Table view of principles and related guidance

Created:  28 Jan 2018
Updated:  28 Jan 2018
A tabular breakdown of the Objectives, principles and underlying guidance.

This page is intended as a handy summary of the 14 NIS principles and their related external guidance. Each individual principle page contains detailed introductory material which you should review before consulting the guidance referenced here.

Objective A. Managing Security Risk


Guidance and references

A1. Governance


NCSC Introduction to Security Governance

ISO 27001

IEC 62443-2-1:2011

A2. Risk Management

NCSC Risk Management Guidance

NCSC assurance blog

NCSC Penetration Testing Guidance

NCSC Cloud Security Collection: Having confidence in cyber security

NCSC Risk frameworks and methods

A3. Asset management

ISO 27001
ISO 55001 - Asset Management

A4. Supply chain

NCSC Supply Chain Security

NCSC cloud security principle 8: supply chain

Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR)


Objective B. Defending systems against cyber attack


Guidance and references

B1. Service protection policies and processes


CPNI's Personnel and People Securinty

ISO 27002:2013 section 5 & 7

IEC/TS 62443-1-1 section 5.8 & BS IEC 62443-2-1:2011 section

SANS blog post

SANS security policy templates

HP & University College London whitepaper The Compliance Budget 

B2. Identity and access control

CPNI physical security guidance

NCSC Security Design Principles for Digital Services 

NCSC Introduction to identity and access management

BS ISO/IEC 27002:2013 section 9

BS IEC 62443-2-1:2011

NIST Identity and Access Management publications

B3. Data Security

NCSC 10 Steps Mobile devices and removable media

NCSC End user device management guidance

BS ISO/IEC 27002:2013 section 8

BS IEC 62443-2-1:2011 section  

ENISA Big Data Security (2016)

B4. System security

NCSC Reducing the impact of common cyber attacks

BS IEC 62443-1-1:2009

BS ISO 27002:2013

NCSC 10 Steps malware prevention

NCSC penetration testing guidance

NCSC obsolete platform guidance

NCSC Secure by default platforms


B5. Resilient Networks & Systems


BS ISO 27002:2013 section 17

PD ISO 27019:2013 section 14

IEC/TS 62443-1-1

BS IEC 62443-2-1:2011 section 4.3.2

HMG Emergency preparedness

HMG Emergency Response and Recovery

BCI  introductory business continuity guidance


B6. Staff Awareness & Training

CPNI's guidance on developing a security culture

GCHQ certified training scheme

NCSC 10 Steps: User Education and Awareness


Objective C. Detecting cyber security events



C1. Security Monitoring

NCSC 10 Steps: Monitoring

NCSC - SOC Buyer's Guide

CREST - Protective Monitoring Guidance

NIST - Continuous Security Monitoring

NIST Guide to Intrusion Detection and Intrusion Prevention Systems

ISO 27002 / 27019

IEC 62443

C2. Anomaly Detection All in-page


Objective D. Minimising the impact of cyber security incidents



D1. Response and Recovery Planning


NCSC 10 Steps: Incident Management

NIST Computer Security Incident Handling Guide 

Part 4 of CREST Cyber Security Incident Response Guide

Part 4 ISO 27035

CIR scheme


D2. Improvements


NCSC 10 Steps: Incident Management

Chapter 8 of ENISA Good Practice Incident Management Guide  

Parts 2-3 of ISO 27035.

Section 3 of NIST Computer Security Incident Handling Guide 

Part 6 of CREST Cyber Security Incident Response Guide





< Back to Principle D2                 Forward to NIS Collection >

Was this guidance helpful?

We need your feedback to improve this content.

Yes No