The National Cybersecurity Authority quietly tightened Control 5-1-1 in the first quarter of 2025, reducing the remediation window for critical vulnerabilities in internet-facing systems from sixty to thirty days. This change affects every NCA-regulated entity that operates web applications, API gateways, VPN concentrators, or any other service exposed to the public internet. The updated NCA ECC vulnerability management timeline now requires CISOs and vulnerability management leads to accelerate patch deployment cycles, document compensating controls more rigorously when vendor patches are unavailable, and maintain evidence in a format that satisfies NCA inspectors during the interim period.
This article explains which asset categories the new thirty-day clock applies to, the three acceptable compensating controls when patching is delayed, and the evidence format—network segmentation diagrams, web application firewall rule exports, and change-control tickets—that satisfies NCA inspectors during the interim period.
Which Asset Categories the Thirty-Day Clock Applies To
The updated Control 5-1-1 applies the thirty-day remediation window to internet-facing assets only. The NCA defines internet-facing assets as any system, application, or network device that accepts inbound connections from the public internet, regardless of whether the service is intended for customers, partners, or employees accessing corporate resources remotely.
The following asset categories fall under the thirty-day clock:
- Web applications and portals accessible via public IP addresses or domain names
- API gateways and RESTful services exposed to third-party integrators
- VPN concentrators and remote-access gateways
- Email gateways and mail transfer agents with public MX records
- DNS servers authoritative for public zones
- Load balancers and reverse proxies in the DMZ
- File-transfer services (SFTP, FTPS) with public endpoints
Internal systems—those accessible only from the corporate network or through a VPN—remain subject to the original sixty-day remediation window for critical vulnerabilities. The NCA distinguishes between these two categories because internet-facing assets present a materially higher risk of exploitation by external threat actors who can scan and probe them without needing to breach the perimeter first.
The thirty-day clock starts when the vendor publishes a patch or when the vulnerability is assigned a CVSS score of 9.0 or higher by the vendor or a recognized vulnerability database, whichever comes first. If your vulnerability scanner flags a critical finding on an internet-facing asset, the clock is already running.
The Three Acceptable Compensating Controls When Patching Is Delayed
The NCA recognizes that not every critical vulnerability can be patched within thirty days. Vendor patches may be delayed, custom applications may require extensive regression testing, or operational constraints may prevent immediate downtime. In these cases, the NCA accepts compensating controls that reduce the risk of exploitation during the interim period.
The three compensating controls that satisfy NCA inspectors are:
1. Network Segmentation with Access-Control Lists
Network segmentation isolates the vulnerable asset from the public internet or restricts access to a defined set of trusted IP addresses. This control is most effective when the vulnerable service does not need to be universally accessible.
To implement this control, you configure firewall rules or access-control lists (ACLs) that permit inbound connections only from known, trusted sources—such as partner networks, specific customer IP ranges, or your own monitoring infrastructure. The vulnerable asset remains technically exposed, but the attack surface is reduced to a manageable set of entities.
The evidence required for this compensating control includes:
- A network diagram showing the vulnerable asset, the firewall or ACL device, and the permitted source IP ranges
- Firewall rule exports or ACL configurations timestamped after the vulnerability disclosure date
- A change-control ticket documenting the segmentation change, the approver, and the rationale
The NCA expects the segmentation to remain in place until the patch is applied or until the vulnerability is otherwise remediated.
2. Web Application Firewall Virtual Patching
A web application firewall (WAF) can block exploitation attempts by inspecting HTTP and HTTPS traffic for known attack patterns associated with the vulnerability. This approach, known as virtual patching, is particularly effective for web applications and APIs where the vulnerability involves injection flaws, authentication bypasses, or remote code execution via HTTP requests.
To implement this control, you deploy a WAF rule that matches the attack signature published by the vendor, a threat-intelligence provider, or your own security team. The rule should block or log suspicious requests, and you should monitor WAF alerts to confirm that the rule is functioning as intended.
The evidence required for this compensating control includes:
- WAF rule exports showing the specific signature or pattern that blocks the exploit
- A configuration screenshot or API response timestamped after the vulnerability disclosure date
- A log sample demonstrating that the rule is active and blocking or alerting on suspicious traffic
- A change-control ticket documenting the rule deployment, the approver, and the rationale
The NCA expects the WAF rule to remain active until the patch is applied or until the vulnerability is otherwise remediated. If the WAF vendor provides a pre-built rule for the vulnerability, you should deploy it within five business days of its availability.
3. Service Deactivation or Removal from Production
If the vulnerable service is not business-critical, the most straightforward compensating control is to deactivate it or remove it from production entirely. This eliminates the risk of exploitation by removing the attack vector.
To implement this control, you shut down the vulnerable service, remove its DNS records, or redirect traffic to an alternative system that is not affected by the vulnerability. The service remains offline until the patch is applied or until a replacement system is deployed.
The evidence required for this compensating control includes:
- A change-control ticket documenting the service deactivation, the approver, and the rationale
- DNS query results or network scan outputs showing that the service is no longer reachable from the public internet
- A communication to stakeholders explaining the temporary unavailability and the expected remediation timeline
The NCA views service deactivation as the strongest compensating control because it eliminates the risk entirely, but it also expects you to restore the service within a reasonable timeframe once the patch is available.
The Evidence Format That Satisfies NCA Inspectors
The NCA does not prescribe a specific document format for compensating-control evidence, but inspectors consistently look for three elements: timestamp, approval, and technical proof.
Timestamp means that the evidence must show when the compensating control was implemented, and that date must fall within the thirty-day remediation window. If you deploy a WAF rule on day twenty-eight, the evidence must include a configuration export or log entry dated on or before day twenty-eight.
Approval means that the evidence must show that the compensating control was reviewed and approved by a change-control board, a senior IT manager, or a designated security authority. The NCA expects compensating controls to follow the same change-management process as any other infrastructure change.
Technical proof means that the evidence must demonstrate that the compensating control is actually in place and functioning as intended. A policy statement or a meeting minute is not sufficient. The NCA expects to see firewall rule exports, WAF logs, network diagrams, DNS query results, or other artifacts that prove the control is active.
A complete evidence package for a compensating control typically includes:
- A change-control ticket with the request date, the approver, the implementation date, and a description of the control
- A technical artifact (firewall rule export, WAF rule export, network diagram, DNS query result) timestamped after the vulnerability disclosure date
- A log sample or monitoring alert that confirms the control is functioning as intended
- A brief narrative explaining why the compensating control was necessary and when the patch will be applied
Store this evidence in your vulnerability management system, your GRC platform, or a dedicated folder structure that your internal audit team can access. The NCA may request this evidence during an on-site inspection, a remote audit, or as part of your annual self-assessment submission.
When to Reassess Your Vulnerability Management Process
The thirty-day remediation window is aggressive. If your current vulnerability management process was designed around the sixty-day window, you will need to reassess your patch-testing procedures, your change-control cycle times, and your vendor escalation protocols.
Signs that it is time to reassess your process include:
- Vulnerability scan reports showing critical findings on internet-facing assets that remain open for more than twenty days
- Change-control backlogs that delay patch deployment beyond the thirty-day window
- Vendor patches that arrive late or require extensive regression testing
- A lack of documented compensating controls for vulnerabilities that cannot be patched within thirty days
- NCA inspection findings or self-assessment gaps related to Control 5-1-1
A good outcome is a vulnerability management process that consistently remediates critical vulnerabilities in internet-facing assets within thirty days, documents compensating controls with the evidence format described above when patching is delayed, and maintains a compliance posture that satisfies NCA inspectors during annual assessments.
How the Firm Supports NCA Essential Cybersecurity Controls Compliance
The firm offers a compliance assessment, remediation and self-assessment support service for the NCA Essential Cybersecurity Controls. The service provides control-by-control compliance status with evidence, a remediation plan with owners, dates and effort, policies and procedures aligned to the 2024 controls, support through the NCA self-assessment, and a baseline you can re-measure every year.
The assessment takes six to ten weeks and delivers a compliance assessment report, a remediation plan and tracker, a policy and procedure set, self-assessment submission support, and an executive summary.
If your organization complied with ECC-1:2018, the firm maps your existing compliance to the new controls so you only address what is actually new or different.
