Cybersecurity compliance is an important responsibility for government entities and organizations operating critical infrastructure in Saudi Arabia.
The National Cybersecurity Authority (NCA) establishes cybersecurity controls to protect information systems, digital assets, and essential services across the Kingdom.
For organizations preparing to meet NCA ECC compliance requirements in Saudi Arabia, understanding the applicable controls, implementation expectations, and assessment process is essential.
This guide explains NCA ECC-2:2024, its applicability, the four cybersecurity domains, and the practical steps needed to prepare for compliance assessments.
What Is NCA ECC-2:2024?
The Essential Cybersecurity Controls (ECC-2:2024) are cybersecurity requirements set by Saudi Arabia's National Cybersecurity Authority.
The framework establishes baseline controls designed to protect the confidentiality, integrity, and availability of organizational information and technology assets.
ECC-2:2024 replaces the earlier ECC-1:2018 version and contains:
- 4 main cybersecurity domains
- 28 cybersecurity subdomains
- 108 main controls
- 92 subcontrols
Who Must Comply with NCA ECC in Saudi Arabia?
Under the framework, NCA ECC applies to:
- Saudi government agencies, ministries, and authorities
- Companies and entities affiliated with applicable government organizations, including those operating outside Saudi Arabia
- Private-sector organizations owning, operating, or hosting Critical National Infrastructure (CNI)
Organizations outside the mandatory scope are strongly encouraged by the NCA to adopt the controls as cybersecurity best practices.
Other sector-specific cybersecurity regulations may also apply.
The Four Main NCA ECC Control Domains
The NCA Essential Cybersecurity Controls are organized into four primary domains.
| Domain | Key requirements |
|---|---|
| 1. Cybersecurity Governance | Cybersecurity strategy, policies, responsibilities, risk management, awareness, and compliance oversight |
| 2. Cybersecurity Defense | Asset protection, access control, network security, vulnerability management, monitoring, and incident response |
| 3. Cybersecurity Resilience | Cybersecurity considerations in business continuity, recovery, and operational resilience |
| 4. Third-Party and Cloud Computing Cybersecurity | Supplier cybersecurity, outsourced services, and applicable cloud security controls |
Cybersecurity Governance
Organizations must establish appropriate cybersecurity management arrangements, approved policies, defined responsibilities, and risk management practices.
The framework also addresses cybersecurity awareness, periodic reviews, and independent audits.
Cybersecurity Defense
This domain focuses on protecting systems, information, networks, and technology infrastructure.
Relevant controls address identity and access management, endpoint security, encryption, vulnerability management, security event monitoring, and incident handling.
Cybersecurity Resilience
Organizations must incorporate cybersecurity requirements into business continuity management to support recovery from disruptive cyber incidents.
Third-Party and Cloud Security
Organizations must manage cybersecurity risks associated with suppliers, outsourced services, and cloud computing. Specific controls depend on the organization's activities and technology environment.
Suppliers to Saudi Aramco also face a separate third-party requirement. Our Aramco CCC requirements checklist explains how to prepare.
NCA ECC Compliance Readiness Checklist
Preparing for NCA cybersecurity compliance requires both documentation and evidence of effective implementation.
1. Determine Framework Applicability
Confirm whether ECC requirements are mandatory for your organization and identify any additional NCA controls that apply to your systems or operations.
2. Conduct an NCA Cybersecurity Gap Assessment
Evaluate your existing policies, processes, and technical safeguards against applicable ECC-2:2024 controls. Document the current compliance position, missing requirements, and priority risks.
3. Establish Governance and Risk Management
Develop or review your cybersecurity strategy, governance arrangements, risk assessment methodology, policies, and assigned responsibilities. Ensure the necessary management approvals are documented.
4. Implement Technical Security Controls
Review the implementation of applicable safeguards, including:
- Identity and privileged access management
- Endpoint and network protection
- Vulnerability and patch management
- Security logging and monitoring
- Backup and recovery arrangements
- Incident response procedures
5. Organize Compliance Evidence
Maintain reliable records demonstrating that cybersecurity controls are implemented and operating as required. Evidence should be current, traceable, and relevant to the assessed controls.
6. Perform an Internal Readiness Review
Review the effectiveness of implemented controls, document outstanding findings, and verify corrective actions before the applicable regulatory assessment.
Documents and Evidence Required for NCA ECC Compliance
The exact documentation depends on the applicable controls and organizational environment. A practical NCA compliance checklist may include:
| Documentation | Purpose |
|---|---|
| Cybersecurity strategy and policies | Demonstrate approved governance arrangements |
| Cybersecurity risk register | Record identified risks and treatment decisions |
| Information asset inventory | Identify and manage relevant technology assets |
| Access control and security records | Demonstrate implementation of technical controls |
| Vulnerability assessment reports | Support vulnerability management activities |
| Incident response and recovery records | Demonstrate operational preparedness |
| Internal audit and compliance reports | Document findings and corrective actions |
Assessors may request additional evidence depending on the applicable requirements.
Maintaining policies without implementing the related controls is not sufficient to demonstrate compliance.
Common NCA Cybersecurity Compliance Gaps
Organizations preparing for NCA assessments may encounter several recurring challenges:
- Unclear responsibilities: Cybersecurity ownership and reporting arrangements are not adequately established.
- Incomplete risk assessments: Technology risks are not consistently identified, documented, or reviewed.
- Weak implementation evidence: Security tools and policies exist, but supporting operational records are missing.
- Insufficient third-party oversight: Supplier and cloud-related cybersecurity risks are not adequately assessed.
- Unresolved audit findings: Identified weaknesses remain open without documented corrective actions.
A structured gap assessment can help organizations prioritize improvements according to regulatory requirements and cybersecurity risk.
How Is NCA ECC Compliance Assessed?
The NCA evaluates compliance using mechanisms such as organizational self-assessments, compliance reporting, and field audits, according to its applicable procedures.
The National Cybersecurity Services Portal, Haseen, supports relevant cybersecurity assessment processes for registered entities.
Organizations should maintain updated compliance records and address findings through documented remediation activities.
NCA ECC is a regulatory control framework, not a conventional ISO-style certification program. Organizations should not assume that completing a consultancy assessment results in an NCA-issued compliance certificate.
Prepare for NCA ECC Compliance with Nour Solutions
Meeting NCA cybersecurity requirements involves more than documenting policies. Organizations need effective security controls, clear governance, reliable evidence, and ongoing compliance management.
Nour Solutions supports organizations across Saudi Arabia with NCA cybersecurity gap assessments, compliance documentation, risk management, control implementation, and assessment preparation. Formal compliance evaluations remain with the NCA.
Based in Al Khobar, we support businesses and organizations in Dammam, Jubail, Riyadh, Jeddah, and other Saudi markets.
Explore our NCA, SAMA & CST Cybersecurity Compliance Services and our Cybersecurity Assessment & Audit services to understand how we can help strengthen your organization's cybersecurity compliance readiness.
Frequently Asked Questions
Is NCA ECC mandatory for all companies in Saudi Arabia?
No. The framework is mandatory for organizations within its defined scope, including applicable government entities and private organizations owning, operating, or hosting critical national infrastructure. Other organizations are encouraged to adopt its controls.
What is the difference between ECC-1:2018 and ECC-2:2024?
ECC-2:2024 is the updated version of the Essential Cybersecurity Controls, incorporating revisions to the previous framework and its cybersecurity requirements.
What is an NCA cybersecurity gap assessment?
It is a structured evaluation comparing an organization's existing cybersecurity controls against the applicable NCA requirements to identify gaps and prioritize remediation.
Does NCA ECC require cybersecurity documentation?
Yes. Applicable controls require documented policies, procedures, governance arrangements, and supporting implementation evidence.
Can a cybersecurity consultancy support NCA ECC implementation?
Yes. Consultants can assist with framework applicability reviews, gap assessments, policies, technical remediation, evidence preparation, and assessment readiness. Formal regulatory evaluations follow the NCA's applicable procedures.