The deliverable library, released on your clearance

NCA ECC 2024 Self Assessment ToolKit

This workbook lets an entity assess and evidence its compliance with the NCA Essential Cybersecurity Controls (ECC-2:2024) and produce a defensible position for regulatory review. The control text is reproduced in full from the NCA's published document. Nothing is summarized or paraphrased. What makes it different from a standard checklist: Scoring you can defend. For the 24 main controls that have subcontrols, the score is not entered — it is the count of subcontrols met divided by those applicable. A control cannot be marked Implemented while its subcontrols remain open. Claimed vs verified compliance, side by side. Verified counts only controls whose evidence has been tested (tier T3 or T4). The gap between the two lines is the honest measure of how much of the position rests on assertion. Two scoring bases. The authoritative figure runs on the 108 main controls; an all-items view over 200 rows tracks progress at finer grain. Lifecycle analysis. Every control is tagged Define, Implement, Specify or Review from its own wording, revealing whether weakness sits in writing requirements, implementing them, meeting minimum content, or reviewing them. No hidden constants. Every weight, threshold and dropdown lives on a visible Config sheet and is referenced by formula. Change the model by editing an input, not a formula. Full traceability. Any dashboard figure resolves down to a domain table, a register row, an evidence ID, and an assessor with a date and method. Contents (13 sheets): Cover · Methodology · Executive Dashboard · Compliance Analytics · Subdomain Heatmap · Control Assessment · Evidence Register · Statement of Applicability · Remediation Plan · Assessment Log · Change Log · Chart Data · Config