Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) Penetration Testing

Assess the effectiveness of the entity's defenses by simulating real attack techniques to uncover unknown weaknesses in the technical infrastructure.

2-11-1

[A: M | B: R] Cybersecurity requirements for penetration testing must be defined, documented and approved, and at minimum the penetration-test scope must include all externally provided services (via the Internet) and their technical components — including infrastructure, websites, web applications, mobile applications, email and remote access.
2-11-2

[A: M | B: R] Those requirements must be implemented.
2-11-3

[A: M | B: R] Those requirements must be reviewed periodically.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.