Telework Cybersecurity Controls (TCC – 1 : 2021) Handbook

• Cybersecurity Policies and Procedures

  Ensures telework cybersecurity requirements are documented, communicated and complied with per related laws, regulations and organizational requirements.

  1 control

• Cybersecurity Risk Management

  Ensures cybersecurity risks to telework systems are managed methodologically to protect the organization's information and technology assets.

  1 control

• Cybersecurity Awareness and Training Program

  Ensures personnel are aware of their telework cybersecurity responsibilities and receive the training, skills and credentials needed to protect the organization's assets.

  2 controls

• Asset Management

  Ensures the organization keeps an accurate, detailed inventory of telework information and technology assets to support cybersecurity and operational requirements.

  1 control

• Identity and Access Management

  Ensures secure, restricted logical access to telework systems so that only authorized users gain the access necessary for their assigned tasks.

  2 controls

• Information System and Processing Facilities Protection

  Ensures information systems and information processing facilities, including workstations and infrastructure, are protected against cyber risks.

  1 control

• Network Security Management

  Ensures the organization's network is protected from cyber risks arising from telework.

  1 control

• Mobile Device Security

  Ensures mobile devices (laptops, smartphones, tablets) and BYOD usage are protected and the organization's information is handled securely during telework.

  1 control

• Data and Information Protection

  Ensures the confidentiality, integrity and availability of the organization's data and information per organizational policies and related laws and regulations.

  1 control

• Cryptography

  Ensures encryption is applied to telework network connections in line with the ECC cryptography requirements and the National Cryptography Standards.

  1 control

• Backup and Recovery Management

  Ensures the organization's data, information and system configurations are protected from cyber risks through planned backups and tested recovery.

  2 controls

• Vulnerabilities Management

  Ensures timely detection and effective remediation of technical vulnerabilities in telework systems to prevent or minimize their exploitation in cyber attacks.

  1 control

• Penetration Testing

  Assesses the organization's cybersecurity defense capabilities through simulated cyber-attacks that uncover unknown weaknesses in telework systems.

  2 controls

• Cybersecurity Events Logs and Monitoring Management

  Ensures timely collection, analysis and round-the-clock monitoring of telework cybersecurity event logs for early detection of potential cyber-attacks.

  2 controls

• Cybersecurity Incident and Threat Management

  Ensures timely identification, detection and effective handling of cybersecurity incidents and threats to prevent or minimize negative impacts on operations.

  1 control

• Cloud Computing and Hosting Cybersecurity

  Ensures cyber risks are remediated and cybersecurity requirements implemented for cloud computing and hosting services used in telework, protecting assets hosted on the cloud or handled by third parties.

  1 control

Need help putting this into practice? See our NCA TCC compliance services.