Skip to content

Non-CNI Private Sector Entities Cybersecurity Controls (NCNICC – 1 : 2025) Third-Party Cybersecurity

Protect the entity's assets from third-party cybersecurity risks, including IT outsourcing and managed services.

3-1-1

[A: M | B: R] Cybersecurity requirements must be defined, documented and approved within the entity's contracts and agreements with third parties (e.g., Service Level Agreements, SLA), containing at minimum:
3-1-2

[A: M | B: R] Those requirements must be implemented.
3-1-3

[A: M | B: R] Those requirements must be reviewed periodically.

Need help putting this into practice? See our NCA NCNICC compliance services.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.