Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) Handbook

• Cybersecurity Management

  Secure senior management's support for managing and implementing the entity's cybersecurity programs.

  3 controls

• Cybersecurity Policies and Procedures

  Document and communicate the entity's cybersecurity policies and ensure ongoing compliance with them.

  3 controls

• Cybersecurity Risk Management

  Manage cybersecurity risks methodically to protect the entity's information and technology assets.

  3 controls

• Periodic Cybersecurity Review and Audit

  Verify through independent audit and internal review that cybersecurity controls are implemented and operating per the entity's policies and the national and international requirements binding on it.

  2 controls

• Cybersecurity Awareness and Training Programs

  Give the entity's personnel the security awareness they need to know and carry out their cybersecurity responsibilities.

  3 controls

• Asset Management

  Maintain an accurate, up-to-date inventory of all information and technology assets to support operations and cybersecurity requirements.

  3 controls

• Identity and Access Management

  Protect logical access to the entity's information and technology assets by preventing unauthorized access and restricting access to business need.

  3 controls

• Systems and Information-Processing Devices Protection

  Protect systems and information-processing devices, including user devices, servers and network devices, from cyber risks.

  3 controls

• Email Protection

  Protect the entity's email service from cybersecurity risks.

  3 controls

• Networks Security Management

  Protect the entity's networks from cybersecurity risks.

  3 controls

• Mobile Devices Security

  Protect the entity's mobile devices and, where BYOD is permitted, keep sensitive business information secure on personal devices in transit and storage.

  3 controls

• Data and Information Protection

  Ensure the confidentiality, integrity, accuracy and availability of the entity's data per its policies and the applicable legislative and regulatory requirements.

  3 controls

• Cryptography

  Ensure the proper and effective use of cryptography to protect the entity's technology assets.

  3 controls

• Backup and Recovery Management

  Protect the entity's data, information and system configurations from unexpected damage caused by cyber risks through managed, tested backups.

  3 controls

• Vulnerability Management

  Detect technical vulnerabilities in time and remediate them effectively to prevent or reduce their exploitation in cyber attacks.

  3 controls

• Penetration Testing

  Assess the effectiveness of the entity's defenses by simulating real attack techniques to uncover unknown weaknesses in the technical infrastructure.

  3 controls

• Cybersecurity Event Logs and Monitoring Management

  Collect, analyze and monitor cybersecurity event logs in time for proactive detection or post-incident analysis of cyber attacks.

  3 controls

• Cybersecurity Incident and Threat Management

  Detect and identify cybersecurity incidents in time and manage and handle them effectively.

  3 controls

• Physical Security

  Protect the entity's information and technology assets against unauthorized physical access, loss, theft and sabotage.

  3 controls

• Web Application Protection

  Protect the entity's external web applications from cyber risks.

  3 controls

• Third-Party Cybersecurity

  Protect the entity's assets from third-party cybersecurity risks, including IT outsourcing and managed services.

  3 controls

• Cloud Computing and Hosting Cybersecurity

  Address cyber risks and implement cloud computing and hosting cybersecurity requirements so entity assets held with third-party providers stay protected.

  3 controls

Need help putting this into practice? See our NCA NCNICC compliance services.