NCA Essential Cybersecurity Controls, ECC-2:2024. Experimental

The convoy holds all 176 requirements of ECC-2:2024, across its four domains and 28 subdomains, under NCA's own identifiers, with a short description of what each asks written by Mamluk; NCA's text is not reproduced, and the authoritative wording remains NCA's publication. Each requirement is classed by how its evidence is obtained:

• Enforced (7). An admission policy of the convoy flags, and once you choose blocks, what the requirement forbids: software only from trusted sources (1-6-3-2), asset classification labels (2-1-5), network segmentation and the separation of production from test and development (2-5-3-1, 2-5-3-2), restricted network services (2-5-3-5), and secure protocols for external web applications (2-15-2, 2-15-3-3). The report shows the policy's result for every object it applies to.
• Checked (14). The convoy observes the requirement in the cluster and reports it: vulnerability assessment, classification by severity and remediation (2-10), patching (2-3-3-3), least privilege, privileged access and access review (2-2-3-3 to 2-2-3-5), the asset inventory (2-1-2), the network security requirements in effect (2-5-2), and vulnerabilities and secure configuration reviewed before launch (1-6-2-1, 1-6-2-2, 1-6-3-5).
• Platform (13). The platform provides the control and the convoy reports it: identity and authentication for access to the cluster (2-2-2 to 2-2-3-2), the protection of the systems themselves (2-3-2), a trusted time source (2-3-3-4), encryption in transit, the encryption of Kubernetes Secrets at rest and the key that protects them (2-8), and audit logging, including privileged access, kept for the twelve months 2-12-3-5 requires (2-12). BKE declares these facts from 2.3.0; on earlier BKE versions and on other distributions, these requirements are reported as not evidenced by the cluster, and the report asks for your evidence of them.
• Your evidence (142). Strategy, governance, risk, awareness, human resources, physical security, the protection of data by its classification, resilience and third parties are your organisation's to evidence. The report lists each one as customer evidence, so the record of the regime is complete and nothing is presented as covered that is not.

Thirty-three of the 34 technical requirements are partly technical: the cluster evidences its own part, and the report also asks for your evidence of the rest, for example the documented procedure behind a vulnerability management requirement. Where a regime sets a threshold, the convoy uses the regime's value: ECC's twelve months of event log retention is the value the audit log rotation check is judged against.

Each requirement is mapped to the NIST SP 800-53 Rev. 5 controls it corresponds to, and each NIST control to the checks that evidence it in the cluster. The checks and their NIST mapping are shared by every regime, so a cluster is scanned once and each regime selected is reported from the same evidence, in its regulator's own numbering.

NCA's requirements are mapped to NIST by Mamluk, requirement by requirement; the mapping and the classes on this page are Mamluk's reading of ECC-2:2024, and the authoritative wording remains NCA's publication.

The mapping is Mamluk's, and the report says so. It records the technical evidence the cluster provides; it does not make an organisation compliant, and compliance is determined by your assessor.