NCA CSCC Explained: Critical Systems Cybersecurity Controls

Why CSCC Exists

Critical systems concentrate national and organisational risk. CSCC adds control depth for those systems while expecting the ECC baseline to remain continuously met across the entity’s broader estate.

Programme Implications

• Maintain an accurate critical-system inventory and classification rationale
• Map CSCC controls as additive obligations, not replacements
• Expect stronger expectations around monitoring, change, and third-party access to critical environments
• Reuse ECC evidence where it truly satisfies CSCC wording — then close gaps explicitly

How CyberSilo Helps

• CSA indexes CSCC beside ECC so shared artefacts are not duplicated blindly
• ThreatHawk strengthens monitoring evidence for critical environments
• Scoping workshops to decide whether CSCC applies

Related Resources

ECC domains · Other NCA sets · Contact

Frequently Asked Questions

What are the CSCC locked counts?

NCA CSCC-1:2019: 4 domains, 21 subdomains, 32 main controls, and 73 subcontrols.

Must we still comply with ECC?

Yes. Continuous ECC compliance is a prerequisite for CSCC programmes.

Who typically needs CSCC?

Owners and operators of critical systems that meet NCA’s critical-system criteria — confirm against current NCA applicability guidance.