Please enable JavaScript.
Coggle requires JavaScript to display documents.
🏛️ 5️⃣ NCA ECC DOMAIN 5 — CYBERSECURITY GOVERNANCE - Coggle Diagram
🏛️ 5️⃣ NCA ECC DOMAIN 5 — CYBERSECURITY GOVERNANCE
5.1️⃣ Cybersecurity Strategy & Planning 📜
5.1.1 Cybersecurity Strategy Development 🎯
Define cybersecurity vision
Align cybersecurity with business objectives
Identify security priorities
Define security roadmap
Establish cybersecurity goals
5.1.2 Cybersecurity Program Management 🏢
Security initiatives
Project planning
Resource allocation
Budget management
Performance tracking
5.1.3 Strategy Review 🔄
Periodic review
Threat landscape updates
Business changes
Continuous improvement
5.2️⃣ Cybersecurity Policies & Procedures 📑
5.2.1 Security Policy Framework 📘
Information Security Policy
Access Control Policy
Password Policy
Data Protection Policy
Incident Response Policy
Acceptable Use Policy
5.2.2 Procedure Management ⚙️
Define security procedures
Document workflows
Assign responsibilities
Maintain documentation
5.2.3 Policy Review 🔍
Regular updates
Compliance checking
Business alignment
Approval process
5.3️⃣ Cybersecurity Organization 👥
5.3.1 Leadership Structure 🏢
Board of Directors
Executive Management
Chief Information Security Officer (CISO)
Security Committee
5.3.2 Security Roles & Responsibilities 👤
SOC Analysts
Security Engineers
System Administrators
Network Engineers
Risk Managers
Incident Response Team
5.3.3 Separation of Duties 🔀
Approval separation
Administration separation
Monitoring separation
Audit independence
5.4️⃣ Cybersecurity Risk Management ⚠️
5.4.1 Risk Identification 🔎
Asset identification
Threat identification
Vulnerability identification
Business impact analysis
5.4.2 Risk Assessment 📊
Likelihood analysis
Impact analysis
Risk scoring
Risk prioritization
5.4.3 Risk Treatment 🛡️
Risk Mitigation
Risk Acceptance
Risk Transfer
Risk Avoidance
5.4.4 Risk Monitoring 📈
Risk register
Security metrics
Risk reporting
Continuous monitoring
5.5️⃣ Cybersecurity Compliance & Audit 📋
5.5.1 Compliance Management ✅
NCA ECC Compliance
ISO 27001
NIST CSF
IEC 62443
Regulatory Requirements
5.5.2 Security Auditing 🔍
Internal Audit
External Audit
Control Testing
Evidence Collection
5.5.3 Compliance Reporting 📊
Audit Reports
Compliance Status
Findings
Remediation Tracking
5.6️⃣ Cybersecurity Metrics & Performance 📈
Security KPIs
Incident Count
Patch Compliance
Vulnerability Closure Rate
Detection Time
Security Monitoring Metrics
Mean Time To Detect (MTTD)
Mean Time To Respond (MTTR)
Alert Accuracy
Threat Detection Rate
Management Reporting
Executive Dashboards
Risk Reports
Security Posture
Improvement Plans
5.7️⃣ Cybersecurity Awareness & Training 🎓
Employee Awareness
Phishing Awareness
Password Security
Data Protection
Social Engineering
Technical Training
SOC Training
Secure Coding
Incident Response
Security Operations
Awareness Measurement
Training Completion
Phishing Tests
Knowledge Assessment
🎯 NCA ECC Domain 5 Implementation Lifecycle
1️⃣ Establish Cybersecurity Governance 🏛️
2️⃣ Create Policies & Procedures 📑
3️⃣ Assign Roles & Responsibilities 👥
4️⃣ Manage Cybersecurity Risks ⚠️
5️⃣ Measure Security Performance 📊
6️⃣ Audit Compliance ✅
7️⃣ Improve Cybersecurity Program 🔄