NCA ECC’s 4 Domains and 108 Controls Explained

1. Cybersecurity Governance

Strategy, roles, risk management, compliance oversight, and the management system that makes technical controls attributable. Expect policies, ownership charts, risk registers, and periodic review evidence.

2. Cybersecurity Defense

The technical core. Subdomains commonly referenced in programmes include:

• 2-1 Asset Management
• 2-2 Identity and Access Management
• 2-3 Information System and Information Processing Facilities Protection
• 2-4 Email Protection
• 2-5 Networks Security Management
• 2-6 Mobile Devices Security
• 2-7 Data and Information Protection
• 2-8 Cryptography
• 2-9 Backup and Recovery Management
• 2-10 Vulnerabilities Management
• 2-11 Penetration Testing
• 2-12 Cybersecurity Event Logs and Monitoring Management
• 2-13 Cybersecurity Incident and Threat Management
• 2-14 Physical Security
• 2-15 Web Application Security

Many subdomains follow a define–implement–minimums–review control pattern — useful for structuring evidence packs.

3. Cybersecurity Resilience

Continuity, recovery, and related resilience capabilities that keep essential services recoverable after disruption. Align BCM exercises and recovery evidence to this domain’s published subdomains.

4. Third-Party and Cloud Computing Cybersecurity

Supplier oversight and cloud computing cybersecurity — including tenant/provider responsibilities where cloud control sets also apply. See also NCA’s other control sets.

How CyberSilo Helps

• CSA indexes all four domains and tracks 108 main-control status
• ThreatHawk evidences 2-12 continuous monitoring and retention
• Gap workshops via contact

Related Resources

Self-assessment · 2-12 SIEM · CSCC

Frequently Asked Questions

How many domains does ECC-2:2024 have?

Four domains — not five. Cybersecurity Governance; Cybersecurity Defense; Cybersecurity Resilience; Third-Party and Cloud Computing Cybersecurity.

How many main controls are there?

108 main controls, plus 92 subcontrols, across 28 subdomains.

Where does logging sit?

Subdomain 2-12 under Cybersecurity Defense — Cybersecurity Event Logs and Monitoring Management.