Critical Systems Cybersecurity Controls (CSCC – 1 : 2019) Handbook

• Cybersecurity Strategy

  Ensures cybersecurity plans, goals, initiatives and projects contribute to compliance with related laws and regulations.

  1 control

• Cybersecurity Risk Management

  Ensures cybersecurity risks are managed methodologically to protect information technology assets per organizational policies and related laws and regulations.

  1 control

• Cybersecurity in Information Technology Project Management

  Ensures cybersecurity requirements are included in project management methodology and procedures to protect the confidentiality, integrity and availability of information technology assets.

  2 controls

• Periodical Cybersecurity Review and Audit

  Ensures cybersecurity controls are implemented and compliant with organizational policies and procedures and related national and international laws, regulations and agreements.

  2 controls

• Cybersecurity in Human Resources

  Ensures personnel-related cybersecurity risks and requirements are managed efficiently prior to employment, during employment and after termination or separation.

  1 control

• Asset Management

  Ensures the organization keeps an accurate and detailed inventory of information technology assets supporting its cybersecurity and operational requirements.

  1 control

• Identity and Access Management

  Ensures secure and restricted logical access to information technology assets, preventing unauthorized access and allowing only access necessary for assigned tasks.

  2 controls

• Information System and Information Processing Facilities Protection

  Ensures information systems and information processing facilities, including workstations and infrastructures, are protected against cyber risks.

  1 control

• Networks Security Management

  Ensures the organization's network is protected from cyber risks.

  1 control

• Mobile Devices Security

  Ensures mobile devices are protected from cyber risks and the organization's information is handled securely while utilizing a BYOD policy.

  1 control

• Data and Information Protection

  Ensures the confidentiality, integrity and availability of the organization's data and information per organizational policies and related laws and regulations.

  1 control

• Cryptography

  Ensures the proper and efficient use of cryptography to protect information assets per organizational policies and related laws and regulations.

  1 control

• Backup and Recovery Management

  Ensures the organization's data and information, including information systems and software configurations, are protected from cyber risks through backup and recovery.

  2 controls

• Vulnerabilities Management

  Ensures timely detection and effective remediation of technical vulnerabilities to prevent or minimize their exploitation in cyber attacks against the organization.

  2 controls

• Penetration Testing

  Assesses the efficiency of the organization's cybersecurity defense capabilities through simulated cyber attacks that uncover unknown weaknesses in the technical infrastructure.

  2 controls

• Cybersecurity Event Logs and Monitoring Management

  Ensures timely collection, analysis and monitoring of cybersecurity events for early detection of potential cyber attacks.

  2 controls

• Web Application Security

  Ensures internet-facing web applications are protected against cyber risks.

  2 controls

• Application Security

  Ensures the critical systems' internal applications are protected against cyber risks.

  4 controls

• Cybersecurity Resilience Aspects of Business Continuity Management (BCM)

  Ensures cybersecurity resilience requirements are included in business continuity management to remediate and minimize impacts from disasters caused by cybersecurity incidents.

  1 control

• Third-Party Cybersecurity

  Ensures assets are protected against cybersecurity risks related to third parties, including outsourcing and managed services.

  1 control

• Cloud Computing and Hosting Cybersecurity

  Ensures proper remediation of cyber risks related to hosting and cloud computing and the protection of the organization's assets hosted on the cloud or processed and managed by third parties.

  1 control

Need help putting this into practice? See our NCA CSCC compliance services.