Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) 2-10-1

Requirement

[A: M | B: M] Cybersecurity requirements for technical vulnerability management must be defined, documented and approved, covering at minimum:

Sub-Controls

2-10-1-1

Requirement: [A: M | B: M] Regular update and patching of systems, software and devices (Patch Management).

2-10-1-2

Requirement: [A: M | B: R] Periodic vulnerability scanning and detection for all the entity's assets.

2-10-1-3

Requirement: [A: M | B: M] Periodic vulnerability scanning and detection for external applications.

2-10-1-4

Requirement: [A: M | B: M] Managing and remediating vulnerabilities based on their classification, including testing vulnerability fixes before deployment.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo