NCA CSCC vs ECC: What Critical-System Owners Must Add

What Critical-System Owners Must Add

• Formal critical-system identification and boundary documentation
• CSCC control implementation beyond ECC minimums where CSCC is more specific
• Stronger change, access, and monitoring discipline on critical paths
• Third-party and cloud controls tuned to critical-system exposure
• Evidence that ECC remains continuously compliant — not “replaced”

Practical Dual-Index Workflow

1. Complete ECC-2:2024 self-assessment for the entity.
2. Confirm CSCC applicability for critical systems.
3. Map overlapping controls once; flag CSCC-only gaps.
4. Prioritise remediation on critical-system blast radius.

How CyberSilo Helps

• CSA dual-indexes ECC and CSCC
• ThreatHawk monitoring for critical-system log sources
• Comparison workshops via contact

Related Resources

ECC self-assessment · ECC audit · Contact

Frequently Asked Questions

What must critical-system owners add beyond ECC?

CSCC’s additional main controls and subcontrols for critical environments — while keeping continuous ECC compliance.

Can we skip ECC if we only run critical systems?

No. Continuous ECC compliance is a prerequisite.

How should evidence be organised?

One evidence library with two indexes — ECC-2:2024 and CSCC-1:2019 — sharing artefacts where wording truly overlaps.