22 Jan NPSA: The UK standard that’s raising the bar

When security leaders talk about “assurance,” they’re really talking about proof; evidence that the technology protecting their people, assets and data will stand up to sophisticated threats. In the United Kingdom, that proof has a name: the National Protective Security Authority (NPSA). Increasingly, NPSA’s approach to assurance is resonating far beyond the UK, especially across the Middle East, because it blends cyber resilience with physical protection and bakes operational rigour into how systems are designed, built and maintained.

This article from AMAG Technology, unpacks what NPSA is, why it matters and how its Cyber Assurance of Physical Security Systems (CAPSS) and Automated Access Control Systems (AACS) schemes translate into real value for buyers. We also look at how AMAG Technology has operationalised these principles through Symmetry® Access Control and the Symmetry M2150 OSDP controller and secure cabinet, bringing NPSA accreditation into day-to-day deployment

What is NPSA?

NPSA is the UK government’s national technical authority for physical and personnel protective security. It develops threat-led guidance and evaluates security technologies against rigorous criteria, then publishes outcomes in the Catalogue of Security Equipment (CSE). For security leaders, the value is twofold: authoritative, practical guidance on how to design and operate resilient systems, and a transparent list of technologies that have been evaluated against nationally set standards.

Crucially, NPSA’s work is not an academic exercise. It is built around the operational realities of critical national infrastructure (CNI), government and high-consequence commercial environments where failures are unacceptable. That is why NPSA focuses on features and end-to-end performance, secure development practices and lifecycle resilience.

CAPSS and AACS: Cyber + physical, end to end

Two NPSA programmes matter most to access control decision-makers:

• CAPSS (Cyber Assurance of Physical Security Systems) validates that a vendor’s development practices and product architecture embed cybersecurity into the product’s DNA, not as an afterthought. CAPSS considers secure design, patching, logging, administration and how systems interact with other security subsystems like CCTV and intrusion detection.
• AACS (Automated Access Control Systems) provides high-level and detailed guidance on designing, commissioning, operating and maintaining access control systems that manage ‘who can go where and when’, including integration with manual controls and authentication technologies. Guidance covers network security, design features, token selection and lifecycle, user training and maintenance for sustained assurance.

Together, CAPSS and AACS address the full chain of trust; hardware, software, communications and operations, ensuring that the same system that keeps intruders out also resists cyber compromise and insider threat.

NPSA in practice: Symmetry Access Control + Symmetry M2150 OSDP

NPSA’s impact is most meaningful when you can buy and deploy accredited solutions. AMAG Technology has achieved NPSA accreditation for Symmetry Access Control as well as the Symmetry M2150 OSDP controller and its secure cabinet. The result is end-to-end assurance that spans software and hardware, including the physical enclosure you mount on the wall.

There are three reasons this matters to security leaders:

1. Assured by default, not bolt-on. The NPSA accreditation is part of the standard, off-the-shelf product from AMAG Technology. That means project teams start on the right foot: the baseline system already aligns to CAPSS and the highest AACS level, reducing the need for aftermarket hardening and lengthy exceptions during governance reviews.
2. A complete chain of trust. On the software side, CAPSS alignment affirms secure development practices, patching cadence, role-based administration and logging controls you rely on when integrating with HR, visitor management, video or PSIM. On the hardware side, the Symmetry M2150 OSDP controller enforces secure reader-to-panel communications using OSDP, supports strong authentication patterns, and, when paired with the secure cabinet, maintains physical integrity of the control point. The combined stack addresses common attack paths: network, credential and enclosure within one accredited design.
3. Faster, clearer procurement. Because NPSA publishes evaluated products in the CSE and defines what ‘good’ looks like across design and operations, specifiers can point to a nationally recognised reference during tender, and owners can show boards and auditors a verifiable alignment to best-in-class standards.

Why NPSA matters to security leaders

Independent assurance you can show to stakeholders

Security leaders are under pressure to justify investments and demonstrate measurable risk reduction. NPSA’s government-backed evaluations provide objective, third-party assurance. The CSE listing shortens due diligence and procurement cycles and gives stakeholders a defensible reference point.

Cyber-physical alignment, not silos

Modern estates are converged environments: readers, controllers, video, building systems and identity platforms share networks and data. CAPSS forces vendors to engineer for secure deployment and lifecycle management, closing the gap between ‘IT-secure’ and ‘physically secure’. That reduces the likelihood that a cyber weakness undermines physical control or vice versa.

Operational resilience over time

NPSA guidance stretches beyond the installation. It prescribes commissioning, privilege management, training and maintenance practices that sustain resilience after day one, critical in organisations where staffing changes, integrations evolve and attack surfaces expand.

Why NPSA accreditation matters in the Middle East

The Middle East is racing ahead on smart cities, airports, industrial megaprojects and digital transformation, exactly the kind of highly connected environments where cyber and physical risks blend. Regional media and industry analysis highlight the convergence challenge: interconnected building systems, OT and IT networks, and AI-enabled security create new pathways for attackers unless controls are engineered and operated to an integrated standard.

NPSA accreditation delivers practical advantages:

1. Procurement clarity for mega-projects. With hundreds of stakeholders and aggressive schedules, large projects benefit from the CSE’s clear, validated product listings. Specifiers can reduce rework and variation orders by insisting on evaluated components from day one.
2. Cyber-physical resilience for smart infrastructure. CAPSS-aligned development and AACS-aligned operations help ensure that access control, often connected to identity, HR and building platforms, does not become the weak link. That is particularly relevant as attackers target OT networks and building automation to pivot into enterprise systems.
3. Stakeholder confidence and auditability. Projects overseen by ministries, regulators, and international partners need transparent, defensible standards. NPSA gives security leaders a common language of assurance backed by a national technical authority.

The bottom line

NPSA-aligned solutions offer a practical path to documented assurance, smoother procurement and stronger, auditable resilience against both cyber and physical threats.

As vendors respond, integrating CAPSS expectations into product development and aligning deployments to AACS guidance, the value to buyers is tangible: less risk, less friction, and clearer evidence of security done right.

This feature appeared in issue 146 of Security Middle East magazine.