Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) 2-4-1

Requirement

[A: M | B: M] Cybersecurity requirements for protecting the entity's email must be defined, documented and approved, covering at minimum:

Sub-Controls

2-4-1-1

Requirement: [A: M | B: M] Analyzing and filtering email messages — especially phishing emails and spam — using modern email protection technologies and mechanisms.

2-4-1-2

Requirement: [A: M | B: M] Authenticating the entity's email domain via the Haseen platform, using SPF, DKIM and DMARC.

2-4-1-3

Requirement: [A: M | B: R] Protection against Advanced Persistent Threats (APT), which typically use previously unknown viruses and malware (zero-day malware), and managing this securely.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo