Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
NCM ICT Security Principles is a framework for ICT security published and maintained by the Norwegian National Security Authority (NSM). The security principles advice businesses and organisations on how to protect their information systems from unauthorized access, damage or misuse.
NCM ICT Security Principles is a framework for ICT security published and maintained by the Norwegian National Security Authority (NSM). The security principles advise businesses and organisations on how to protect their information systems from unauthorized access, damage or misuse.
The principles focus on technological and organisational measures. Measures concerning physical security and the human perspective are generally not covered. The measures apply to both unintentional and intentional acts, although the main focus is on intentional acts.
In this framework there are 21 security principles with a total of 118 security measures, distributed across four categories: i) identify, ii) protect and maintain, iii) detect and iv) respond and recover.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Verify the sender address of incoming emails (detect spoofing). Do so by using DMARC, DKIM, SPF and DNSSEC.
Activate STARTTLS on the organisation’s email server to authenticate and ensure the confidentiality of all emails between the organisation and other organisations that have activated STARTTLS.
Only use supported email clients, browsers and plugins. Only use the latest version with the latest security functions and the latest security updates. Uninstall/deactivate browsers which were included with the operating system but are no longer supported.
Only permit organisation-approved plugins. For many organisations, necessary plugins will only be those that integrate email readers and browsers with e.g. CRM-systems and archiving systems. A plugin not needed for the organisation’s activities can represent a vulnerability and should therefore not be permitted (i.e. use allowlisting of application plugins).
Plan for regular backups of all the organisation’s data. As a minimum, the plan should describe: a) Which data should be backed up. b) Frequency of backups of various data, based on value. c) Responsibility for backing up various data. d) Procedures for failed backups. e) How long to store backups. f) Logical and physical criteria for backup security. g) Criteria for how long it should take to restore the organisation’s systems and data (see principle 4.1 – “Prepare the organisation for incident”). h) The roles responsible for approving the plan.
Include backups of software to ensure recovery. This includes (as a minimum) a) security configuration, cf. 2.3 – “Maintain secure configuration”, b) templates for virtual machines and master images of operating systems, and c) installation software.
Test backups regularly and verify that the backup is correct and restorable.
Protect backups against intentional and unintentional deletion, manipulation and reading. a) Backup copies should be kept separate from the organisation’s production environment. See e.g. principle 2.1 – “Maintain security during procurement and development processes”. b) Access rights to backup copies should be restricted to only employees and system processes involved in restoring data. c) Offline backups which are inaccessible through the organisation’s networks should be created regularly. This is in order to prevent intentional/unintentional deletion and manipulation. d) Backups should be protected with encryption when being stored or moved over the network. This includes external security backups and cloud services.
Include security in the organisation’s change management process. The process for change management should include: a) Considering change proposals to identify their effect on established security measures, e.g. the measures described in the security principles. b) Requirements for testing of changes before and after deployment, see principle 2.1 – “Maintain security during procurement and development processes”. c) Informing and involving parties affected by the change. d) Documenting assessments, recommendations, decisions and reviews/tests relevant to the secure state.
Involve necessary ICT security staff when making changes. This could involve general and technical assessments and reviews, testing, approval/signatures or notification.
Test affected security functions both before and after deployment in order to maintain secure state.
Integrate security into the organisation’s urgent change processes. Stipulate minimum requirements for staff involvement, security assessments, testing and documentation before and after deployment, see 2.10.1 – 2.10.3.
Conduct regular vulnerability assessments in the information system using automated tools. The assessment should cover clients, servers and networks. a) Rank the findings according to priority and verify that any detected vulnerabilities are dealt with. b) Ensure that the tools used for vulnerability assessments are updated regularly with information about all relevant security vulnerabilities.
Subscribe to vulnerability intelligence services to keep up to date with new and expected vulnerabilities. Use this information as input for vulnerability assessment tools.
Use automated and centralised tools to handle known threats (such as malware). a) Use antivirus/antimalware products, ideally a centrally managed solution, to detect and block known malware that can exploit vulnerabilities in email clients and document readers etc. b) Also use IDS/IPS functionality on clients and servers. c) Incidents from these tools should be logged, see principle 3.2 – Establish security monitoring.
Determine a strategy and guidelines for security monitoring. The following should be described: a) Purpose and usage of collected data. b) Which data to collect. c) Secure storage of data (including storage and processing of data related to legal processes). d) Capacity planning for collected data. e) Access control of collected data. f) Collation of logs from the organisation’s different devices and services. g) Deletion of data. h) Audit frequency for the strategy (at least once a year and on particular occasions, e.g. after a major event such as a cyberattack).
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.