technology Officer of CrowdStrike
- Ivan Martinovic, Professor of Computer Science at the University of Oxford
- Katie Moussouris, founder and Chief Executive Officer of Luta Security and specialist in vulnerability disclosure and bug-bounty policy
- Laura DeNardis, Professor and Endowed Chair in Technology, Ethics and Society at Georgetown University
- Maria Markstedter, founder of Azeria Labs
- Richa Singh, professor at the University at Buffalo and researcher in artificial intelligence, biometrics and responsible machine learning
- Ross Anderson, 1956–2024, Professor of Security Engineering at the University of Cambridge and foundational researcher in security economics
- Rumman Chowdhury, Chief Executive Officer of Humane Intelligence and specialist in responsible artificial intelligence, algorithmic accountability and security testing
- Susan Landau, Professor of Cyber Security and Policy at Tufts University
- Tim Maurer, cyber-policy specialist and author on state–hacker relationships, financial-system resilience and international cybersecurity policy
- Tim Stevens, Professor of International Security at King’s College London
- Troy Hunt, Microsoft Regional Director and creator of Have I Been Pwned
- Wendy Nather, Head of Advisory CISOs at Cisco
📌 Cybersecurity conferences and webinars
- ACM Conference on Computer and Communications Security (CCS) 2026, 15–19 November, The Hague (paid registration required)
- Black Hat Europe, cutting-edge research, vulnerabilities and exploits, December, London (paid registration required)
- BSides events, community-driven cybersecurity talks and workshops, global, year-round (registration required; ticket cost varies by local event)
- CIS webinars — security controls, benchmarks and resilience briefings, online
- CISA cybersecurity events and workshops — public-sector and critical-infrastructure briefings, online and in person
- CRESTCon UK events, practitioner-led technical and community events, UK (registration required; free for CREST members and qualified individuals, fees may apply to others)
- CyberUK, NCSC’s flagship cybersecurity conference, May, UK, hybrid (paid registration required)
- DEF CON, hacking, cybersecurity research and hands-on workshops, August, Las Vegas, hybrid (paid registration required)
- ENISA 9th Cybersecurity Standardisation Conference 2025 — event materials and programme
- ENISA events — EU cybersecurity conferences, meetings and webinars, year-round
- European Cybersecurity Skills Conference 2026, 4–5 November, Larnaca and online (free registration required; capacity limited)
- Gartner Security & Risk Management Summit, strategic cybersecurity insights for leaders, June/September, global (paid registration required)
- IEEE Symposium on Security and Privacy 2026, 18–21 May, San Francisco (paid registration required)
- InfoSecurity Europe, cybersecurity trends, solutions and networking, June, London, hybrid (free visitor registration required; some workshops are paid)
- RSA Conference, cybersecurity innovation, trends and best practices, April/May, San Francisco, hybrid (paid registration required)
- SANS webcasts — cybersecurity briefings and training, online, year-round
- SASIG Events — online and in-person events throughout the year aimed at the UK CISO community (application or eligible membership required; attendance is free for members)
- USENIX Security Symposium 2026, 12–14 August, Baltimore (paid registration required)
🏫 Education-specific resources
- CISA Cybersecurity for K-12 Schools
- Cyber Security Breaches Survey 2025/2026 — education institutions findings
- Cyber Discovery programme evaluation
- Cybersecurity for Schools and Colleges
- DfE guidance on procuring educational technology
- ENISA cybersecurity skills and competences resources
- GDPR Guidance for Schools
- Google for Education Security
- Information Commission school resources
- Jisc Cyber Security Services
- Keeping children safe in education — statutory guidance for schools and colleges in England
- LGfL Cybersecurity Resources
- LGfL Digital Safety Toolkit
- Microsoft Education
- Naace — educational technology professional association
- NCSC Cyber Skills and TechFirst
- NCSC Education Sector Guidance
- NIST’s The Future of Cybersecurity Education
- Raspberry Pi Projects — computing and cybersecurity learning resources
- Raspberry Pi teaching resources
- Safer Internet Centre
- UK Safer Internet Centre resources for teachers and school staff
News, analysis and current-affairs media
- BBC Panorama
- BBC Technology News
- Bellingcat
- BleepingComputer
- Carnegie Endowment — Cyber and Digital Policy
- CISO Perspectives
- The Citizen Lab
- CyberScoop
- CyberWire podcast network
- Dark Reading: Cybersecurity News
- The Diplomat: Cybersecurity Section (metered access)
- ENISA News
- Google Project Zero
- The Guardian: Technology
- The Hacker News
- Hacking Humans
- KrebsOnSecurity
- Lawfare — Cybersecurity & Tech
- NCSC Blog
- POLITICO Europe — Cybersecurity and Data Protection (some content requires a POLITICO Pro subscription)
- The Record
- The Register
- Reuters Cybersecurity Coverage
- WIRED: Security (partially paywalled)
🎥 Documentaries and videos
- CYBERUK — NCSC conference keynotes, technical talks and panel discussions.
- Cyber War (2021, PBS) – State-sponsored cyberattacks and global espionage.
- ENISA Video Library — EU cybersecurity briefings, explainers, event recordings and training materials.
- Global Spyware Scandal: Exposing Pegasus (2023, PBS FRONTLINE) — investigative documentary on commercial spyware and its use against journalists and civil-society figures.
- The Great Hack (2019) – Cambridge Analytica and data manipulation. Subscription required.
- TED Talk: How Hackers Could Crash the Entire Internet – Dan Geer on systemic cyber risks.
- Zero Days (2016) — Alex Gibney’s documentary on Stuxnet and the emergence of cyber warfare.
- Zero Trust for Dummies — Fortinet video introduction to zero-trust concepts.
🎧 Podcasts
- CyberWire Daily – Daily cybersecurity news and analysis.
- Darknet Diaries – Real-world cyberattack stories.
- NCSC Cyber Series – Authoritative UK guidance on cyber threats, resilience, ransomware, artificial intelligence, passwords and incident response.
- Risky Business – Deep dives into cybersecurity threats and trends.
- SANS Internet Storm Center Stormcast – Concise weekday analysis of current vulnerabilities, exploits and network-security developments.
- The Cyberlaw Podcast – Legal and policy aspects of cybersecurity.
Books
- Rid, Thomas. Active Measures: The Secret History of Disinformation and Political Warfare. Profile Books, 2020. Hardcover. ISBN-13: 978-1-78816-074-2.
- Miller, Chris. Chip War: The Fight for the World’s Most Critical Technology. Updated ed. Simon & Schuster UK, 2026. Paperback. ISBN-13: 978-1-3985-5735-2.
- Zetter, Kim. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. Crown Business, 2014. Hardcover. ISBN-13: 978-0-7704-3617-9.
- Clarke, Richard A., and Robert K. Knake. Cyber War: The Next Threat to National Security and What to Do About It. Ecco, 2010. Hardcover. ISBN-13: 978-0-06-196223-3.
- Singer, P. W., and Allan Friedman. Cybersecurity and Cyberwar: What Everyone Needs to Know. Oxford University Press, 2014. Paperback. ISBN-13: 978-0-19-991811-9.
- Buchanan, Ben. The Cybersecurity Dilemma: Hacking, Trust and Fear Between Nations. Oxford University Press, 2017. Paperback. ISBN-13: 978-0-19-066501-2.
- Brum, Pablo. Decoding Cybersecurity: A Comprehensive Guide for the Non-Techie. Globe Pequot Press, 2026. Hardcover. ISBN-13: 978-1-4930-9337-3.
- Clarke, Richard A., and Robert K. Knake. The Fifth Domain: Defending Our Country, Our Companies, and Ourselves in the Age of Cyber Threats. Penguin Books, 2020. Paperback. ISBN-13: 978-0-525-56198-9.
- Buchanan, Ben. The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics. Harvard University Press, 2020. Hardcover. ISBN-13: 978-0-674-98755-5.
- Cialdini, Robert B. Influence, New and Expanded: The Psychology of Persuasion. Expanded ed. Harper Business, 2021. Hardcover. ISBN-13: 978-0-06-293765-0.
- Buchanan, Ben, and Andrew Imbrie. The New Fire: War, Peace, and Democracy in the Age of AI. MIT Press, 2022. Hardcover. ISBN-13: 978-0-262-04654-1.
- Smeets, Max. No Shortcuts: Why States Struggle to Develop a Military Cyber-Force. Hurst, 2022. Hardcover. ISBN-13: 978-1-78738-687-7.
- Sanger, David E. The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age. Scribe UK, 2018. Paperback. ISBN-13: 978-1-91161-772-3.
- Kim, Gene, Kevin Behr, and George Spafford. The Phoenix Project: A Novel About IT, DevOps, and Helping Your Business Win. 4th ed. IT Revolution Press, 2024. Paperback. ISBN-13: 978-1-95050-894-5.
- Ryan, Matthew. Ransomware Revolution: The Rise of a Prodigious Cyber Threat. Springer International Publishing, 2021. Hardcover. ISBN-13: 978-3-030-66582-1.
- Greenberg, Andy. Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers. Doubleday, 2019. Hardcover. ISBN-13: 978-0-385-54440-5.
- Anderson, Ross. Security Engineering: A Guide to Building Dependable Distributed Systems. 3rd ed. Wiley, 2020. Hardcover. ISBN-13: 978-1-119-64278-7.
- Perlroth, Nicole. This Is How They Tell Me the World Ends: A True Story. Bloomsbury Publishing, 2022. Paperback. ISBN-13: 978-1-5266-5253-9.
- Greenberg, Andy. Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency. Vintage, 2024. Paperback. ISBN-13: 978-0-593-31561-3.
- Alperovitch, Dmitri, and Garrett M. Graff. World on the Brink: How America Can Beat China in the Race for the Twenty-First Century. PublicAffairs, 2024. Hardcover. ISBN-13: 978-1-54170-409-1.
- Rais, Razi, Christina Morillo, Evan Gilman, and Doug Barth. Zero Trust Networks: Building Secure Systems in Untrusted Networks. 2nd ed. O’Reilly Media, 2024. Paperback. ISBN-13: 978-1-4920-9659-7.