NCSC Risk Management Measures (RMMs)

Maintain a complete inventory of all IT assets, software, and system configurations.

Identify, assess, and remediate vulnerabilities in systems and software.

Apply security patches and updates to systems and software in a timely manner.

Maintain secure baselines and monitor system configurations for compliance.

Enforce least-privilege access and maintain role-based permissions.

Implement multi-factor authentication and secure identity management.

Use encryption to protect data in transit and at rest.

Implement comprehensive logging and real-time security monitoring.

Detect security incidents and respond within defined timelines.

Manage cybersecurity risks from third-party suppliers and service providers.

Embed security in software development and system acquisition.

Maintain backup and recovery capabilities for critical systems.

Implement controls to protect personal and sensitive data.

Manage access control and personnel security responsibilities.

Provide cybersecurity training and awareness programs.

Audit and monitor supplier compliance with security requirements.