Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) 2-13-1

Requirement

[A: M | B: M] Requirements for cybersecurity incident and threat management must be defined, documented and approved, covering at minimum:

Sub-Controls

2-13-1-1

Requirement: [A: M | B: R] Developing detailed response plans for cybersecurity incidents (e.g., data breach, ransomware) and the related escalation mechanisms.

2-13-1-2

Requirement: [A: M | B: M] Notifying the NCA upon occurrence of a cybersecurity incident.

2-13-1-3

Requirement: [A: M | B: M] Sharing cybersecurity information with the NCA.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo