Better Health for All

NCC Group demonstrates exceptional healthcare data responsibility by preventing the leaking of public health data

and securing critical government and national grade personal data , including for the UK's COVID-19 Test & Trace program. The company specializes in helping healthcare organizations develop and implement comprehensive data lifecycle management strategies , navigating complex regulatory landscapes like HIPAA and HITRUST. During public health emergencies, NCC Group exhibits exceptional crisis response capabilities. They supported the UK's COVID-19 pandemic response by securing the Test & Trace cloud-based technology platforms and 'mega lab' facilities. Additionally, they provided free cyber threat intelligence to global healthcare providers, including national Computer Emergency Response Teams, hospitals, and public health institutes, during the COVID-19 pandemic. The company's products and services do not have direct health impacts, addiction potential, or health risks requiring disclosure, and the company does not engage in pharmaceutical, food, or clinical trial activities.

Fair Money & Economic Opportunity

NCC Group PLC is a cybersecurity and software escrow business, not a financial institution that lends, insures, moves, or stores money for consumers.

Consequently, KPIs related to consumer lending, financial product pricing, fee exposure, and customer financial outcomes are not applicable to its core operations, mapping to a score of 0 as per the rubric's definitions. While the company implements internal diversity and inclusion initiatives for employees and adheres to data protection regulations , these do not directly address financial inclusion, fair lending, or wealth building for underserved client segments. Community engagement efforts, such as employee volunteering and matched funding, are present but are not quantified as profit reinvestment in community finance.

Fair Pay & Worker Respect

NCC Group reported no workplace fatalities since its formation and no reported workplace accidents in the year.

The overall employee turnover rate was 22.0% in 2019, which decreased from 23.5% in 2018.

Fair Trade & Ethical Sourcing

NCC Group, a cybersecurity and risk mitigation services provider, does not procure or trade physical commodities, making fair trade certification and materials risk indices not applicable to its operations. The company reported zero violations of human rights or cases of modern slavery in FY24 (a 16-month period from June 2023 to September 2024).

It maintains a zero-tolerance approach to modern slavery and has systems in place to prevent it in its business and supply chain. The company's Supplier Code of Conduct outlines expectations for ethical behavior, including prohibiting forced or child labor, and suppliers are bound by these standards and must comply with relevant laws like the UK Modern Slavery Act 2015 through their terms and conditions. NCC Group also operates a whistleblowing policy, published in seven languages, to encourage reporting of concerns.

Honest & Fair Business

NCC Group PLC has an Anti-Bribery and Anti-Corruption Policy published on its website and available on request

. The company maintains a zero-tolerance position regarding corruption and bribery , with the policy overseen by the Compliance department, led by the Director of Risk and Governance . No specific, quantifiable evidence was found for regulatory fines, transparency index scores, whistleblower policy implementation metrics, financial restatements, audit coverage percentages, ESG controversy index scores, complaint resolution times, board conflict-free percentages, or the extent of independent verification of ethical claims.

Kind to Animals

NCC Group plc operates in the cybersecurity and software sector, which means its core business has no direct interaction with animal-related issues.

As such, the company has no animal-derived products, animal testing operations, or animal agriculture activities, rendering most animal welfare KPIs not applicable. While environmental efforts are noted to indirectly support wildlife, no measurable biodiversity impact or specific animal welfare initiatives are provided to score the relevant KPI.

No War, No Weapons

NCC Group has established links to the UK Ministry of Defence through contracts.

The company is involved with dual-use technologies, including AI and cyber intrusion capabilities, which have potential for both positive and negative applications, such as generating malicious code. It participates in the Pall Mall Process, a global initiative addressing the misuse of commercial cyber intrusion capabilities. Large language models (LLMs) used by the company typically implement controls to prevent malicious or unethical outputs. In February 2020, NCC Group signed the UK's Armed Forces Covenant, committing to fair treatment for armed forces personnel and their families.

Planet-Friendly Business

NCC Group reports total annual Scope 1 and Scope 2 emissions of 1,686.8 tCO2e for the period 1 October 2023 to 30 September 2024.

, Scope 3 emissions reporting has been expanded to include purchased goods and services (accounting for circa 80% of global spend) and employee commuting for the first time. , The company has a net-zero target year of 2045, with interim targets to reduce Scope 1, 2, and 3 emissions by 42% by 2030 from a 2024 base year. NCC Group is committed to setting science-based targets and is working with Positive Planet to map its net-zero journey and set these targets for FY25, stating they are in line with the Paris Agreement's 1.5 °C goal. , The company began reporting against the TCFD framework in 2022, producing a comprehensive report covering governance, strategy, risk management, and metrics/targets, with partial consistency to some recommendations. An initial quantitative analysis against 1.5°C and 4°C climate scenarios has been conducted. Operational changes include a 40% reduction in global office footprint by closing ten offices in the 16 months to September 2024. A new travel policy promotes rail over domestic flights, and carbon literacy is being integrated into mandatory training. The company also requests renewable energy from landlords and introduced an electric/hybrid car scheme for UK colleagues.

Respect for Cultures & Communities

NCC Group's business model, focused on cybersecurity and software resilience, does not inherently intersect with cultural preservation or indigenous rights.

Consequently, the company has no reported cultural appropriation incidents, cultural impact assessment protocols, FPIC processes, or cultural site disruptions, as these are not applicable to its operations. There is also no specific cultural preservation investment or cultural incident response framework. The company provides unconscious bias training to employees , which aligns with standard diversity training rather than specific cultural sensitivity components.

Safe & Smart Tech

NCC Group has achieved global re-certification against ISO 9001:2015 and ISO 27001:2013 standards, and successfully transitioned to the new ISO 27001:2022 Information Security Standard ahead of the October 2025 deadline.

The company also maintains Cyber Essentials Plus certification. Its data protection program is designed to meet GDPR, CCPA, and other applicable global data privacy legislation. NCC Group emphasizes the need for inclusive and accessible AI systems, highlighting the importance of diverse teams to prevent bias. Standard induction and annual refresher security training are provided, with dedicated training for high-risk roles. Procedures are in place for responding to data subject access requests.

Zero Waste & Sustainable Products

NCC Group has implemented several waste reduction initiatives, including a 40% reduction in its global office footprint in the 16 months to September 30, 2024

, which involved closing ten offices . Other initiatives include removing non-essential printers in UK offices , conducting sustainability audits of its websites , implementing eco-design strategies to reduce website carbon footprint , upgrading its CMS for energy savings , and revising its travel policy to promote lower-carbon options . The company's environmental policy and approach to cybersecurity solutions emphasize the integration of sustainability and designing products for longevity and recyclability , aiming to create enduring designs .