Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) 2-14-1

Requirement

[A: M | B: M] Cybersecurity requirements for the physical security of the entity's information and technology assets must be defined, documented and approved, covering at minimum:

Sub-Controls

2-14-1-1

Requirement: [A: M | B: M] Protecting physical access to IT rooms and sensitive electronic devices.

2-14-1-2

Requirement: [A: M | B: R] Protecting physical access to the entity's information and technology assets (e.g., computers, storage media and printers) and documents.

2-14-1-3

Requirement: [A: M | B: M] Protecting surveillance-system (CCTV) records.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo