Back to Frameworks
NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability)
International (NATO — 32 members)
v2024
4 domains
13 controls
NATO's cyber defence framework includes the NATO Cyber Defence Policy (2014, updated 2021), the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) Tallinn Manual, and the NATO Computer Incident Response Capability (NCIRC). Key documents include: NATO Communications and Information Agency (NCIA) security standards, AC/322 Information Assurance series, Cyber Defence Pledge (2016), and the 2021 Comprehensive Cyber Defence Policy recognising cyberspace as an operational domain. NATO nations committed to the Cyber Defence Pledge at the 2016 Warsaw Summit, with enhanced commitments at the 2023 Vilnius Summit including the Virtual Cyber Incident Support Capability (VCISC).
Verified
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Cyber Defence Integration
3 controls
| Code | Title |
|---|---|
| NCIRC-4.1 | Collective Defence Integration |
| NCIRC-4.2 | Cyberspace as Operational Domain |
| NCIRC-4.3 | Cyber Defence Exercises |
Cyber Defence Policy and Governance
3 controls
| Code | Title |
|---|---|
| NCIRC-1.1 | Cyber Defence Policy |
| NCIRC-1.2 | Cyber Defence Committee Governance |
| NCIRC-1.3 | NC3 Board Technical Oversight |
NCIRC Operations
4 controls
| Code | Title |
|---|---|
| NCIRC-2.1 | Centralised Cyber Defence Support |
| NCIRC-2.2 | Incident Handling and Reporting |
| NCIRC-2.3 | Rapid Reaction Teams |
| NCIRC-2.4 | Threat Intelligence Sharing |
National Cyber Defence Capabilities
3 controls
| Code | Title |
|---|---|
| NCIRC-3.1 | National Cyber Defence Development |
| NCIRC-3.2 | Cyber Defence Pledge Compliance |
| NCIRC-3.3 | CCDCOE Standards Development |
Maps to 153 other frameworks
13 total controls
HKMA Cyber Resilience Assessment Framework (C-RAF)
2 source controls mapped|3 target controls covered
15%
BS 65000:2014 — Guidance on Organizational Resilience
2 source controls mapped|4 target controls covered
15%
FFIEC Cybersecurity Assessment Tool (CAT)
2 source controls mapped|4 target controls covered
15%
ILO Nursing Personnel Convention C149 (1977)
2 source controls mapped|3 target controls covered
15%
EU Anti-Money Laundering Directive (AMLD6 / Directive 2018/1673)
2 source controls mapped|3 target controls covered
15%
ISO 8000 — Data Quality
2 source controls mapped|3 target controls covered
15%
FATF Recommendation 16 — Virtual Asset Travel Rule
2 source controls mapped|3 target controls covered
15%
Privacy by Design (PbD) — Seven Foundational Principles
2 source controls mapped|3 target controls covered
15%
ISO 27001:2022
2 source controls mapped|2 target controls covered
15%
Bermuda Monetary Authority (BMA) Cyber Risk Management Code of Conduct
2 source controls mapped|2 target controls covered
15%
NIST Cybersecurity Framework 2.0
2 source controls mapped|5 target controls covered
15%
O-RAN Alliance Security Specifications (O-RAN.WG11)
2 source controls mapped|2 target controls covered
15%
ECB TIBER-EU Framework
2 source controls mapped|4 target controls covered
15%
FTC Safeguards Rule (16 CFR Part 314)
1 source controls mapped|2 target controls covered
8%
ASD Strategies to Mitigate Cyber Security Incidents
1 source controls mapped|1 target controls covered
8%
CFTC System Safeguards (17 CFR 37, 38, 39, 49)
1 source controls mapped|3 target controls covered
8%
EU Taxonomy Regulation
1 source controls mapped|2 target controls covered
8%
GLBA
1 source controls mapped|3 target controls covered
8%
IEEE 7000
1 source controls mapped|1 target controls covered
8%
HKMA SPM
1 source controls mapped|3 target controls covered
8%
EU AI Act
1 source controls mapped|1 target controls covered
8%
CDP Corporate Questionnaire
1 source controls mapped|2 target controls covered
8%
FFIEC IT Examination Handbook
1 source controls mapped|3 target controls covered
8%
COSO Internal Control — Integrated Framework (2013)
1 source controls mapped|1 target controls covered
8%
ASEAN Data Management Framework
1 source controls mapped|1 target controls covered
8%
Voluntary Principles on Security and Human Rights (VPs)
1 source controls mapped|1 target controls covered
8%
US OFAC Sanctions Compliance Framework
1 source controls mapped|1 target controls covered
8%
EU Cyber Resilience Act
1 source controls mapped|3 target controls covered
8%
GLI-33 — Gaming Laboratories International Event Wagering Systems
1 source controls mapped|2 target controls covered
8%
EIOPA Guidelines on ICT Security and Governance (2020)
1 source controls mapped|2 target controls covered
8%
TISAX — Trusted Information Security Assessment Exchange
1 source controls mapped|2 target controls covered
8%
Telecommunications Sector Security Reforms (TSSR)
1 source controls mapped|2 target controls covered
8%
Defence Security Principles Framework (DSPF)
1 source controls mapped|2 target controls covered
8%
Protective Security Policy Framework (PSPF) Release 2024
1 source controls mapped|2 target controls covered
8%
DORA
1 source controls mapped|3 target controls covered
8%
Notifiable Data Breaches Scheme (Australia)
1 source controls mapped|2 target controls covered
8%
EU Digital Markets Act
1 source controls mapped|2 target controls covered
8%
FTC Health Breach Notification Rule
1 source controls mapped|2 target controls covered
8%
UK Product Security and Telecommunications Infrastructure Act (PSTI)
1 source controls mapped|2 target controls covered
8%
EAR — Export Administration Regulations
1 source controls mapped|2 target controls covered
8%
European Accessibility Act (Directive (EU) 2019/882)
1 source controls mapped|2 target controls covered
8%
EU Deforestation-Free Products Regulation (EUDR)
1 source controls mapped|2 target controls covered
8%
Ontario Accessibility for Ontarians with Disabilities Act (AODA) — IASR Web Standard
1 source controls mapped|2 target controls covered
8%
EU NIS2 Directive — Energy Sector Cybersecurity Requirements (Directive 2022/2555)
1 source controls mapped|2 target controls covered
8%
US ITAR and EAR — Export Control and Data Security
1 source controls mapped|2 target controls covered
8%
US SEC Digital Assets and Crypto Regulatory Framework
1 source controls mapped|2 target controls covered
8%
Australia Consumer Data Right — Banking (CDR)
1 source controls mapped|2 target controls covered
8%
Australia eSafety Commissioner — Online Safety Expectations for Industry
1 source controls mapped|2 target controls covered
8%
CSA CCM v4
1 source controls mapped|3 target controls covered
8%
MTCS — Multi-Tier Cloud Security (Singapore)
1 source controls mapped|1 target controls covered
8%
ISO/IEC 38500:2024 — Governance of IT
1 source controls mapped|1 target controls covered
8%
ITIL 4
1 source controls mapped|1 target controls covered
8%
ISO 42001
1 source controls mapped|1 target controls covered
8%
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)
1 source controls mapped|1 target controls covered
8%
MAS TRM
1 source controls mapped|3 target controls covered
8%
BCBS 239
1 source controls mapped|3 target controls covered
8%
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)
1 source controls mapped|1 target controls covered
8%
WELL Building Standard v2 (International WELL Building Institute)
1 source controls mapped|1 target controls covered
8%
Critical Infrastructure Risk Management Program (CIRMP) Rules 2023
1 source controls mapped|2 target controls covered
8%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
1 source controls mapped|3 target controls covered
8%
COBIT 2019
1 source controls mapped|1 target controls covered
8%
ASIS SPC.1-2009 — Organizational Resilience Standard
1 source controls mapped|3 target controls covered
8%
ISO/IEC 27007:2020
1 source controls mapped|1 target controls covered
8%
US EPA Safe Drinking Water Act (SDWA) — Cybersecurity Requirements
1 source controls mapped|3 target controls covered
8%
South Korea Cloud Security Assurance Program (CSAP)
1 source controls mapped|1 target controls covered
8%
Japan AI Guidelines
1 source controls mapped|1 target controls covered
8%
APRA CPS 234
1 source controls mapped|3 target controls covered
8%
UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities
1 source controls mapped|1 target controls covered
8%
IEC 62351 — Power Systems Communication Security
1 source controls mapped|2 target controls covered
8%
ISO/IEC 27031:2011
1 source controls mapped|2 target controls covered
8%
ISO/IEC 25012:2008 — Data Quality Model
1 source controls mapped|1 target controls covered
8%
ISO 20000-1
1 source controls mapped|1 target controls covered
8%
FDA Quality Management System Regulation (QMSR)
1 source controls mapped|1 target controls covered
8%
NATO AQAP 2110 — Quality Assurance Requirements for Design, Development, and Production
1 source controls mapped|1 target controls covered
8%
Digital Economy Partnership Agreement (DEPA)
1 source controls mapped|1 target controls covered
8%
Brazil AI Framework
1 source controls mapped|1 target controls covered
8%
TNFD Recommendations
1 source controls mapped|3 target controls covered
8%
AASB S2 Climate-related Disclosures
1 source controls mapped|3 target controls covered
8%
China AI Regulations
1 source controls mapped|1 target controls covered
8%
IRM Enterprise Risk Management Framework (Institute of Risk Management)
1 source controls mapped|3 target controls covered
8%
EU Maritime Single Window Environment Regulation (EU 2019/1239) and EMSA Cybersecurity
1 source controls mapped|1 target controls covered
8%
CISA ICS-CERT Advisories and Industrial Control Systems Security Guidelines
1 source controls mapped|1 target controls covered
8%
ASIC Cyber Resilience Good Practices
1 source controls mapped|1 target controls covered
8%
FTC GLBA Safeguards Rule (16 CFR Part 314)
1 source controls mapped|1 target controls covered
8%
Nevada Gaming Control Board Cybersecurity Requirements
1 source controls mapped|1 target controls covered
8%
Lloyd's Minimum Standards — Cyber Security
1 source controls mapped|1 target controls covered
8%
Australia AI Ethics Framework
1 source controls mapped|1 target controls covered
8%
EU Taxonomy Regulation (Regulation 2020/852)
1 source controls mapped|1 target controls covered
8%
India CERT-In Cyber Security Directions 2022
1 source controls mapped|1 target controls covered
8%
Security of Critical Infrastructure Act 2018 (SOCI)
1 source controls mapped|2 target controls covered
8%
PCI PIN Security
1 source controls mapped|3 target controls covered
8%
ITU-T X.805 — Security Architecture for End-to-End Communications
1 source controls mapped|1 target controls covered
8%
SWIFT CSCF
1 source controls mapped|3 target controls covered
8%
PCI SSF
1 source controls mapped|3 target controls covered
8%
UK Security and Emergency Measures Direction (SEMD) — Water Industry
1 source controls mapped|2 target controls covered
8%
UK FCA/PRA Operational Resilience Framework
1 source controls mapped|3 target controls covered
8%
SOC for Cybersecurity — Cybersecurity Risk Management Examination
1 source controls mapped|1 target controls covered
8%
SASB Standards (ISSB Integrated)
1 source controls mapped|1 target controls covered
8%
SASB Standards
1 source controls mapped|1 target controls covered
8%
AICPA SOC 1
1 source controls mapped|3 target controls covered
8%
SWIFT CSP
1 source controls mapped|3 target controls covered
8%
OSFI B-13
1 source controls mapped|3 target controls covered
8%
NIST Privacy Framework Version 1.0
1 source controls mapped|2 target controls covered
8%
PCI P2PE
1 source controls mapped|3 target controls covered
8%
ECB TIBER-EU
1 source controls mapped|3 target controls covered
8%
TEFCA — Trusted Exchange Framework and Common Agreement
1 source controls mapped|1 target controls covered
8%
PSD2 SCA
1 source controls mapped|3 target controls covered
8%
DAMA-DMBOK2 — Data Management Body of Knowledge (2nd Edition)
1 source controls mapped|1 target controls covered
8%
Open Banking Security
1 source controls mapped|3 target controls covered
8%
SSAE 18 — Attestation Standards (SOC Reporting)
1 source controls mapped|1 target controls covered
8%
NIST SP 800-82 Rev 3 — Guide to OT Security
1 source controls mapped|2 target controls covered
8%
UK AI Regulation Framework
1 source controls mapped|1 target controls covered
8%
NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
1 source controls mapped|2 target controls covered
8%
Singapore AI Governance Framework
1 source controls mapped|1 target controls covered
8%
NIST Privacy Framework 1.0
1 source controls mapped|1 target controls covered
8%
Right to Disconnect (Australia)
1 source controls mapped|1 target controls covered
8%
UK Open Banking Standard
1 source controls mapped|2 target controls covered
8%
AICPA SOC 3
1 source controls mapped|3 target controls covered
8%
SEC Climate Disclosure Rule
1 source controls mapped|1 target controls covered
8%
SOC 2
1 source controls mapped|3 target controls covered
8%
OECD AI Principles
1 source controls mapped|1 target controls covered
8%
South Africa Promotion of Access to Information Act (PAIA)
1 source controls mapped|1 target controls covered
8%
NIST SP 800-53A
1 source controls mapped|1 target controls covered
8%
CSA STAR (Security, Trust, Assurance, and Risk)
1 source controls mapped|1 target controls covered
8%
Australian Energy Sector Cyber Security Framework (AESCSF)
1 source controls mapped|1 target controls covered
8%
OWASP Top 10:2025
1 source controls mapped|1 target controls covered
8%
Ghana Cybersecurity Act
1 source controls mapped|1 target controls covered
8%
NIST SP 800-172
1 source controls mapped|1 target controls covered
8%
Spain ENS
1 source controls mapped|1 target controls covered
8%
IAEA Nuclear Security Series — Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
1 source controls mapped|1 target controls covered
8%
FISMA
1 source controls mapped|1 target controls covered
8%
Japan FSA Cybersecurity Guidelines for Financial Institutions
1 source controls mapped|2 target controls covered
8%
CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)
1 source controls mapped|1 target controls covered
8%
ISO/IEC 27011:2024
1 source controls mapped|1 target controls covered
8%
BSI IT-Grundschutz
1 source controls mapped|1 target controls covered
8%
OWASP DevSecOps Maturity Model (DSOMM)
1 source controls mapped|1 target controls covered
8%
CMMC 2.0
1 source controls mapped|1 target controls covered
8%
NIST SP 800-171
1 source controls mapped|1 target controls covered
8%
DoD Zero Trust Reference Architecture
1 source controls mapped|1 target controls covered
8%
CISA Secure by Design Principles
1 source controls mapped|1 target controls covered
8%
Belgium CyberFundamentals
1 source controls mapped|1 target controls covered
8%
ISO/IEC 27400:2022
1 source controls mapped|1 target controls covered
8%
Saudi NCA ECC
1 source controls mapped|1 target controls covered
8%
CISA Zero Trust Maturity Model
1 source controls mapped|1 target controls covered
8%
Cyber Essentials Plus
1 source controls mapped|1 target controls covered
8%
ANSSI Cybersecurity Framework
1 source controls mapped|1 target controls covered
8%
Space ISAC (Information Sharing and Analysis Center) — Threat Framework
1 source controls mapped|1 target controls covered
8%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
1 source controls mapped|1 target controls covered
8%
US NRC 10 CFR 73.54 — Cyber Security for Nuclear Power Plants
1 source controls mapped|1 target controls covered
8%
FAA Cybersecurity Framework for Aviation
1 source controls mapped|1 target controls covered
8%
Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)
1 source controls mapped|1 target controls covered
8%
RBI Cybersecurity Framework for Banks
1 source controls mapped|1 target controls covered
8%
Kuwait National Cybersecurity Framework
1 source controls mapped|1 target controls covered
8%
Frequently Asked Questions
What is NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability)?
NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) is a compliance framework from International (NATO — 32 members) with 4 domains and 13 controls. NATO's cyber defence framework includes the NATO Cyber Defence Policy (2014, updated 2021), the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) Tallinn Manual, and the NATO Computer Incident Response Capability (NCIRC). Key documents include: NATO Communications and Information Agency (NCIA) security standards, AC/322 Information Assurance series, Cyber Defence Pledge (2016), and the 2021 Comprehensive Cyber Defence Policy recognising cyberspace as an operational domain. NATO nations committed to the Cyber Defence Pledge at the 2016 Warsaw Summit, with enhanced commitments at the 2023 Vilnius Summit including the Virtual Cyber Incident Support Capability (VCISC). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) have?
NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) has 13 controls organised across 4 domains. The largest domains are NCIRC Operations (4 controls), Cyber Defence Integration (3 controls), Cyber Defence Policy and Governance (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) map to?
NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) maps to 153 other compliance frameworks. The top mapping partners are HKMA Cyber Resilience Assessment Framework (C-RAF) (15% coverage), BS 65000:2014 — Guidance on Organizational Resilience (15% coverage), FFIEC Cybersecurity Assessment Tool (CAT) (15% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) compliance?
Start your NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NATO Cyber Defence Standards and NCIRC (NATO Computer Incident Response Capability) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 13 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 692 frameworks.
Get Started Free →Free forever — no credit card required