NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC)
The NATO cyber defence framework is defined by the NATO Cyber Defence Policy (original 2014, updated 2021) and operationalised through the NATO Computer Incident Response Capability (NCIRC) managed by the NATO Communications and Information Agency (NCI Agency). The CCDCOE provides research and the Tallinn Manual on the International Law Applicable to Cyber Operations, but these are not NATO policy documents. Key references: NATO Cyber Defence Policy (2021), NCIRC Handbook (2022), NCI Agency publications.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Classified Systems
| Code | Title |
|---|---|
| NATO-NCIRC-3 | Classified Network Segregation and Cryptographic Material Handling |
Cyber Defence Policy
| Code | Title |
|---|---|
| NATO-NCIRC-1 | NATO Cyber Defence Policy Alignment and Summit Declarations |
Incident Response
| Code | Title |
|---|---|
| NATO-NCIRC-5 | Incident Triage, Response, and Rapid Reaction Teams |
NCIRC Operations
| Code | Title |
|---|---|
| NATO-NCIRC-2 | NCIRC Technical Centre Operations + NCI Agency Implementation |
Personnel and Exercises
| Code | Title |
|---|---|
| NATO-NCIRC-7 | Personnel Security Clearances and Cyber Exercises |
Strategic Cyber Defence
| Code | Title |
|---|---|
| NATO-NCIRC-8 | Cyberspace as Operational Domain + Cyber Defence Pledge + Annual Self-Assessment |
Technical Controls
| Code | Title |
|---|---|
| NATO-NCIRC-6 | Vulnerability Management, Configuration Baselines, and Supply Chain Risk |
Threat Intelligence
| Code | Title |
|---|---|
| NATO-NCIRC-4 | Cyber Threat Intelligence Sharing and Coordinated Vulnerability Disclosure |
Your Compliance Coverage
If you comply with NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC), you already cover:
FFIEC Cybersecurity Assessment Tool (CAT)
25%
2 controls mapped
Compare →ISO/IEC 27031:2011
13%
1 controls mapped
Compare →South Korea Cloud Security Assurance Program (CSAP)
13%
1 controls mapped
Compare →+ 22 more: Protective Security Policy Framework (PSPF) Release 2024 (13%), Nevada Gaming Control Board Cybersecurity Requirements (13%)
See all 25 mapped frameworks ↓Maps to 25 other frameworks
Frequently Asked Questions
What is NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC)?
NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) is a compliance framework from International (NATO — 32 members) with 8 domains and 8 controls. The NATO cyber defence framework is defined by the NATO Cyber Defence Policy (original 2014, updated 2021) and operationalised through the NATO Computer Incident Response Capability (NCIRC) managed by the NATO Communications and Information Agency (NCI Agency). The CCDCOE provides research and the Tallinn Manual on the International Law Applicable to Cyber Operations, but these are not NATO policy documents. Key references: NATO Cyber Defence Policy (2021), NCIRC Handbook (2022), NCI Agency publications. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) have?
NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) has 8 controls organised across 8 domains. The largest domains are Classified Systems (1 controls), Cyber Defence Policy (1 controls), Incident Response (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) map to?
NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) maps to 25 other compliance frameworks. The top mapping partners are FFIEC Cybersecurity Assessment Tool (CAT) (25% coverage), ISO/IEC 27031:2011 (13% coverage), South Korea Cloud Security Assurance Program (CSAP) (13% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) compliance?
Start your NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 8 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.
Get Started Free →Free forever — no credit card required