Most NCA ECC projects do not fail because the controls are unclear. They stall because evidence collection consumes the people who also run the environment. This article describes an NCA ECC compliance implementation method built around that problem, so that it is clear what happens, who takes part and what you hold at the end of each phase.
The framework in question is the Essential Cybersecurity Controls issued by the National Cybersecurity Authority (NCA). The current version is ECC-2:2024. Our NCA Essential Cybersecurity Controls service provides compliance assessment, remediation and self-assessment support, with readiness measured control by control.
Why ECC projects stall
Three patterns recur. Evidence requests arrive as one large spreadsheet with no guidance on what an acceptable artifact looks like. Remediation starts with policy rewriting when a configuration change would have closed the gap. And the work is treated as a one-off event, so nothing remains to re-measure next year.
The method below addresses each of these directly. It is organised in four phases, and the assessment portion takes 6–10 weeks.
Phase 1: Discovery and control mapping
What happens. We run structured workshops that walk through the controls and match them to the processes, tools and documents you already have. The aim is to avoid asking you to create anything that already exists in another form.
Who takes part. Your CISO or security lead, IT operations, and the owners of the relevant processes such as access management, backup, vulnerability handling and incident response. Attendance is limited to the sessions that concern each person's area.
What you hold at the end. A control-by-control view of where you stand, showing which controls are covered by existing practice and which are not.
If your organisation complied with ECC-1:2018, this phase matters even more. The structure and several requirements changed in ECC-2:2024. We map your existing compliance to the new controls so you only address what is actually new or different.
Phase 2: Evidence collection
What happens. Evidence is requested asynchronously, control by control, with a clear description of the artifact expected for each. Where possible, you provide what you already produce: exports, screenshots, approved documents, tickets and reports in their current formats. We review what arrives and return specific questions rather than general chasers.
Who takes part. Control owners respond when their schedule allows. Each request is small and scoped to a single owner, so no one is pulled into long working sessions.
What you hold at the end. A compliance assessment report that gives the control-by-control compliance status with evidence. Each status can be traced to an artifact, which is what makes it defensible in front of the regulator and your own board.
Phase 3: Gap remediation
What happens. Findings are turned into a remediation plan with owners, dates and effort. We sequence it so that quick wins come first: configuration changes, enabling existing logging, tightening access settings and closing small procedural gaps. Larger architectural changes follow, planned with realistic effort estimates so they can be scheduled around operational priorities. Policy and procedure work is aligned to the 2024 controls and is written to reflect what your teams actually do.
Who takes part. Named owners for each remediation item, typically system administrators, network and security engineers, and policy approvers. Your CISO decides priorities and accepts any residual risk.
What you hold at the end. A remediation plan and tracker that show status at any moment, together with a policy and procedure set aligned to the 2024 controls.
Why configuration comes before policy
A policy that describes a control which is not yet implemented creates a new gap. Doing the technical changes first means the policy documents describe a real state, and the evidence you collected can be cited in them.
Phase 4: Self-assessment package and submission support
What happens. We assemble the material needed for the NCA self-assessment: control statuses, evidence references and narrative explanations drafted for each control. We support you through the self-assessment process itself.
Who takes part. Your CISO and the executive sponsor review the package and provide sign-off. Control owners are contacted only if a narrative needs factual confirmation.
What you hold at the end. A submission-ready package, an executive summary for senior leadership, and a baseline you can re-measure every year.
What client time looks like
Client effort is concentrated where only your people can contribute: workshop attendance in discovery, short evidence responses, execution of remediation items that touch your systems, and final review. Document drafting, evidence review, tracker maintenance and package assembly sit with us. The point is to keep security and IT teams on their operational responsibilities while the programme advances in parallel.
Full list of deliverables
- Compliance assessment report
- Remediation plan and tracker
- Policy and procedure set
- Self-assessment submission support
- Executive summary
Together these give you control-by-control compliance status with evidence, a remediation plan with owners, dates and effort, policies and procedures aligned to the 2024 controls, support through the NCA self-assessment, and a baseline you can re-measure every year.
Next step
If an ECC deadline is approaching and your technical teams cannot be spared for weeks of evidence gathering, the NCA Essential Cybersecurity Controls service is the place to start. Contact CISO Consulting to discuss your current ECC position, including any earlier ECC-1:2018 work, and how the assessment would be scoped.
