Cloud Cybersecurity Controls – Service Providers (CCC – 2 : 2024) Handbook

• Cybersecurity Roles and Responsibilities

  Defines and approves cybersecurity roles and responsibilities, including those of the Authorizing Official, for all parties participating in implementing the cloud cybersecurity controls.

  1 control

• Cybersecurity Risk Management

  Manages cloud cybersecurity risks in a methodological approach to protect information and technology assets per entity policies and related laws and regulations.

  1 control

• Compliance with Cybersecurity Standards, Laws, and Regulations

  Ensures the CSP's cybersecurity program complies with related cybersecurity laws and regulations.

  1 control

• Cybersecurity in Human Resources

  Manages personnel-related cybersecurity risks and requirements before, during, and after employment per entity policies and related laws and regulations.

  2 controls

• Cybersecurity in Change Management

  Embeds cybersecurity requirements in the CSP's change management methodology and procedures to protect the confidentiality, integrity, and availability of information and technology assets.

  4 controls

• Asset Management

  Maintains an accurate and detailed inventory of information and technology assets to support cybersecurity and operational requirements.

  1 control

• Identity and Access Management

  Restricts logical access to information and technology assets so that only authorized users get the access necessary to accomplish their assigned tasks.

  1 control

• Information System and Information Processing Facilities Protection

  Protects information systems and information processing facilities, including workstations and infrastructure, against cyber risks.

  1 control

• Networks Security Management

  Protects the CSP's networks, including the Cloud Technology Stack network, from cyber risks.

  1 control

• Mobile Devices Security

  Protects mobile devices (laptops, smartphones, and tablets) from cyber risks and ensures secure handling of information, including sensitive information, on those devices.

  1 control

• Data and Information Protection

  Ensures the confidentiality, integrity, and availability of data and information per entity policies and related laws and regulations.

  1 control

• Cryptography

  Ensures the proper and efficient use of cryptography to protect information assets per policies, procedures, and related laws and regulations.

  1 control

• Backup and Recovery Management

  Protects the CSP's data and information, including information systems and software configurations, from cyber risks through backup and recovery management.

  1 control

• Vulnerabilities Management

  Ensures timely detection and effective remediation of technical vulnerabilities to prevent or minimize their exploitation in cyber attacks.

  1 control

• Penetration Testing

  Assesses the CSP's cybersecurity defense capabilities through simulated cyber attacks that uncover unknown weaknesses in the technical infrastructure.

  1 control

• Cybersecurity Event Logs and Monitoring Management

  Ensures timely collection, analysis, and monitoring of cybersecurity event logs for proactive detection and effective management of cyber attacks.

  1 control

• Cybersecurity Incident and Threat Management

  Ensures timely identification and detection of cybersecurity incidents, their effective management, and proactive response to threats to minimize business impact.

  1 control

• Physical Security

  Protects the CSP's information and technology assets from unauthorized physical access, loss, theft, and damage.

  1 control

• Web Application Security

  Protects the CSP's external web applications from cyber risks.

  1 control

• Key Management

  Ensures secure management of cryptographic keys to protect the confidentiality, integrity, and availability of information and technical assets.

  4 controls

• System Development Security

  Ensures the CSP's systems are developed, integrated, and deployed in a secure manner.

  4 controls

• Storage Media Security

  Ensures the CSP handles information and data on physical storage media securely.

  4 controls

• Cybersecurity Resilience Aspects of Business Continuity Management (BCM)

  Embeds cybersecurity resilience requirements in business continuity management to remediate and minimize the impact of disasters caused by cybersecurity incidents.

  1 control

• Supply Chain and Third-Party Cybersecurity

  Protects assets against cybersecurity risks from third parties, including outsourcing and managed services, per policies and related laws and regulations.

  1 control

Need help putting this into practice? See our NCA CCC compliance services.