Cloud Cybersecurity Controls – Tenants (CCC – 2 : 2024) Handbook

• Cybersecurity Roles and Responsibilities

  Defines and approves cybersecurity roles and responsibilities, including those of the Authorizing Official, for all parties participating in implementing the cloud cybersecurity controls.

  1 control

• Cybersecurity Risk Management

  Manages cloud cybersecurity risks in a methodological approach to protect information and technology assets per entity policies and related laws and regulations.

  1 control

• Compliance with Cybersecurity Standards, Laws, and Regulations

  Ensures the CST's cybersecurity program complies with related cybersecurity laws and regulations.

  1 control

• Cybersecurity in Human Resources

  Manages personnel-related cybersecurity risks and requirements before, during, and after employment per entity policies and related laws and regulations.

  1 control

• Asset Management

  Maintains an accurate and detailed inventory of cloud services and related information and technology assets to support cybersecurity and operational requirements.

  1 control

• Identity and Access Management

  Restricts logical access to information and technology assets so that only authorized users get the access necessary to accomplish their assigned tasks.

  1 control

• Information System and Information Processing Facilities Protection

  Protects information systems and information processing facilities, including workstations and infrastructure, against cyber risks.

  1 control

• Networks Security Management

  Protects the CST's network, including its connection channel with the CSP, from cyber risks.

  1 control

• Mobile Devices Security

  Protects mobile devices (laptops, smartphones, and tablets) from cyber risks and ensures secure handling of information, including sensitive information, on those devices.

  1 control

• Data and Information Protection

  Ensures the confidentiality, integrity, and availability of the CST's data and information in the cloud per entity policies and related laws and regulations.

  1 control

• Cryptography

  Ensures the proper and efficient use of cryptography to protect information assets per policies, procedures, and related laws and regulations.

  1 control

• Vulnerabilities Management

  Ensures timely detection and effective remediation of technical vulnerabilities to prevent or minimize their exploitation in cyber attacks.

  1 control

• Cybersecurity Event Logs and Monitoring Management

  Ensures timely collection, analysis, and monitoring of cybersecurity event logs for proactive detection and effective management of cyber attacks.

  1 control

• Key Management

  Ensures secure management of cryptographic keys to protect the confidentiality, integrity, and availability of information and technical assets.

  4 controls

• Cybersecurity Resilience Aspects of Business Continuity Management (BCM)

  Embeds cybersecurity resilience requirements in business continuity management to remediate and minimize the impact of disasters caused by cybersecurity incidents.

  1 control

Need help putting this into practice? See our NCA CCC compliance services.