Essential Cybersecurity Controls (ECC – 2 : 2024) Periodical Cybersecurity Review And Audit
To ensure that cybersecurity controls are implemented and in compliance with organizational policies and procedures, as well as related national and international laws, regulations and agreements.
-
1-8-1
Cybersecurity reviews must be conducted periodically by the cybersecurity function in the organization to assess the compliance with the cybersecurity controls in the organization.
-
1-8-2
Cybersecurity audits and reviews must be conducted by independent parties outside the cybersecurity function (e.g., Internal Audit function) to assess the compliance with the cybersecurity controls in the organization. Audits and reviews must be conducted independently, while ensuring that this does not result in a conflict of interest, as per the Generally Accepted Auditing Standard controls (GAAS), and related laws and regulations.
-
1-8-3
Results from the cybersecurity audits and reviews must be documented and presented to the cybersecurity steering committee and Authorizing Official. Results must include the audit/review scope, observations, recommendations and remediation plans.
Need help putting this into practice? See our NCA ECC compliance services or read our NCA ECC articles.
See LakeRidge in action.
Talk with our team about your framework, your gaps, and the right plan.
Get a demo